Skip to main content


Folks, please do delete your X accounts, by all means, but I’d be very surprised if that meant that your data is deleted or that Elon Musk won’t be using it to train his AI, etc.

I put in a data deletion request after deactivating my account in 2022 and set the Irish DPC on them when they didn’t. After several back and forths, with the Irish DPC being less than worthless, I gave up. Afaict, there is zero enforcement of GDPR Article 17.

CC @noybeu

#x #twitter #gdpr #ElonMusk

reshared this

in reply to Aral Balkan

but that’s something that could lead to a big EU fine if they pick it up
in reply to Nicovel0

I won’t hold my breath. The only time the EU – and especially Ireland – seems to enforce GDPR is when they’re sued by NOYB (CCed) and lose and are thus forced to, kicking and screaming.
This entry was edited (3 days ago)
in reply to Aral Balkan

Full alt text for the first image of the letter in the post above can be found at:

codeberg.org/aral/gists/raw/br…

(It exceeds Mastodon’s character limit on alt-text.)

#altText #mastodon

in reply to Aral Balkan

I have the feeling there is almost no enforcement of GDPR, or too much enforcement of GDPR (see Dutch DPA and a soccer company wanting to live stream resulting in going bankrupt, it was way to much enforcement).
in reply to Aral Balkan

Okay, this motivated me to start the download, clean, delete process.

@noybeu

in reply to Aral Balkan

Specifically, as far as the Irish DPC was concerned, “all data associated with the account being rendered unavailable through Twitter’s production tools” was enough for them to consider Twitter’s obligations under GDPR Article 17 to be fulfilled and for the complaint to be “amicably resolved.”

At this point we’d had several back-and-forths and I decided it wasn’t worth my time to pursue it further given the Irish DPC’s clear lack of desire to enforce GDPR Article 17.

in reply to Aral Balkan

Full alt text of the letter excerpts in the above post can be found at:

codeberg.org/aral/gists/raw/br…

(They exceed Mastodon’s character limits for alt-text.)

#mastodon #altText #characterLimit

in reply to Aral Balkan

it's virtually impossible that any big tech would actually delete someone's data entirely from their silos, IMHO. Technically they could. But it's way too much effort to implement (with no incentive or penalty), and even more complex to audit. Once there, it will always be there, in countless representations, structures, repositories...
That strategy seems to be working pretty well for training data too (their gain, everyone else's loss).
This entry was edited (3 days ago)
in reply to Rodrigo Pio

@rrapio At best, your data is forever "marked for deletion" and at the mercy of at least a dozen internal systems being administered well and in good faith for it to all eventually disappear.
in reply to Rodrigo Pio

@rrapio for a bit I worked for a tech company that handles an enormous amount of traffic and so an enormous amount of data about people's online behavior, tied to IP addresses if not users. They archived data to avoid loss, and did it in a way that deleting PII from the archives when there's a gdpr deletion request would be astonishingly time-consuming and costly, so they didn't. And the data team that was trying to work on some degree of compliance wouldn't touch that
This entry was edited (3 days ago)
in reply to arestelle

@rrapio because the archives were another team's doing and responsibility so it was their problem, not the data team's 🙃
in reply to Aral Balkan

Short of bringing a JR action and getting a reference to the CJEU yourself, is it worth contacting EDPB and ask them what Art 17 requires?
in reply to Aral Balkan

Looks like your Data Protection Authority handled your complaint incorrectly.

You can take legal action against the Irish DPC.

commission.europa.eu/law/law-t…

in reply to Aral Balkan

#1 Weird Trick To End Tinnitus This Thanksgiving In Just 30 Seconds A Day

tinyurl.com/4mm9zrn7

in reply to Aral Balkan

Isn't it a bad advice? If you delete your account, a bad guy could register an account with the same identifier, and use (and waste) your reputation.
in reply to Stéphane Bortzmeyer

@bortzmeyer Sure, it’s called identity theft and it’s illegal. Anyone can do it on any medium that you’re not a part of.
in reply to Aral Balkan

This applies to 99% of companies:

#GDPR "forget me" request sent.
#DPO looks at it, tells IT guys to run the deletion
IT guys couldn't care less, wait a couple hours, go buy beers, get back and send ok email to DPO
DPO mails you "we've deleted your data"

The problem lies in #trust. And lies create a trust problem.

This entry was edited (3 days ago)
in reply to Aral Balkan

"While we are working to improve our removal processes, users may continue to request the deletion of specific data by contacting Twitter through a number of mechanisms and submitting a deletion request."

I'll bet that most/all mechanisms require that you are an active Twitter user. 🤦

in reply to Aral Balkan

NOYB EU is certainly a good start, but they are only a small team (of highly qualified and motivated experts), so you might be better off contacting a lawyer who specializes in GPDR. Winning against one of the big names could be very tempting for them too (and good for their reputation), perhaps even pro bono?
in reply to Aral Balkan

I locked my account and deleted all activity the day that Elmo decided TFG could come back if he wanted to.
in reply to Aral Balkan

I would find it interesting to see you pursuing further action together with @noybeu. Please keep us updated about anything that happens
in reply to Aral Balkan

ah, no! It’s still my major network where I target much more users than here and have also the possibility to convince beginners and new users to #opensource solutions and especially #FreeBSD at a time where they’re mostly not even aware of the Fediverse. They should come to the #Fediverse by their own will - if not, they go to #Threads or #Bsky - with a bad fragmentation.
in reply to Aral Balkan

I'm thinking we need to prepare some lobbing for mandatory "delete all content I added" button on websites
in reply to Aral Balkan

if true this could result in serious fines for X in the EU. Why did you give up?
in reply to Aral Balkan

what was the reason behind your creation of a twitter account back in the day?
in reply to Aral Balkan

I mean we are all equal before the law, but some are more equal.

If you start collecting private data, that’s against the GDPR, if they do, that’s ok.

If you scrape the web that’s illegal and you may not do this because it’s their data. If they scrape the web to train AI, that’s ok.

This entry was edited (3 days ago)
in reply to Aral Balkan

I don't use actively X/twitter anymore by years. I still maintain active the account only to corrupt the data with incoherent following, avoiding personal info about what I do and writing nonsense stuff. Just for fun with AI.
in reply to Aral Balkan

I used a script to delete all my tweets. Requested a new datadump afterwards and it was the same size. Also the counter on my profile is the same.

Really bad if the Irish didn't require Twitter to follow the law.

in reply to Aral Balkan

Well, i guess you had your data exported before deactivation. Why not send a separate email for every post you made, asking them to delete the 'specific data', namely the post?

I think everybody should do that after deletion. See if they react a little more forthcoming when the inbox gets flooded. And why do they think that article 17 doesn't apply to them? The only loophole i see is that they call on article 17 p.3d, for archieving purposes. But that would be a stretch before court.

in reply to Aral Balkan

the Irish DPC being basically useless on GDPR enforcement is a hot button issue in Europe right now, from what I understand the rest of the EU is essentially applying legal pressure and threatening penalties for non-enforcement so hopefully the Irish DPC gets much better in future
in reply to CyberFrog

@froge It won’t as long as Ireland has a financial interest in pleasing Big Tech. Basically, Big Tech keeps the lights on in Ireland.
in reply to Aral Balkan

He can have my Tweets. I would never want to train an AI on that platform. Anything intelligent I may have written would just be drowned out by widespread Idiocracy. The AI will just end up promoting crypto, sex trafficking, and funny cat videos.
in reply to Aral Balkan

@noybeu
When you can't delete your data you should overload it.
Instead of just deleting the account post nonsense.

On the one hand all data will train AI or they will be deleted because of nonsense.

You want to hide your address? Add more.

After all it's still unbelievable undemocratic how the Irish DCP blocks out European Standards. And unbelievable that @EUCommission does nothing for years.