So, I’m kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussions…
Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I don’t think there is jurisprudence regarding usernames, so that might be up for discussion.
Since the entire goal of the fediverse is “transporting” all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsible… The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?
Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be “in the spotlights” in the upcoming years.
I don’t like GDPR, and I’m all for the technological setup of the fediverse. However, I definitely can see a “competitor” (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competition…
What do y’all thing about this?
“don’t like GDPR”? What’s not to like? Best thing that came out of EU regulation in a long time. And as others have noted you seem to be misinformed about what it actually says…
I also can’t wrap my head around “not liking” GDPR
As a relevant example, seems like only citizens covered by GDPR will be able to request Reddit to remove all of their data from Reddit’s servers since comment deleting tools and scripts are being bypassed, with loads of comments and even entire profiles getting restored by Reddit admins
Can you explain where I’m misinformed? I can surely be misinformed about the workings of Lemmy. However, for GDPR you will not “win” it with a simple TOS or something like that.
If even Google can’t make their Workplace to follow rules in such a way that Workplace can be used according to the AVG rules in the Belgian (well, Flemish) schools, I’m pretty sure that just saying “it’s in the TOS” is not enough…
But again, no expert so I hope that I am wrong.
deleted by creator
You are missing the point. A TOS can’t fix it. If it can, they would have done so. And for GDPR, there is no difference between schools and genpop. A citizen is a citizen…
deleted by creator
deleted by creator
Again, Facebook does not rely on their TOS. They rely on the fact that they obey to the Privacy Shield (see https://www.facebook.com/about/privacyshield). Lemmy instances do not, by default, obey to GDPR and or Privacy Shield.
Even more: (info from https://www.facebook.com/business/gdpr):
Transfers As is the case today, any transfers of personal data outside of the EEA (European Economic Area) must meet certain legal requirements. Facebook Inc. is certified under the Privacy Shield framework. Under this framework, we receive and process personal data from our advertisers in the EU. We do this in connection with certain products, including data file Custom Audiences, attribution checkup and certain offline conversion lift studies.(if the Privacy Shield is sufficient or not is a whole other discussion and not for this topic).