So amidst all the weeping and gnashing of teeth as reddit admins confirm that any destructive protest is very obviously against the rules, no matter how "well ackshually" you get about it -
one bright spark happens upon something that probably could seriously disrupt reddit's ability to function. I don't know where this comment is from originally, but this screenshot was posted -
Most of these are pointless because ever since mods kept getting hacked and the hackers kept fucking up their subreddits, the admins have an ability to revert all these changes. The one this person has hit on is GDPR DSARs.
EEA users (well, anyone really) can request a GDPR Data Subject Access Request for their personal data.
Reddit even has a form for it so you don't have to write an email.
(they also have a
beefier form and an email address). People often misunderstand what GDPR access requests can do (you can't use it to see an admin's private messages about you, for example).
They have to respond within 30 days (that can be to extend the full response deadline if it's a complicated case, but you still have to respond within that 30 days). While this might be part automated -
(most reddit comments wouldn't necessarily be "personal data" but they'd be pulling all of them to avoid having to process them further) they probably have a human being doing at least some of it. You can't decline subject access requests just because they're vexatious (unless it's one person spamming for various requests loads) and failure to conform can result in a fine of €20mil (£17mil/$21mil) or 4% of annual turnover, whichever is higher.
If the jannies got a GDPR spam fest going, Reddit Inc. would actually have to move employees onto dealing with it or hire additional temporary staff to deal with the GDPR blitz. The back up option of blocking EEA users (like some American websites do, to avoid dealing with GDPR) wouldn't work as they already have European users' personal data (and they're not about to block ~10% of their traffic either).
Additionally the data subject can request the permanent deletion of all their personal data.
It's very much the nuclear option for the jannies because if they got that ball rolling, there wouldn't be any stopping it if reddit
did cave on the API - since the pissed off users would be on a bandwagon at that point. It'll be interesting to see if this tactic does get any traction (since explaining it to users is a bit more complicated than "post John Oliver pics lol"... but GDPR-as-protest (if this does catch on and reach public consciousness) could prove seriously disruptive to the longer term functioning of
any social media site that has users that might decide to bandwagon against it some day.
