So if I understand GDPR correctly: If I want a service/business to remove all my personal data, they have to comply with it in a certain timespan or get in trouble with the law.
If I understand federation correctly: All posts get replicated on federated instances all over the fediverse.
My question: If I e.g. want lemmy.world to remove my data, all my posts etc are still up on lemmy.ml right? As they just have a copy of these posts?
Would I as a customer have to contact every single instance to get my data removed? Or how does GDPR compliance work with lemmy?
Or am I completely misunderstanding how GDPR works?
You must log in or register to comment.
This was discussed in depth yesterday, removing per rule #4.
It sorta depends on the relationship between federated servers. If your server acts as a data controller and the servers it federated with act as a data processor, then yes indeed your admin would have to contact all those servers to get that data removed.
But I don’t think that’s what the relationship really is. I think your server publishes that data effectively publicly. At that point other servers can take a copy if they want (ie each would be a controller). So you’d have to make a request to each server to get the data removed.
Think about it like this, if you allow some print publication to print your name for some reason, some other companies might keep a copy of that data. Eg an archival company, or perhaps something less nice like a sales company. The publication doesn’t have a responsibility to contact them all. Even if, say, they have some relationship, like federation, or for example archival company has a subscription to the newspaper.
So if you want that data deleting you’re going to have to contact every sever that has it.
Yeah, that sounds like the most correct take. I don’t think the EU will be happy with that if ActivityPub really blows up. e.g. if Threads joins the federation (and we don’t defederate from their data leeching service), that would become really really complex :)
Yeah that really could end up being problematic!
Actually not sure how that’s going to go… presumably it’ll work the same way search engines do cos it’s kinda like holding a copy of public data like they do…
Think of it this way. The way I see it federation is similar to an archival service storing a copy of the data. If reddit deletes all info when requested, but archive.org doesn’t delete it. Well it ain’t reddit’s problem anymore.
Similarly, if a user request data deletion of data in their home instance located in the EU, and as long as the instance honors the request, that instance are not liable for other instances not honoring the deletion request. You might have to request data deletion with each individual instance that has a copy of your data, and it’s only enforceable if the instance is in the EU where GDPR applies.
That’s my interpretation, correct me if I’m wrong.
If archive.org, or any other web scraper is able to pull personal information from a site, it means that the site is already breaking the GDPR.
GDPR protects personal information, not public texts.
Because instance holds identifying information about EU citizens (email, nickname), it means that the instance owner is the registery holder, and they must comply with GDPR.
I believe email address of the user is not shared between the instances, what makes things quite good. Nicknames are bit more problematical, because they can be considered as personal identifier.
Some GDPR experts maybe should write template registery document that instances can use. And the delete of account should be handled between instances. Posts do not need to be deleted, but nick should be changed to [deleted]
That sounds like a good take. I have no idea if it’s correct, but it sounds reasonable.
So I’d have to contact every single instance to get rid of my data, which sounds reasonable, but is practically speaking absolutely impossible.
Lemmy just sounds like a GDPR nightmare for the EU tbh.
Not sure if this is the right community to ask? It’s not really a technical support question, just a general lemmy question.
It isn’t a single site or host, and there is no owner. Wouldn’t that be like saying “e-mail must be GDPR compliant”?
Not as if the GDPR cares about that specifically. Whatever excuse or justification you might have, the law still applies… Mail servers also have to comply with the law.
To the point of the person you’re replying to, I think it may be treated the same as email. For example, if you send an email and it gets forwarded somewhere else, all the “custodian of your data” (lets say google in this example) can do is delete any copies they have on their server. Anything outside of that is outside their responsibility/capacity.
The solution will be really simple and probably arrive in the next 12 months.
You just federate the removal requests too as part of the Lemmy API.
That feels potentially incomplete, because there’s still the question of how to deal with an instance that refuses to honor federated removal requests, or which claims to but lies and secretly keeps a backup. If for example the legal/regulatory system was to decide that the original instance was responsible for ensuring user data is deleted even from federated servers, then the potential existence of such non-deleting servers would be a huge problem for the network as a whole.
As soon as the content moves to another server, it’s their liability to comply.
If you scrape a website, them removing a user’s PII in response to a GDPR request is not contingent on you also deleting what you scraped.
Federation of removal requests would simply ease the flow of compliance for both hosts and users.
If certain hosts decide to ignore the requests and the GDPR, that’s up to them.
Someone correct me if I’m wrong but GDPR doesn’t apply fully to small organizations (less than 250 employees) and mostly only applies if you offer goods and services which is not the case if you’re running a Lemmy instance. If you’re an instance owner with no employees because you’re not a registered business of any sort, you’re not on the hook for anything
Then again, I am neither European or knowledgeable in GDPR so someone please correct me if I’m wrong.
Edit: I am wrong see below
This is incorrect, GDPR is any registery, company size or even profit/nonprofit is not relevant. Even it being digital/in paper is not relevant. If EU citizen is identifiable in registery, it must comply with GDPR.
Apologies and thank you for the clarification, I was reading an earlier draft of GDPR that had information on companies with fewer than 250 employees. Not sure how Lemmy instances fall under this though, do you know?
Businesses that are not engaged in processing of the personal data listed in Article 9 or Article 10 do not need to appoint a data protection officer (DPO or DPO as a Service) unless they are engaged in regular and systematic monitoring of data subjects on a “large scale”.
That quote from GDPR talks about specific job role that large company is by-law requires to have, called data protection officer. He/She is responsible that company is GDPR compliant.
Why do you think Lemmy is GDPR compliant?
No idea. That’s why I am asking.
I just feel that if Lemmy keeps growing, the EU will eventually take notice and consider implementing requirements/measures/regulations…
But I guess it’s not just lemmy, but also any other fediverse (or any other decentralized) service. Just curious
Practically speaking, can they actually regulate it, beyond going after instance owners that are themselves based in the EU? I mean, they can pass laws, but given that instances are not large companies that might want to do business in Europe, I’m not sure what stops an instance owner not located within their jurisdiction from just ignoring them and not paying any levied fines or similar. They could require ISPs then block that instance or something I suppose but keeping up with an evolving list of tiny websites that don’t necessarily advertise themselves much and so might slip under regulator’s radar for awhile is probably much more difficult to block compared to a single corporate run site.
Not that I’m suggesting that Lemmy shouldn’t make an effort to comply with regulations requiring people be able to delete their data, if anything, such a system if successful would make it harder for companies to take advantage of it by setting up servers to secretly collect what data they can, for example, I’m just questioning if it’s really possible for a government to meaningfully enforce rules on some small group of random mostly volunteer people who may likely be operating from another country anyway.
