Aral Balkan
Folks, please do delete your X accounts, by all means, but I’d be very surprised if that meant that your data is deleted or that Elon Musk won’t be using it to train his AI, etc.
I put in a data deletion request after deactivating my account in 2022 and set the Irish DPC on them when they didn’t. After several back and forths, with the Irish DPC being less than worthless, I gave up. Afaict, there is zero enforcement of GDPR Article 17.
CC @noybeu
Aral Balkan
@noybeu Full alt text for the first image of the letter in the post above can be found at:
(It exceeds Mastodon’s character limit on alt-text.)
Nicovel0 🍉
@aral @noybeu but that’s something that could lead to a big EU fine if they pick it up
Aral Balkan
@Nicovel0 @noybeu I won’ hold my breath. The only time the EU – and especially Ireland – seems to enforce GDPR is when they’re sued by NOYB (CCed) and lose and are thus forced to, kicking and screaming.
Aral Balkan
@noybeu Specifically, as far as the Irish DPC was concerned, “all data associated with the account being rendered unavailable through Twitter’s production tools” was enough for them to consider Twitter’s obligations under GDPR Article 17 to be fulfilled and for the complaint to be “amicably resolved.”
At this point we’d had several back-and-forths and I decided it wasn’t worth my time to pursue it further given the Irish DPC’s clear lack of desire to enforce GDPR Article 17.
Aral Balkan
@noybeu Full alt text of the letter excerpts in the above post can be found at:
https://codeberg.org/aral/gists/raw/branch/main/irish-dpc-letter-details-alt-texts.txt
(They exceed Mastodon’s character limits for alt-text.)
notmybackdoorbug
@aral @noybeu I have the feeling there is almost no enforcement of GDPR, or too much enforcement of GDPR (see Dutch DPA and a soccer company wanting to live stream resulting in going bankrupt, it was way to much enforcement).
Rodrigo Pio
@aral @noybeu it's virtually impossible that any big tech would actually delete someone's data entirely from their silos, IMHO. Technically they could. But it's way too much effort to implement (with no incentive or penalty), and even more complex to audit. Once there, it will always be there, in countless representations, structures, repositories...
That strategy seems to be working pretty well for training data too (their gain, everyone else's loss).
Urzl
@rrapio @aral @noybeu At best, your data is forever "marked for deletion" and at the mercy of at least a dozen internal systems being administered well and in good faith for it to all eventually disappear.
Aral Balkan
@gooba42 @rrapio @noybeu “Good faith” or Big Tech, pick one.
Aral Balkan
@angietaylor @noybeu God* only knows. It’s a black box.
* Elon
Angie Taylor
@aral @noybeu So I guess me deleting everything with CircleBoom was a massive waste of time and money too then? :-(
Aral Balkan
@bortzmeyer @noybeu Sure, it’s called identity theft and it’s illegal. Anyone can do it on any medium that you’re not a part of.
Stéphane Bortzmeyer
@aral @noybeu Isn't it a bad advice? If you delete your account, a bad guy could register an account with the same identifier, and use (and waste) your reputation.
Samuel Hautamäki
Looks like your Data Protection Authority handled your complaint incorrectly.
You can take legal action against the Irish DPC.
Aral Balkan
@sirobsidian @noybeu Wish I had the time and money. Both are better spent on building the Small Web.
Aral Balkan
@arestelle @rrapio @noybeu Fun times :)
arestelle
@rrapio @aral @noybeu because the archives were another team's doing and responsibility so it was their problem, not the data team's 🙃
arestelle
@rrapio @aral @noybeu for a bit I worked for a tech company that handles an enormous amount of traffic and so an enormous amount of data about people's online behavior, tied to IP addresses if not users. They archived data to avoid loss, and did it in a way that deleting PII from the archives when there's a gdpr deletion request would be astonishingly time-consuming and costly, so they didn't. And the data team that was trying to work on some degree of compliance wouldn't touch that
Aral Balkan
@froge @noybeu It won’t as long as Ireland has a financial interest in pleasing Big Tech. Basically, Big Tech keeps the lights on in Ireland.
CyberFrog
@aral@mastodon.ar.al @noybeu@mastodon.social the Irish DPC being basically useless on GDPR enforcement is a hot button issue in Europe right now, from what I understand the rest of the EU is essentially applying legal pressure and threatening penalties for non-enforcement so hopefully the Irish DPC gets much better in future
Brokar
Well, i guess you had your data exported before deactivation. Why not send a separate email for every post you made, asking them to delete the 'specific data', namely the post?
I think everybody should do that after deletion. See if they react a little more forthcoming when the inbox gets flooded. And why do they think that article 17 doesn't apply to them? The only loophole i see is that they call on article 17 p.3d, for archieving purposes. But that would be a stretch before court.
Aral Balkan
@Brokar And get a 💩 reply back for each? :)
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.