News and Discussions about Reddit
Welcome to !reddit. This is a community for all news and discussions about Reddit.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
Rule 1- No brigading.
**You may not encourage brigading any communities or subreddits in any way. **
YSKs are about self-improvement on how to do things.
Rule 2- No illegal or NSFW or gore content.
**No illegal or NSFW or gore content. **
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding META posts.
Provided it is about the community itself, you may post non-Reddit posts using the [META] tag on your post title.
Rule 7- You can't harass or disturb other members.
If you vocally harass or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here. This includes using AI responses and summaries.
view the rest of the comments
That's illegal under GDPR, if true
If you have tangible evidence of this claim, please document it online and report it to the government
This statement is unfortunately doing a lot of work with the word “that”, even if I dearly wish it wasn't so. Like, I really wish it were that easy, it would even the playing field back to the non-corporate webmaster almost instantly.
But alas.
The GDPR doesn't have some special category where data only becomes data once you hit Submit. Article 4 literally defines “processing” to include collection, recording, and storage. So yes, depending on what the site is actually doing, it can absolutely be processing what you type before you submit anything:
https://eur-lex.europa.eu/eli/reg/2016/679/art_4/oj/eng
But that does not get you from “they captured it” to “therefore illegal.” GDPR doesn't prohibit processing personal data; it regulates how and why you can do it. Article 6 gives six possible lawful bases for processing, including consent, contractual necessity, and legitimate interests (and it is bastardizing the spirit of how these six interconnect that these companies use to skirt intent of the law):
https://eur-lex.europa.eu/eli/reg/2016/679/art_6/oj/eng
The actually interesting question is what they're capturing, why, how long they retain it, what they do with it, whether they disclosed that processing, and what lawful basis they're claiming.
That's where you can potentially have a GDPR problem.
Article 5 requires, among other things, fairness/transparency, purpose limitation, data minimization, limited retention, and appropriate security:
https://eur-lex.europa.eu/eli/reg/2016/679/art_5/oj/eng
And Article 13 requires the relevant information to be provided when the personal data is obtained. There isn't a magical “well technically the user never clicked Submit” exemption from transparency:
https://eur-lex.europa.eu/eli/reg/2016/679/art_13/oj/eng
There's also a separate ePrivacy issue if we're talking about storing or accessing information on the user's device. Article 5(3) generally requires consent unless the storage/access is strictly necessary to provide a service the user explicitly requested:
https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A62017CJ0673
And this is where the details get important again, because regulators have explicitly recognized things like short-lived, first-party “user-input” session cookies for multi-page forms as potentially falling within that necessary-function exemption. See WP29 Opinion 04/2012:
https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf
That is a very different animal from silently retaining abandoned form contents indefinitely, sending them somewhere unexpected, profiling somebody with them, or reusing them for advertising.
So if somebody actually wants to know whether their abandoned input was retained and what happened to it, GDPR gives them tools for finding out instead of having to speculate from browser behavior. Make an access request to the controller and ask what personal data they hold, the purposes/legal basis, recipients, retention period, and the source/context of the collection.
They normally have one month to respond under Article 12:
https://eur-lex.europa.eu/eli/reg/2016/679/art_12/oj/eng
If they don't respond, or the answer establishes something questionable, then you have something concrete to take to the relevant supervisory authority under Article 77:
https://eur-lex.europa.eu/eli/reg/2016/679/art_77/oj/eng
The EDPB has the list of national authorities here:
https://www.edpb.europa.eu/contact_en
GDPR is leverage, not a magical force field that prevents a server from receiving bytes. The useful part is that it gives you a mechanism to make the controller explain what those bytes became, why they kept them, and what they did with them—and a regulator to complain to if the answers suck.
I'm not saying it's illegal to collect or store.
I'm saying that if you tell them to delete your data, they must delete your data. You have a right for your data to be deleted (unless you're a politician or some extreme case).
So, if you told them to delete your data, and they kept it, then they broke the GDPR law. And if you can prove it, they're looking at tens of millions of euros in fines.