this post was submitted on 21 Jun 2023

11 points (86.7% liked)

Lemmy

13762 readers

1 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to [email protected].

founded 5 years ago

MODERATORS

[email protected]

Lemmy (and the fediverse) and GDPR: a clusterfuck waiting to happen? (lemmy.ml)

submitted 2 years ago by [email protected] to c/[email protected]

74 comments fedilink hide all child comments

So, I’m kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussions…

Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I don’t think there is jurisprudence regarding usernames, so that might be up for discussion.

Since the entire goal of the fediverse is “transporting” all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsible… The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?

Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be “in the spotlights” in the upcoming years.

I don’t like GDPR, and I’m all for the technological setup of the fediverse. However, I definitely can see a “competitor” (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competition…

What do y’all thing about this?

top 50 comments

sorted by: hot top controversial new old

[–] [email protected] 11 points 2 years ago (7 children)

"don't like GDPR"? What's not to like? Best thing that came out of EU regulation in a long time. And as others have noted you seem to be misinformed about what it actually says...

[–] [email protected] 6 points 2 years ago

I also can't wrap my head around “not liking” GDPR

As a relevant example, seems like only citizens covered by GDPR will be able to request Reddit to remove all of their data from Reddit's servers since comment deleting tools and scripts are being bypassed, with loads of comments and even entire profiles getting restored by Reddit admins

load more comments (6 replies)

[–] [email protected] 8 points 2 years ago* (last edited 2 years ago) (4 children)

I'm not an expert in GDPR and will leave the technical side to those who are, but the fact that the EU actively present at the Fediverse with among others the @EU_Commission represented at their official Mastodon instance, I would be surprised if the GDPR was suddenly weaponised against it.

GDPR was written with the intention of empowering users over corporations. The Fediverse has the same goal.

[–] [email protected] 1 points 2 years ago* (last edited 2 years ago)

IANAL, but he GDPR is quite reasonable and if Lemmy did the right thing (c) it would not be a problem I think. Transferring data to a jurisdiction, like for example the US, where people do not enjoy the same level of data protection comes with risks for any eu citizen. Therefore, it is important that any new user of Lemmy/ActivityPub is educated on what's actually going on here and the consequences of posting on Lemmy for their personal data. Article 49, 1a) of the GDPR provides an exemption for the rule this posting is about if

the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards

Why can't we have that? Add a step to the signup process that explains the basics of how a decentralised community works: even if you sign up to a German Lemmy instance, Lemmy is a global community, your data may be transferred to any place in the world and that means that you won't be able to enjoy the rights and protection you may expect on a German server. Click the "accept the risks" button to continue. Go to this link if you ever change your mind to stop federation of your content and attempt to remove it from any place it has already been federated to.

Even cooler if we can somehow record the jurisdiction of instances and build mechanics that act on that information, e.g. during federation.

load more comments (3 replies)

[–] [email protected] 7 points 2 years ago* (last edited 2 years ago) (26 children)

And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data.

Thankfully, Lemmy instances do not transport this kind of information about their users to other instances!

load more comments (26 replies)

[–] [email protected] 5 points 2 years ago (1 children)

IMO it's pretty much the same case as email. With email you send data to some remote server which may or may not reside in the EU.

I'm not really sure what argument you can make that fediverse apps but not email break gdpr.

Or even something as simple as putting your email on a public website that may be visited by someone in the US.

[–] [email protected] 4 points 2 years ago

You are correct. That's why email is a big topic in GDPR: https://gdpr.eu/email-encryption/

[–] [email protected] 5 points 2 years ago (7 children)

all personal data from EU users must remain in the EU

Create your account on a EU server, problem solved.

Lemmy (fediverse in general) doesn't send account data away, and posts don't qualify as personal data, when you publish something to the internet, it's public by definition.

load more comments (7 replies)

[–] [email protected] 4 points 2 years ago (1 children)

Neil Brown did quite a good write-up on the legal standing of the Fediverse late last year: https://decoded.legal/blog/2022/11/notes-on-operating-fediverse-services-mastodon-pleroma-etc-from-an-english-law-point-of-view

There's a section part way down about GDPR, but the answer is "it depends"

[–] [email protected] 4 points 2 years ago

Thanks! The info actually makes sense. Also, do note that every EU country has their own specific implementation of the GDPR law with very small differences. So this is written according to the UK implementation, but the BE implementation might be just a bit different.

All complicated stuff...

[+] [email protected] 2 points 2 years ago* (last edited 2 years ago) (2 children)

[deleted]

[–] [email protected] 2 points 2 years ago

I don't think a TOS will hold up. GDPR (and the implementation per country) is a law. You can't bypass a law with a TOS, I think.

However, I'm definitely not a GDPR expert...

[–] [email protected] 1 points 2 years ago

Ok, so I did some checking regarding the location and stuff, since I'm clearly not informed enough about this. However, my point still stands (I think).

Copy pasted from Twilio. I guess they are better aware than I am about the rules...

The general principle for transfers is outlined in Article 44, which can be summed up as saying, if you transfer EU personal data out of the EU, make sure that this data still enjoys the same level of protection it gets under GDPR. In other words, the entity or company that you pass the data to outside the EU must be under a legally binding obligation to follow GDPR data protection principles or the equivalent. (Unlike an outright prohibition on extraterritorial data transfers, this actually makes sense. No point if having rules if those rules get tossed out the window just by moving the data out of the EU.)

and also:

This legally binding obligation can be achieved in multiple ways. Here is a sampling:

1. The entity to whom you pass the data to happens to be in a country that has data protection laws that are just as strong as GDPR (as determined by the EU Commission).
2. The entity to whom you pass the data to agrees by legally binding contract to follow GDPR principles of data protection.
3. The company has enacted Binding Corporate Rules.
4. There is some regulatory-approved code of conduct to which the entity subscribes.

So, if someone opens up an instance in, let's say, Ethiopia or the US, it is not compliant, afaik.

However, question remains about the proxy thingy of the fediverse. Is data copied/stored on other instances OR does it remain on the instance that I subscribed to. And what if that instance is located in a "non-GDPR-compliant-environment"?

[–] [email protected] 1 points 2 years ago (15 children)

Since the entire goal of the fediverse is “transporting” all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place.

It doesn't work like that, think of your instance being a proxy to the fediverse

[–] [email protected] 1 points 2 years ago (3 children)

Is it? I read somewhere that data effectively gets "copied" to the different instances? But that might be wrong info :p

load more comments (3 replies)

load more comments (14 replies)

load more comments