As the Fediverse grows more and more, rules and regulations become more important. For example, is Lemmy GDPR compliant? If not, are admins aware of the possible consequence? What does this mean for the growth of Lemmy?

Edit: The question “is Lemmy GDPR compliant” should mean, does the software stack provide admins with means to be GDPR compliant.

Edit2: Similar discussion with many interesting opinions on lemmy.ml by /u/[email protected]–> https://lemmy.ml/post/1409164

  • @[email protected]
    15•2 years ago

    Wither GDPR applies to an individual instance will be up to those running the instance to decide.

    If you decide it does, then you need to do a few things. Number one is read up advice on compliance with GDPR.

    Being able to delete data alone doesn’t mean GDPR compliance. I’m thinking about the need for privacy notices on sign up, retention schedules for data, lawful basis of processing, records of processing activities… Data subjects have numerous rights, which apply depend on the lawful basis you’re processing under.

    I’d suggest that larger general instances might want to read up more urgently than smaller single focus “hobby” instances.

    edit: more I think about this, I think there is an moral responsibility for the developers to help those running instances comply. If GDPR does not apply to an instance, it is still good practice to allow uses to delete their data, etc… Also, art. 20 of GDPR is the right to portability. Interesting to see how this applies to fediverse platforms like Lemmy.

    • Skull giver
      7•2 years ago

      The GDPR applies to any instance collecting personal data about EU citizens (and probably adjacent countries with similar laws). You can choose to ignore the law if you don’t do any business in the EU and don’t plan on ever going there, but you can’t decide whether or not it applies to you.

      I think the general consensus on GDPR compliance for federated networks is “we’ll see about it when someone complains”. I doubt any DPA is going to waste time on a random hobby instance or even a medium sized public instance since the only personal information you’re even collecting on here is either public data (your posts), your username and password, and your IP address. Federating instances don’t even receive the last bits of information.

      I can see someone starting a lawsuit against a standards incompliant server that ignores deletes and edits, though.

      As for portability, such an export should be quite easy to accomplish; fetch someone’s account data from the database, add in that person’s ActivityPub outbox, and you’re pretty much done. The GDPR provides you with 30 days to comply with requests but this data shouldn’t take more than a few seconds to extract.

      Seeing as the development of Lemmy is sponsored by NLNet (a Dutch organisation) I’m sure someone will have thought about it at some point at least!

      • @[email protected]
        2•2 years ago

        My statement about it being up to those running instances is mean in terms of it’s up to them to read the legislation and come to a conclusion. If I were hosting an instance I’d certainly assume it applied, though I doubt there has been any case testing its implementation in this sort of situation.

        I can see someone starting a lawsuit against a standards incompliant server that ignores deletes and edits, though.

        I wonder if the first data breach will draw the attention of a regulator. We’re all using essentially alpha software, with no privacy notice, I doubt there are RoPAs or DPIAs, I doubt there is a DPO… all those things might upset someone like the ICO in the UK if a breach were to occur.

        Edit: saying that, I’m not sure any breach would even be reportable given what data is collected by Lemmy.

        • Skull giver
          2•2 years ago

          I’m not even sure what a data breach would look like. I’m guessing the server logs which include the IP addresses, usernames, and password hashes?

          If this does go wrong, I’m wary of what will happen. I’m pretty sure Fediverse servers are on thin ice.

      • cakeistheanswer
        3•2 years ago

        Isn’t the key operating word here business?

        With no advertising on the line and no operations currently in place operating at anything but a loss there isn’t a commercial interest at stake.