this post was submitted on 05 Jul 2023
123 points (97.7% liked)
Asklemmy
43394 readers
1826 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The GDPR applies to any instance collecting personal data about EU citizens (and probably adjacent countries with similar laws). You can choose to ignore the law if you don't do any business in the EU and don't plan on ever going there, but you can't decide whether or not it applies to you.
I think the general consensus on GDPR compliance for federated networks is "we'll see about it when someone complains". I doubt any DPA is going to waste time on a random hobby instance or even a medium sized public instance since the only personal information you're even collecting on here is either public data (your posts), your username and password, and your IP address. Federating instances don't even receive the last bits of information.
I can see someone starting a lawsuit against a standards incompliant server that ignores deletes and edits, though.
As for portability, such an export should be quite easy to accomplish; fetch someone's account data from the database, add in that person's ActivityPub outbox, and you're pretty much done. The GDPR provides you with 30 days to comply with requests but this data shouldn't take more than a few seconds to extract.
Seeing as the development of Lemmy is sponsored by NLNet (a Dutch organisation) I'm sure someone will have thought about it at some point at least!
Isn't the key operating word here business?
With no advertising on the line and no operations currently in place operating at anything but a loss there isn't a commercial interest at stake.
Charities and other types of non profits have to comply with the GDPR too. Just because you're not making any money doesn't mean you can ignore privacy law.
I think it also depends on how you tell the tax authority about your donations. There are tax rules about gifts versus donations versus income. It can easily be beneficial to report donations as income for some small company rather than pay tax over donations, depending on the country where you live. Alternatively, you could commit tax fraud and not report the donations at all, but then privacy law is probably not your biggest concern.
Governments also have to comply with GDPR. They also have no commercial interest in the personal data.
Nope, GDPR does not limit itself on businesses. It applies to all data collection.
My statement about it being up to those running instances is mean in terms of it's up to them to read the legislation and come to a conclusion. If I were hosting an instance I'd certainly assume it applied, though I doubt there has been any case testing its implementation in this sort of situation.
I wonder if the first data breach will draw the attention of a regulator. We're all using essentially alpha software, with no privacy notice, I doubt there are RoPAs or DPIAs, I doubt there is a DPO.. all those things might upset someone like the ICO in the UK if a breach were to occur.
Edit: saying that, I'm not sure any breach would even be reportable given what data is collected by Lemmy.
I'm not even sure what a data breach would look like. I'm guessing the server logs which include the IP addresses, usernames, and password hashes?
If this does go wrong, I'm wary of what will happen. I'm pretty sure Fediverse servers are on thin ice.