Response from Reddit regarding GDPR violation

That's not true. PII has harsher requirements, but personal data is not just PII

Please tell us whether you'll get a response.

If you replace www with old it still works though

Yeah they don't allow access from VPN unless signed in or if you replace www with old in the URL. They want to know who you are!

Started a few months ago. But you can bypass it with the old subdomain

Long tale short, it depends, but likely yes unless reddit stops what it is doing.

Almost every post will contain experiences that could identify someone, so the wisest move would be to assume yes, or naively try to classify each post as 'bread-crumb' or 'not bread-crumb' for their specific processing then store and sell each separately. Non exhaustive list of personal data criteria:

• If the comments are tied to, or not stored separately from, your identifiers, (email, IP, handle, site ID, location, etc,) then yes
• If your comments are not anonymous or include details about you, then yes.
• If the data will be processed to identify you, then yes.
• If the data will be used to profile you, then yes.

Unique information about you, such as your subscribed sub-reddits, your browsing habits, the time spent on each link, your writing style, etc may also count as personal data if used to identify or target you.

https://gdpr-info.eu/art-4-gdpr/

(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

[...]

(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

[...]

(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;--

Yes

If this ever goes to court I doubt Reddit wants to open this can of worms, as well as every other social media company lol

People really find it hard to grasp that stuff you willingly post online in a public way can be seen by everyone. There was a thread here earlier about people flabbergasted that the admins of email services can read their unencrypted emails you send through their servers. Top response was said admins going "yes we can read your emails, no we don't, we have better things to be doing with our time."

Lemmy (not for profit social media) protects your privacy less than Reddit (corporate social media)

I'd rather not throw up my hands in defeat though thanks

Is that an EULA? I thought that was for buying software? I mean I'm pretty sure we have other forms of contracts here in the EU?! Like Terms of service.

Is that a known fact about Reddit's terms of service / "EULA", or something you made up?

And some EULA's are valid in the EU. Just not the American ones that you get to read after you bought something.

I think this is the issue here. OP is mixing content copyright with the GDPR. But the GDPR regulates personal data, not copyright on text. And that's what Reddit is trying to sell, the content of posts, not their user's personal data... So the GDPR doesn't apply to that. Hence Reddit say they aren't violating anything, because the copyright is in the ToS.

I think that's also my issue with the original letter. It wants to sound official and legalese, but it confuses several things. Intellectual property, copyright and privacy /data protection laws. I don't think the author(s) understand the GDPR. It includes a definition what personal data is. And the letter is mostly talking about something unrelated. Also there are additional requirements. For example identifiability. And they also fail to address any of that... I also don't like some of the things Reddit does, but I think this is just not a well reasoned argument. If I were in customer support or a lawyer, I'd brush it off, too.

GDPR doesn't care if they make money on the data. But in practice they do go after the bigger offenders, who often make billions of euros (and have been fined over a billion euros)