cross-posted from: https://programming.dev/post/251752

It is important to note that although this may be a result of Reddit’s UI not displaying the content users posted to now-private subreddits, it remains a problem. Additionally, I agree with the author’s comments in the video description, as it appears strategically unrealistic for Reddit to ask that users manually delete the content themselves.

This is particularly true when considering that many automated methods to accomplish this task will be hindered by Reddit’s upcoming API pricing changes. Furthermore, Reddit has demonstrated a recurring pattern of rolling back databases using historical backups, thereby disregarding user deletion requests that were submitted prior to the database rollback.

See similar discussion of this video on Hacker News:

  • I overwrote then deleted all of my comments a few weeks ago—they were all back in their original form last week. I’ve since run the process again and already old comments are starting to reappear

    • The best part about this is that the more they do this, the more it costs them. Every action, especially disk transactions, cost them money. Just log in every day, run your deletion utility, and cost them a couple bucks more for being pricks about it.

      • That’s peanuts for them.

        If you want to hurt them, make the platform unusable. Post real looking, but garbage comments in a semi automated way (random comments every few seconds, while you’re scrolling through. Vote randomly, downvote everything on /new…

    • I believe the reddit API might not allow full discovery of comment history. At least my experience with deletion tools was that once I had the data export to check I found only a small portion of the posts from by 12 years of history were deleted despite the reddit UI and deletion tools not showing any comments remaining.

      I had to use a tool to go through the GDPR export to find all the posts and the tool has had problems due to some subs being private due to protests. I suspect a lot of people who thought they deleted their entire comment history may not have done so.

    •  taxet_   ( @taxet_@sopuli.xyz ) 
      link
      fedilink
      English
      11 year ago

      I used a small script I made by running it in the Comments and also in Posts section of Profile and it worked fine. So far none of the comments or posts have been restored, but I don’t know if it’s just the fact that I didn’t have that many comments or posts to begin with (like 5-6 posts and around 200-300 comments). Regardless, I’m still keeping my account for a bit so I can monitor for a month or two what happens. Here’s the script I used: https://pastebin.com/1w2nhCn9

      Note that my JavaScript skills are not that great, but it should work. Might need to scroll down the page first though since not all the comments/posts are necessarily loaded right away.

    • Not in general, maybe, but if someone posts their first name in one place, post about their neighborhood in another place, and mention their job in a third place that’s enough to uniquely identify them. Or who’s to say there isn’t a comment with someone’s full name and address?

      Unless they manually scan all comments for PII, there might be PII in any comment. Even something innocuous like a picture of a sign can doxx someone, so it’s not obvious, either.

      • If that is the case, then lemmy would be illegal by design, right? I can request my home instance delete my content, but it would still exist on any federated instance.

    • It can be, depending on whether PII was involved. Just being publicly published doesn’t make it not be PII. It can be or not be. GDPR counts PII widely, since it also includes stuff that can be combined with other information to make for identifying the person.

      Frankly this is one of those cases, where we need a court ruling to set precedent on what is counted in and what is counted out.

      • I find it hard to believe a court would decide that a post someone intentionally made to a public forum could be considered private information after the fact. But I suppose I’m not vary familiar with the wording of GDPR. It feels a bit like someone giving away business cards with a phone number, and being upset that people don’t return them when you ask months later. Obviously it is scummy for reddit to not delete content when requested, but that doesn’t seem to be the sort of thing the law is targeted towards

        •  variaatio   ( @variaatio@sopuli.xyz ) 
          link
          fedilink
          English
          5
          edit-2
          1 year ago

          intentionally made to a public forum could be considered private information after the fact

          Well that’s the thing. The criterion is Personally identifying information. Not private information.

          Remember GDPR includes right to be forgotten. Person is allowed to change their mind. At one point they might have wanted and agreed for that information being readily publicly available. Then they have right to change their mind “Nope, don’t want the information out still”.

          As I said. Just because it has been publicly published, doesn’t remove the protection categorization GDPR offers.

          It is just then PII you at the moment want to be publicly available. Ofcourse deleting anything completely of the net later is not possible, but the point is when informed of deletion order, that organization is not supposed to be part of the “this persons information is published, when they don’t want it” problem anymore. Company can’t control all of Internet, but they can control their own conduct and within that limit they must comply to privacy order. Even if it doesn’t perfectly swipe the information from all of internet.

          It is utterly different mentality and regime from “private/secret” or “public/its gone now” system. In this other system privacy is on going process and scale. It can move two ways instead of just unidirectionally. Person has right to ask and demand for what has been public to be made more private. As they also can choose to make private more public.

          EU and its citizens have right to choose what principles they base their privacy laws on and they chose this different kind of regime. Other regions and countries are free to choose otherwise in their own jurisdiction (though EU does this super claim of “EU data subject involved, we claim jurisdiction”)

          • Thank you for the more thorough explanation, I’m from the US and not used to these kind of sweeping consumer protection laws lol. Does that mean Lemmy is also in violation? Does deleting a post on my home instance notify federated instances to delete it as well?

            • It could affect lemmy administrators. As I understand lemmy federation does include federated removal propagation. Atleast the original instance can send federated notification to delete post or comment. Whether other instances comply is different matter. Since there is no central authority, it would be instance administrator per instance administrator obligation. Thought GDPR does propagate with data transfers. So theoretically for example EU instances might have to limit themselves to federation with instances committing to honoring GDPR notices. At which point “delete this” is not mere protocol requests, it is legal demand. Instance administrator might be held responsible for federation with GDPR non-complying instance.

              Just being nice, free and open source doesn’t free us from legal obligations. However someone would probably have to actively bring GDPR complain for anything to start happen. Free open source project is low on enforcement pole compared to big Internet businesses.

              However some GDPR compliance things might have to be implemented. For example formal declarations of adherence to GDPR, messaging of “this deletion notice comes as result of GDPR request, delete or be in violation”.

              However I would also note the PII protections are not unlimited. It does have exceptions for legal obligations, legitimate business obligations (you can’t demand business deletes all of their information, if they say need your contact information for still pending billing and so on). There is also public interests exception, aka person can’t gag order just based on “I don’t like this” should it be matter of journalistic/public interest matter. Some others exceptions also, that I don’t remember right now.

  •  shirro   ( @shirro@aussie.zone ) 
    link
    fedilink
    English
    3
    edit-2
    1 year ago

    I finally got my personal data export from reddit and am checking the comments to see what is deleted. I did a lot of passes with powerdelete as subs came out of private until nothing showed up. There are no comments showing in my profile.

    Going through the links in the export and powerdelete seems to have cleared out recent comments but if I look at links to ones from ten years ago they are mostly still there so I suspect it couldn’t find them.

    Currently running a rust version of shreddit in a container using the gdpr export to edit and delete the comments. Seems to be working though it gets exceptions on some comments behind private subs and I have to delete the entry from the csv and re-run but it will probably be patched soon.