I'm not sure why everybody here seems to think that sites need to fork over all date they have on store via e-mail if a registered user requests it via e-mail.
A site could easily be compliant by answering general questions (this is what kind of data we have, this is how we collect it, this is what we need it for, this is our legal basis) via e-mail but requiring data exports to be performed via the site itself.
The GDPR actually encourages sites to provide automated self-serve data export mechanisms. The entire point of being able to request a copy of your data is data portability.
"But what if the user never signed up?", I hear some people ask. Why did you collect their data in the first place? If you collect sensitive data like that described in the BBC article, you better have explicit consent and if you have explicit verifiable consent, you should be able to verify a request is made using the same identity that granted the consent (be it an e-mail, a phone call or a signature). So just ask for that again.
Also, if you can't easily comply with a data request because the data is so sensitive and the identity can't easily be verified, you can still explicitly say so. Describe the kind of data you have and offer to delete it, then offer whatever form of authentication is adequate given the level of sensitivity of the data in question should they still demand it.
I'm not sure why some people seem to think this is particularly unreasonable. Just because it isn't code, doesn't mean you have to reinvent authentication from scratch. Think of how you identify someone before you agree to store their data. You already do that for all other business processes, why should data requests be any different?
EDIT: Also if you figure you can't easily verify someone's identity after you took their data, that sounds like a good reason not to take their data in the first place. And that's the entire point of the GDPR: minimising personal data. The GDPR makes personal data toxic and that's intentional. Just like toxic substances you need special precautions for handling and storing it, and you probably want to avoid both unless absolutely necessary.
Disclosing data to an individual because you make no attempts to verify their identity is in itself a GDPR violation. As far as the GDPR is concerned it doesn't matter whether you were hacked or whether your employees recklessly exposed information to individuals. The only difference is scale and scope.
It's even worse than that. Sure, a chunk of the video's initial ad revenue will be lost over illegitimate claims but if the video is restricted, the video is basically dead. Most videos get the lion share of their views in the time immediately after they're uploaded (i.e. the first day or week). If the video gets stuck in limbo, not only isn't the creator making any money but also the video will underperform and any cost of producing that video will have virtually no return on investment.
So in other words, smaller channels can easily get stuck producing worse content because the risk of investing significant amounts of time into a single video is too great. And even when channels don't rely on monetisation, lost exposure can limit their reach and harm their growth.
Nope, the problem is that disputes can be (and routinely are, by default) rejected by the claimants with no risks to them, again. Escalating beyond that risks a copyright strike (three of which mean your channel is gone, but even a single strike costs you access to various features).
The best approach is to only escalate if you understand the specific legal situation of your video and can make a case that would likely hold up in court. Needless to say most creators aren't well-versed in legalese and the risks to the creator are much greater than the risks to the claimant so most creators avoid this for "less important" videos.
I don't know whether you're trolling or simply naive but that's clearly fraud and the scenario you describe explicitly aims to commit fraud.
At the very least it's violating the terms of service. But very clearly the two of you would have conspired to defraud GitHub and in this case there would even be evidence in the form of an HN comment where you literally ask if this would work.
You may think you're clever but trust me when I tell you that no, you're not, and I've seen enough people try to be exceptionally clever and think "plausible deniability" would cover their butts and then get sued for fraud.
I think it's really cultural. Nintendo doesn't "get" online gaming because it's fundamentally different from Nintendo's DNA.
Nintendo is about children and families and friends playing together. Online gaming is about playing in a global community of millions of strangers who may become friends or turn around and spoil everything.
That risk is accepted by gamers who play multiplayer online games, especially competitive games with online matchmaking, but it doesn't fit in the "we're all friends and family" narrative.
I think it's brilliant. Looking at the concept video, it seems like local coop multiplayer is built right into the controller but they also show local network multiplayer for parties and competitions. It's trivial and emphasised by the design choices.
Games that do online multiplayer well generally don't work well with local multiplayer. What works well for one doesn't necessarily work well for the other. This reminds me of GameBoy link cables and 1990s LAN parties -- and I think that's an aspect of gaming that has been neglected by other companies who favoured the online experience.
Also it makes perfect sense for Nintendo not to attempt to get a foot in the door in an oversaturated market they don't have any experience in. This is the first time since the original Wii that I've been genuinely surprised by Nintendo and it looks a lot less gimmicky.
("fairly new" in this case meaning over five years but still)