cross-posted from: https://programming.dev/post/251752
It is important to note that although this may be a result of Reddit’s UI not displaying the content users posted to now-private subreddits, it remains a problem. Additionally, I agree with the author’s comments in the video description, as it appears strategically unrealistic for Reddit to ask that users manually delete the content themselves.
This is particularly true when considering that many automated methods to accomplish this task will be hindered by Reddit’s upcoming API pricing changes. Furthermore, Reddit has demonstrated a recurring pattern of rolling back databases using historical backups, thereby disregarding user deletion requests that were submitted prior to the database rollback.
See similar discussion of this video on Hacker News:
as much as I’m sick of reddit, posts and comments are not PII
*Sights. Every time we discuss this. Every fucking time. * Under the GDPR are they are. See §4 part 1.
Ok? I haven’t discussed this before.
Now you did.
What about me? I want to discuss!
Not in general, maybe, but if someone posts their first name in one place, post about their neighborhood in another place, and mention their job in a third place that’s enough to uniquely identify them. Or who’s to say there isn’t a comment with someone’s full name and address?
Unless they manually scan all comments for PII, there might be PII in any comment. Even something innocuous like a picture of a sign can doxx someone, so it’s not obvious, either.
It can be, depending on whether PII was involved. Just being publicly published doesn’t make it not be PII. It can be or not be. GDPR counts PII widely, since it also includes stuff that can be combined with other information to make for identifying the person.
Frankly this is one of those cases, where we need a court ruling to set precedent on what is counted in and what is counted out.