Practically speaking, can they actually regulate it, beyond going after instance owners that are themselves based in the EU? I mean, they can pass laws, but given that instances are not large companies that might want to do business in Europe, I’m not sure what stops an instance owner not located within their jurisdiction from just ignoring them and not paying any levied fines or similar. They could require ISPs then block that instance or something I suppose but keeping up with an evolving list of tiny websites that don’t necessarily advertise themselves much and so might slip under regulator’s radar for awhile is probably much more difficult to block compared to a single corporate run site.
Not that I’m suggesting that Lemmy shouldn’t make an effort to comply with regulations requiring people be able to delete their data, if anything, such a system if successful would make it harder for companies to take advantage of it by setting up servers to secretly collect what data they can, for example, I’m just questioning if it’s really possible for a government to meaningfully enforce rules on some small group of random mostly volunteer people who may likely be operating from another country anyway.
That feels potentially incomplete, because there’s still the question of how to deal with an instance that refuses to honor federated removal requests, or which claims to but lies and secretly keeps a backup. If for example the legal/regulatory system was to decide that the original instance was responsible for ensuring user data is deleted even from federated servers, then the potential existence of such non-deleting servers would be a huge problem for the network as a whole.