Ask Lemmy
A Fediverse community for open-ended, thought provoking questions
Please don't post about US Politics.
Rules: (interactive)
1) Be nice and; have fun
Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them
2) All posts must end with a '?'
This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?
3) No spam
Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.
4) NSFW is okay, within reason
Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either [email protected] or [email protected].
NSFW comments should be restricted to posts tagged [NSFW].
5) This is not a support community.
It is not a place for 'how do I?', type questions.
If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email [email protected]. For other questions check our partnered communities list, or use the search function.
Reminder: The terms of service apply here too.
Partnered Communities:
Logo design credit goes to: tubbadu
view the rest of the comments
But if that were the case, wouldn't GDPR already be used to take down TOR or torrents or any other p2p tech? All it would take is someone's personal information being on them, right? (I'm really asking I have no idea)
Then you adapt to that threat with user exports or built in auto migration methods.
The distributed nature makes it much harder to down the fediverse with legal claims than it does reddit/twitter/whatever already. Just being hosted in different countries makes these claims a stunning pain in the ass, as many countries do not require any compliance with the DMCA.
Sure if you want to play in a sandbox alone and have nothing but privacy and lqbgt content (nothing against them in the least bit).
What makes it impossible? Why would any given instance maintainer be responsible for the data on someone else's instance? Would it not fall on the GDPR requester to make that request of each individual instance?
So then if someone requests that Gmail delete all their email data, is Google then responsible for making sure any emails sent out from it's server to another is also deleted from those external servers?
Just in case you guys are wondering, there’s probably dozens of us enjoying the fuck out of this conversation. Thank you for asking questions I wouldn’t think of asking. On behalf of all three of us lurking.
Lol yeah this is great.
I really want to hear the answer to this
I don't have the answer but I think of it like this.
Email is essentially a direct conversation between you and someone in the same room but you may extend (cc) to those people in the house. There is an implicit "I am including you in the conversation"
Lemmy on the other hand is more akin to talking to someone in a crowded bar but the conversation is recorded and anyone over the world has the ability to listen to the conversation at any given time.
Apples and oranges.
Interesting perspective, but then cannot we consider that Lemmy users are aware that they are including all of the Fediverse in their conversation? That way Lemmy instances could be treated in the same way email providers are
See https://gdpr-info.eu/issues/right-to-be-forgotten/
Once the "controller has made the personal data public", they have legal obligations. Gmail doesn't make my data public, generally.
Hm, I see. A shortcoming of the law, when they probably did not imagine something such as Lemmy or Mastodon happening. By the way, how does Mastodon deal with that? They've been around for much longer
I checked Mastodon briefly. It appears they are currently not in compliance. There are open issues on GitHub, but nothing looks close.
Interesting, thanks!
But the controller is not making the data public. The user is.
See https://gdpr-info.eu/issues/right-to-be-forgotten/
Once the "controller has made the personal data public", they have legal obligations. When you send an email, you are not making it public.
Essentially yes, it's called the Right to Erasure or the Right to be Forgotten. If the user is in a country that adheres to GDPR and the company controlling the data operates in a country that also uses GDPR, then that right applies.
The only reason Google/Gmail wouldnt delete (or wouldn't be able to delete) some of your data would be if they had a lawful or legitimate basis for holding onto it.
I can't think of a reason Google would give for hanging on to your data but that doesn't mean there isn't one, but they'd have to notify you of that reason as part of their response to your request.
Unless these instances are showing ads and selling data, I'm pretty sure they're protected from the law. Not only that but if you're not hosting in the EU that law doesn't apply to you.
The problem here is how does that work? If I host something in the USA, how is someone going to bring a lawsuit towards me if I am also in the USA?
Asking honest questions here. As this just sounds like a lot of chest thumping from the EU.
"Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR."
Just say, we don't provide or target EU individuals and you're free.
Don't allow users from the EU to sign up? Is that your plan?
Seems to be the plan for an increasing number of social media companies. As far as Lemmy is concerned, if it and other related services get killed, that just drives us underground to the darknet and the old tried and true chat services still being used there. As the old saying goes, can't stop the signal, and every empire falls to ruin eventually. We'll see how long it takes for Rome to crumble this time.
Wouldn't it be easier to fix the delete federation bug so Lemmy could comply with GDPR ?
No, just say in the Terms, that the target audience isn't the EU.
Yeah, but if you don't have any assets in the EU for them to seize, and if you're not present in the bloc yourself it doesn't matter for shit. They have no jurisdiction or ability to enforce unless you really, really want to operate inside of their market at scale.
See https://gdpr-info.eu/issues/right-to-be-forgotten/
Once the "controller has made the personal data public", they have legal obligations.
Yes, but "the controller" is one instance, and it's certainly easy for one instance to allow a user to be forgotten. You can purge the user from the instance. Then they are forgotten, as far as the instance is concerned.
As an example, just because someone makes a GDPR request on YouTube to delete a video, does not require Google to actually remove the video from the whole internet. There are plenty of websites that archive content which are unaffected by that GDPR request. It's the exact same thing with different Lemmy instances, just because you ask lemm.ee to delete your content does not mean that lemmy.world needs to delete your content.
The GPDR doesn't require Lemmy to remove personal data from the entire internet. But when a Lemmy instance gives data to other Lemmy instance, there are legal responsibilities.
https://gdpr-info.eu/art-17-gdpr/ Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
==========
Maybe this is open to interpretation, but I feel that the same Federation protocol that federates out my personal data (my posts and comments), should also federate out my delete requests. I'm unsure why this would be controversial.
This is a big issue of eu regulations. They are needed, but don't account for non profit initiatives, in practice favoring big players
I'm never to sure about GDPR. The spirit of the law is that any identifiable information has to indeed be removed.
However, does a Lemmy username really fit that definition? If John Doe has all of his Lemmy content under CoolNick89, I'm not sure GDPR applies.
Emails, especially if they contain first and last name, are a different story, but those would only be known by the host instance.
Interesting, thanks. I'll research this further.
IP addresses make more sense, because they can be used to be cross-checked with your ISP to know who you are.
If you don't tell anyone your username and use a VPN, there is no way for people to guess your Lemmy username
The law specifically names "online identifier".
The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier such as a name, an identification number, location data, an online identifier or one of several special characteristics, which expresses the physical, physiological, genetic, mental, commercial, cultural or social identity of these natural persons. In practice, these also include all data which are or can be assigned to a person in any kind of way. For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data.
https://gdpr-info.eu/issues/personal-data/
Thanks for the definition, and that brings us to the next question: I know your identifier, [email protected]. However, does that make you identifiable by me, even indirectly? I have no way to identify you using that information.
I always think that they meant online identifier such as [email protected], where the identifier indeed directly allows to identify the person.
The CCPA (USA version) and GDPR (EU) both specify Personal Data, not Personally Identifiable Information. So the contents of my posts are my personal data, even if my username doesn't identify to a real person. If I want my personal data removed from Lemmy, the GDPR allows for me to request it to be deleted.
Lemmy is still in the early stages. I'm not asking for changes to be made right away, or even this year. But I do feel that my personal data should be under my control. Lemmy should be programmed to federate out the the deletion of all my personal data, if I make such a request.
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data
(*) Note the CCPA has a ton of exceptions, and only really applies to the larger social media sites.
Interesting. To be honest, I could see such a feature coming down the line, in a few months let's say.
However, the question that it bring is, what to do with archive.is or wayback machine? Are those also non-compliant for archiving the pages every so often?
Archive.org (wayback machine) has a request page for removal. I don't have any knowledge of how they do it.
https://help.archive.org/help/how-do-i-request-to-remove-something-from-archive-org/
So in this case, it's the requester's responsibility to file request for every page they want to remove, I guess?
Well, the upside and the downside of GDPR is that if you're not a member of the EU, you can basically just tell them to go fuck themselves because they have little to no actual power to impact you since you're not within their jurisdiction.
Makes me wonder if the fediverse shouldn’t be individually instanced. Like Each persons phone/browser is their own individual “instance”. Maybe a central hub/series of hubs (like instances as they are now maybe) that act like dns servers to point everyone around. No content is hosted on them, they just tell everyone’s apps where to look to the other apps for posts.
I have no idea, I’m a moron and I don’t know how the internet actually works. I’m guessing this is a problem at scale.
You're not a moron, you were slightly right with dns. You're idea is actually quite sound and it's something I'm interested in also. Basically p2p social networking.
We used to be able to stream 1080p via torrent stream p2p. We could do it.