reddit is telling it's future investors with recent news and more info on their IPO, that they're currently selling and looking to sell their user's data to companies wanting to train their LLMs, including Google....
That sounds like it places an undue burden onto the user to determine and explain why data might be personal. Is a particular writing style personal? Something that identifies their IP address, or time zone, or three separate messages that can be used to pinpoint someone’s identity or narrow it down significantly?
To build on the Matrix example I mentioned, they give you the ability to “redact” messages but it’s your job to hunt them down across their entire platform, and obviously you can’t look at any messages in any rooms you’ve been kicked out of (and I’m pretty sure an API call to redact them, even if you correctly guessed the ID, would be rejected).
places an undue burden onto the user to determine and explain why data might be personal
The other way around: all data originating from a person, is by default “personal data”, and the burden of explaining which one is not, lies with whoever is keeping it.
you can’t look at any messages in any rooms you’ve been kicked out of
If they’re keeping them, then you can request a GDPR export of ALL your data. Doesn’t matter whether some interface or application allows you access to the data or not, or even if you’ve been banned from the whole platform; as long as they keep the data, they have an obligation to honor your rights of:
Access
Correction/Modification
Removal
Even during obligatory data retention periods, when they can’t remove the data and only make it inaccessible, you still have the right to get a copy of your own personal data.
I really hope I’m wrong and you’re right here! I agree with you entirely in terms of what should be allowed, if it isn’t already allowed. And I definitely hope you’re correct. I haven’t recently requested a data export from my languishing Matrix account, but I might give it another go to see what kind of data is stored on my home server.
I’ve had to deal with this on the data collection end, and it’s a PITA to build in the mechanisms to fully follow the law. If you’re an EU resident, and especially if the server is in the EU or has to follow EU agreements, then they’d risk some quite high penalties if they didn’t follow it.
That sounds like it places an undue burden onto the user to determine and explain why data might be personal. Is a particular writing style personal? Something that identifies their IP address, or time zone, or three separate messages that can be used to pinpoint someone’s identity or narrow it down significantly?
To build on the Matrix example I mentioned, they give you the ability to “redact” messages but it’s your job to hunt them down across their entire platform, and obviously you can’t look at any messages in any rooms you’ve been kicked out of (and I’m pretty sure an API call to redact them, even if you correctly guessed the ID, would be rejected).
The other way around: all data originating from a person, is by default “personal data”, and the burden of explaining which one is not, lies with whoever is keeping it.
If they’re keeping them, then you can request a GDPR export of ALL your data. Doesn’t matter whether some interface or application allows you access to the data or not, or even if you’ve been banned from the whole platform; as long as they keep the data, they have an obligation to honor your rights of:
Even during obligatory data retention periods, when they can’t remove the data and only make it inaccessible, you still have the right to get a copy of your own personal data.
I really hope I’m wrong and you’re right here! I agree with you entirely in terms of what should be allowed, if it isn’t already allowed. And I definitely hope you’re correct. I haven’t recently requested a data export from my languishing Matrix account, but I might give it another go to see what kind of data is stored on my home server.
I’ve had to deal with this on the data collection end, and it’s a PITA to build in the mechanisms to fully follow the law. If you’re an EU resident, and especially if the server is in the EU or has to follow EU agreements, then they’d risk some quite high penalties if they didn’t follow it.