gdpr privacy data-protection data-ownership database
Is Pushshift.io compliant to GDPR if they refuse to delete collected content?
<p>Pushshift.io collects posts and comments using Reddit API, and saves that data into their database. This service is used by websites that allow you to see deleted contents in Reddit. For example, if you are viewing a Reddit post and want to see the deleted contents, you can tweak the &quot;reddit.com&quot; domain a little, to enter a website that will show you all the deleted contents, using the Pushshift.io website.</p>
<p>However, <a href="https://www.reddit.com/r/pushshift/comments/pat409/comment/haifjk1/" rel="nofollow noreferrer">several</a> Reddit users from the EU are <a href="https://www.reddit.com/r/gdpr/comments/vqlrmo/comment/ieq7dk2/" rel="nofollow noreferrer">concerned</a> about this, because Pushshift.io is not respecting the &quot;right to be forgotten&quot; from GDPR, when they're asked to remove contents that belong to the user.</p>
<p>(besides that this data is being collected and stored without anyone's consent)</p>
<p>In a <a href="https://www.reddit.com/r/pushshift/comments/pat409/online_removal_request_form_for_removal_requests/" rel="nofollow noreferrer">Reddit post</a>, they say:</p>
<blockquote>
<ol start="2">
<li>What happens when a removal request is made?<br />
A) Right now, we internally blacklist the account so that the data is not exposed via any public API. For full disclosure, we currently do not permanently delete any data unless there is a major issue involving PII, etc. While you have the right to request that people cannot search your comments and submissions via the public API, we reserve the right to keep data in our private archive so long as we never allow any data that you requested be removed get exposed through any public API endpoints.</li>
</ol>
</blockquote>
<p>So they are still keeping our data against our wishes, and all it takes is their servers getting breached, for all this data to be exposed.</p>
<p>Not only that, all the data apparently can be downloaded from <a href="https://files.pushshift.io/reddit/comments/" rel="nofollow noreferrer">this page</a>, which contains compressed databases of their API. But while they remove (hide) the data from the API, that data is still available for anyone to publicly download.</p>
<p>In this <a href="https://www.reddit.com/r/pushshift/comments/xolefn/psa_even_if_you_submitted_a_removal_request_your/" rel="nofollow noreferrer">Reddit post</a>, they replied with:</p>
<blockquote>
<p>safrax MOD · 10 hr. ago<br />
Pushshift is not subject to the GDPR. No useful discussion will come from this so I'm locking the thread.</p>
</blockquote>
<p>There's also an <a href="https://www.reddit.com/r/pushshift/comments/odem3c/comment/h41i9h3/" rel="nofollow noreferrer">old comment here</a>, saying:</p>
<blockquote>
<p>GDPR only applies to websites you give your data to, not third parties that scrape it. There's no violation here.<br />
Not to mention that pushshift is US based and GDPR doesn't even apply.</p>
</blockquote>
<p><strong>Is it really correct that Pushshift is not subject to the GDPR?</strong></p>
<p>--</p>
<p>The Reddit user <code>u/Stuck_In_the_Matrix</code> is the creator of this API, and <a href="https://www.reddit.com/r/pushshift/comments/pat409/comment/hawbnn7/" rel="nofollow noreferrer">he said in a post</a>:</p>
<blockquote>
<p>I am an American but I don't see that as an excuse to violate or circumvent EU law. My intention is to observe the laws governing the GDPR and make a good faith effort to follow the law to respect and protect the privacy of residents of the EU.</p>
</blockquote>
<p>But he clearly isn't respecting EU residents' privacy, with this.</p>

<h2>Maybe, but probably not</h2>
<p>The geographic location of the organisation is immaterial: under <a href="https://gdpr.eu/companies-outside-of-europe/" rel="nofollow noreferrer">Article 3.2</a>:</p>
<blockquote>
<p>This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ... (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>
</blockquote>
<p>Posts anyone (not just EU citizens) make to Reddit (or anywhere else) while they are physically located in the EU or UK engage the GDPR. Pushift.io is therefore captured by the GDPR and any denial of that is just plain wrong.</p>
<p>Given the denial, it is likely right out of the gate that they are non-complient. For example, they are unlikely to provided the required information under <a href="https://gdpr.eu/article-14-personal-data-not-obtained-from-data-subject/" rel="nofollow noreferrer">Article 14</a>. More importantly, it seems that they have not determined the lawful basis for processing the data under <a href="https://gdpr.eu/article-6-how-to-process-personal-data-legally/" rel="nofollow noreferrer">Article 6</a> - they can possibly rely on the public interest basis (preserving deleted publication is arguably a public interest) or a legitimate interest but that requires a balancing of their interest against the data subject's.</p>
<p>That said, the right to be forgotten is not <a href="https://gdpr.eu/right-to-be-forgotten/" rel="nofollow noreferrer">absolute</a>, the reasons that might be applicable here are:</p>
<ul>
<li>The data is being used to exercise the right of freedom of expression and information.</li>
<li>The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority.</li>
<li>The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.</li>
</ul>

<p>It is quite possible that Pushshift is not subject to the GDPR. But it's impossible to know for sure until a court rules on this specific case.</p>
<p>As <a href="https://law.stackexchange.com/a/84751">Dale M's answer correctly points out</a>, we have to consider <a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">Art 3(2) GDPR</a>, since Pushshift is not EU-based:</p>
<blockquote>
<p>This Regulation applies to the processing of personal data of data subjects who are in the Union
by a controller or processor not established in the Union,
where the processing activities are related to:</p>
<p>(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or</p>
<p>(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>
</blockquote>
<p>The critical question then is whether Pushshift triggers either the Art 3(2)(a) targeting criterion or the Art 3(2)(b) monitoring criterion. The EDPB has published their <a href="https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en" rel="nofollow noreferrer">guidelines 03/2018 on the territorial scope of the GDPR</a> to help us understand this.</p>
<h2>Art 3(2)(a) targeting criterion</h2>
<p>Whether a data controller is “offering” a service depends largely on the <em>intention</em> of the controller, and mere availability of their website is not sufficient. Recital 32 (quoted below) provides relevant factors to consider, and the EDPB document summarizes further factors from case law that would suggest a targeting intention.</p>
<blockquote>
<p>[…] In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.</p>
</blockquote>
<p>The Recital 23 factors are:</p>
<ul>
<li>use of a language or currency generally used in one or more EU member states</li>
<li>mentioning customers or users who are in the EU</li>
</ul>
<p>Explicit non-factors are:</p>
<ul>
<li>availability of websites or contact details</li>
<li>use of a language generally used in the controller's country</li>
</ul>
<p>I cannot see that Pushshift would meet any of the factors that would cause GDPR to apply per Art 3(2)(a).</p>
<p>At most, it could be argued that Pushshift is so important that they should reasonably expect that their services will be used from the EU, so that they should reasonably expect themselves to be offering a service to people in the EU. But that's a rather convoluted argument.</p>
<h2>Art 3(2)(b) monitoring criterion</h2>
<p>This criterion is potentially more interesting since it doesn't rely on the intention of the data controller. But what is monitoring? Recital 24 of the GDPR explains:</p>
<blockquote>
<p>In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.</p>
</blockquote>
<p>The EDPB adds their interpretation that</p>
<blockquote>
<p>While Recital 24 exclusively relates to the monitoring of a behaviour through the tracking of a person on the internet, the EDPB considers that tracking through other types of network or technology involving personal data
processing should also be taken into account</p>
</blockquote>
<p>The EDPB gives clear-cut examples of monitoring:</p>
<blockquote>
<ul>
<li>Behavioural advertisement</li>
<li>Geo-localisation activities, in particular for marketing purposes</li>
<li>Online tracking through the use of cookies or other tracking techniques such as fingerprinting</li>
<li>Personalised diet and health analytics services online</li>
<li>CCTV</li>
<li>Market surveys and other behavioural studies based on individual profiles</li>
<li>Monitoring or regular reporting on an individual’s health status</li>
</ul>
</blockquote>
<p>There is a potential argument that Pushshift's activities do imply such monitoring, since Pushshift's service makes it possible to search for one user's Reddit comments.</p>
<p>But I think that this argument is a stretch, since Pushshift itself does not make per-user inferences based on this data. Pushshift merely takes the Reddit data and indexes it. Yes, that is processing of personal data as defined by the GDPR, but it does not seem to be “monitoring” within the meaning of the GDPR. Thus, I think it is unlikely that Pushshift is subject to GDPR per Art 3(2)(b).</p>
<h2>Conclusion</h2>
<p>For GDPR to apply, one of the cases in Art 3 GDPR must be fulfilled. Art 3(1) does not apply due to the services location. Per the above analysis, Art 3(2)(a) is very unlikely to apply since there is no evidence of an intention to offer the service to people in the EU. The Art 3(2)(b) monitoring criterion is more interesting, but after looking at the relevant factors it too is unlikely to apply to Pushshift's actual service.</p>
<p>Thus, it is likely that Pushshift is indeed free from GDPR compliance concerns, which means not having to provide a privacy notice, not having to determine an appropriate legal basis, and not having to fulfill data subject requests such as when they try to invoke a right to be forgotten.</p>
