Was there even a mass exodus? I largely avoid Reddit now, but I do kind of doubt that they’ve been hurt in any meaningful way by all the protests and people leaving…
Was there even a mass exodus? I largely avoid Reddit now, but I do kind of doubt that they’ve been hurt in any meaningful way by all the protests and people leaving…
deleted by creator
But if that were the case, wouldn’t GDPR already be used to take down TOR or torrents or any other p2p tech? All it would take is someone’s personal information being on them, right? (I’m really asking I have no idea)
deleted by creator
Then you adapt to that threat with user exports or built in auto migration methods.
The distributed nature makes it much harder to down the fediverse with legal claims than it does reddit/twitter/whatever already. Just being hosted in different countries makes these claims a stunning pain in the ass, as many countries do not require any compliance with the DMCA.
Sure if you want to play in a sandbox alone and have nothing but privacy and lqbgt content (nothing against them in the least bit).
That’s a good point. Right now if I send something out, even if the company I submitted it to deletes it from their servers, doesn’t mean other users will delete copies of the data I want to have deleted. Only the party I submitted it to will have to delete it.
Just take a screenshot of a tweet or a LinkedIn profile or whatever someone posts here in the Fediverse, anyone can capture a copy of it.
What makes it impossible? Why would any given instance maintainer be responsible for the data on someone else’s instance? Would it not fall on the GDPR requester to make that request of each individual instance?
deleted by creator
So then if someone requests that Gmail delete all their email data, is Google then responsible for making sure any emails sent out from it’s server to another is also deleted from those external servers?
Just in case you guys are wondering, there’s probably dozens of us enjoying the fuck out of this conversation. Thank you for asking questions I wouldn’t think of asking. On behalf of all three of us lurking.
Lol yeah this is great.
I really want to hear the answer to this
I don’t have the answer but I think of it like this.
Email is essentially a direct conversation between you and someone in the same room but you may extend (cc) to those people in the house. There is an implicit “I am including you in the conversation”
Lemmy on the other hand is more akin to talking to someone in a crowded bar but the conversation is recorded and anyone over the world has the ability to listen to the conversation at any given time.
Apples and oranges.
Interesting perspective, but then cannot we consider that Lemmy users are aware that they are including all of the Fediverse in their conversation? That way Lemmy instances could be treated in the same way email providers are
See https://gdpr-info.eu/issues/right-to-be-forgotten/
Once the “controller has made the personal data public”, they have legal obligations. Gmail doesn’t make my data public, generally.
Hm, I see. A shortcoming of the law, when they probably did not imagine something such as Lemmy or Mastodon happening. By the way, how does Mastodon deal with that? They’ve been around for much longer
See https://gdpr-info.eu/issues/right-to-be-forgotten/
Once the “controller has made the personal data public”, they have legal obligations. When you send an email, you are not making it public.
Unless these instances are showing ads and selling data, I’m pretty sure they’re protected from the law. Not only that but if you’re not hosting in the EU that law doesn’t apply to you.
deleted by creator
The problem here is how does that work? If I host something in the USA, how is someone going to bring a lawsuit towards me if I am also in the USA?
Asking honest questions here. As this just sounds like a lot of chest thumping from the EU.
“Provided your company doesn’t specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.”
Just say, we don’t provide or target EU individuals and you’re free.
Yeah, but if you don’t have any assets in the EU for them to seize, and if you’re not present in the bloc yourself it doesn’t matter for shit. They have no jurisdiction or ability to enforce unless you really, really want to operate inside of their market at scale.
See https://gdpr-info.eu/issues/right-to-be-forgotten/
Once the “controller has made the personal data public”, they have legal obligations.
Yes, but “the controller” is one instance, and it’s certainly easy for one instance to allow a user to be forgotten. You can purge the user from the instance. Then they are forgotten, as far as the instance is concerned.
As an example, just because someone makes a GDPR request on YouTube to delete a video, does not require Google to actually remove the video from the whole internet. There are plenty of websites that archive content which are unaffected by that GDPR request. It’s the exact same thing with different Lemmy instances, just because you ask lemm.ee to delete your content does not mean that lemmy.world needs to delete your content.
The GPDR doesn’t require Lemmy to remove personal data from the entire internet. But when a Lemmy instance gives data to other Lemmy instance, there are legal responsibilities.
https://gdpr-info.eu/art-17-gdpr/ Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
==========
Maybe this is open to interpretation, but I feel that the same Federation protocol that federates out my personal data (my posts and comments), should also federate out my delete requests. I’m unsure why this would be controversial.
This is a big issue of eu regulations. They are needed, but don’t account for non profit initiatives, in practice favoring big players
Well, the upside and the downside of GDPR is that if you’re not a member of the EU, you can basically just tell them to go fuck themselves because they have little to no actual power to impact you since you’re not within their jurisdiction.
I’m never to sure about GDPR. The spirit of the law is that any identifiable information has to indeed be removed.
However, does a Lemmy username really fit that definition? If John Doe has all of his Lemmy content under CoolNick89, I’m not sure GDPR applies.
Emails, especially if they contain first and last name, are a different story, but those would only be known by the host instance.
deleted by creator
Interesting, thanks. I’ll research this further.
IP addresses make more sense, because they can be used to be cross-checked with your ISP to know who you are.
If you don’t tell anyone your username and use a VPN, there is no way for people to guess your Lemmy username
Makes me wonder if the fediverse shouldn’t be individually instanced. Like Each persons phone/browser is their own individual “instance”. Maybe a central hub/series of hubs (like instances as they are now maybe) that act like dns servers to point everyone around. No content is hosted on them, they just tell everyone’s apps where to look to the other apps for posts.
I have no idea, I’m a moron and I don’t know how the internet actually works. I’m guessing this is a problem at scale.