So, I’m kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussions…
Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I don’t think there is jurisprudence regarding usernames, so that might be up for discussion.
Since the entire goal of the fediverse is “transporting” all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsible… The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?
Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be “in the spotlights” in the upcoming years.
I don’t like GDPR, and I’m all for the technological setup of the fediverse. However, I definitely can see a “competitor” (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competition…
What do y’all thing about this?
Not all data is transferred to other servers. That's the point where I think you are wrong.
You mention email and IP addresses as examples of personal data covered by GDPR, but that data is not transferred to other instances, only the instance where you registered holds that data. So you would only need to care about the instance where you registered to be GDPR-compliant.
Ok, agree. There seems to be a bit of a discussion on if my posts are personal data, but if we say that those are public, then that is covered. Now there is just a simple question I have... What if I, as a EU citizen, knowingly subscribe to a non-EU, non-GDPR friendly instance and/or service. Is that ok? Should that instance then suddenly become GDPR friendly?
I don't think I can answer that :-)
I think the GDPR applies to any company providing services to an EU citizen, regardless of where it is. So I guess that means yes to your question? Does it mean you can force foreign companies into becoming compliant by using their services unless the actively block EU citizens from using their services?
I guess that if you started using that service knowing that it was non-compliant, we could say you were implicitly giving up that right, but I don't think that is something you can do individually given that it's a right affecting all EU citizens.
But, honestly, now I am talking about things very out of my area of expertise :-)
Thanks for your ideas. I think you are right, it sounds right, but also way out of my knowledge area.