144
Lemmy and GDPR - What is the current state?
(lemmy.world)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 05 Jul 2023
144 points (97.4% liked)
Asklemmy
43944 readers
621 users here now
A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
It isn't up to Lemmy to be GDPR compliant, but the individual instances.
People are struggling really hard to understand the concept of software federation
Both ways are a wheel with a hub in the center and spokes out to the wheel. The users are the spoke/wheel location, the “corporation” is the spoke/hub connection
The Old Way was users connecting to a corporation that provided a service. The corporation controls almost everything.
The New Way is that users control almost everything and connect to the hub which allows them to connect with each other.
Lemmy is the hub, instances are the users, and communities are the data shared.
Has this actually been court-tested? I get the feeling that this is all really quite grey until something in the Fediverse actually gets sued over this.
For example: when you create something (a comment, a post, a community), the "true" version exists on your home-instance, but copies also get sent and saved across the entire Fediverse. Is an instance really able to be GDPR compliant if it's constantly "backing up" data to non-compliant instances?
On the one hand, you could make the case that these outside instances are separate entities. Like the equivalent of a webarchive. Simply being public on the internet means other people can save copies and that's obviously all fair play under the GDPR.
On the other hand, you could make the case that saving copies to the outside instances is a lot like using third-party cookies. It's not technically "strictly necessary" for the instance to send your data to outside instances, even though it would seriously complicate the underlying design to allow specific users to opt-out of federating their content specifically.
There's no reason why activitypub would be considered any different from email, nntp, or even search engines and internet archives. When an website or email server gets a GDPR request it's not propagated in any way, and it would be a stretch to expect it to.
Are you sure? Email only sends your message to servers which you explicitly ask it to. If you only trust protonmail, you can choose to only send emails to other protonmail addresses. If protonmail chose to share your emails with other third parties regardless, I can't help but think maybe that breaches the GDPR.
Lemmy, by design, propagates copies to instances based on opaque factors outside of the user's control, even when the UI suggests that you are sending content locally. In the case of posting a comment to a community hosted on your home instance: Lemmy will send a copy to whichever servers happen to have users that are currently subscribed to that community. It's a very opaque outcome and pretty far from the outcome you'd experience when sending an email message to someone using the same email provider.
Yes, but these are genuinely disconnected entities who come across the data as a user might. Lemmy doesn't personally phone up Google and send them a copy of your comment as soon as you post it, but that's basically exactly what happens when Lemmy federates a comment with other instances via ActivityPub.
FWIW: I think Lemmy as a piece of software is actually very aligned with the interests of the EU more generally and I think it would be a bad idea for them to come down on federated social media as a GDPR issue. I nevertheless worry that it represents untested waters and can certainly imagine a reality where it receives a raw deal from regulators.
Wouldn't this be solvable by one of those cookie banners or some sort of waiver? After all, the only personal information I can think of that is shared is your username, which anyone can see if they just go to your instance. The post and the comments are public, aren't they?
Wouldn't this be solvable by one of those cookie banners or some sort of waiver? After all, the only personal information I can think of that is shared is your username, which anyone can see if they just go to your instance. The post and the comments are public, aren't they?
Wouldn't this be solvable by one of those cookie banners or some sort of waiver? After all, the only personal information I can think of that is shared is your username, which anyone can see if they just go to your instance. The post and the comments are public, aren't they?
Wouldn't this be solvable by one of those cookie banners or some sort of waiver? After all, the only personal information I can think of that is shared is your username, which anyone can see if they just go to your instance. The post and the comments are public, aren't they?
Wouldn't this be solvable by one of those cookie banners or some sort of waiver? After all, the only personal information I can think of that is shared is your username, which anyone can see if they just go to your instance. The post and the comments are public, aren't they?
I would imagine that the caching that Lemmy does has been tested in court, since the intent of the cache isn't to create a permanent copy of the data. It would likely only become a problem with GDPR if that data would stay across the instances.
As far as the federated server is concerned, the copy it has is canonical and kept forever until such a time that it receives an edit/delete signal from the original instance. I'm not really sure if you could plausibly call that caching, but I'm not a GDPR lawyer (or any variety of legal professional, for that matter) 🤷
I don't see this staying in Lemmy as the federation grows. I can't see admins being able to sustain these costs.
Well... that's just kind of how it has to work. Storage is cheaper than bandwidth and it's not a close contest. Historically, storage costs have fallen faster than networks have grown and it is probably safe to assume that this trend will continue indefinitely.
FWIW: The stuff that gets federated is all text. Image uploads aren't federated at all -- those are just shared as URLs which point to the instance wherein they were originally uploaded. This is actually why things like avatars are currently so unreliable on Lemmy -- they can't scale well without there being local copies.
I think to this might be a reductive view.
the fediverse uses activypub.
ActivityPub is. a W3C raccomandation and this organisation cares about privacy.
it's likely that the protocol will, if it already doesn't, take care of it.
even if it's up to single imstamcesy is true, there are two further questions here (beyond how much it's enforceable)
should fediverse help admin in the task?
should fediverse help users to protect their privacy?
and to me the answer to both is yes.
You need the protocol to implement crosshonoring of deletion requests, which is the default now. However, that deletion request could be ignored.
As others noted, it gets complicated if two instances defederate from each other, as the communication link which would process these requests have been severed.
this to me is good though.
ActivityPub takes care of it.
this means that the fediverse is gdpr friendly.
easier situation.
out of curiosity, is it resistant to temporary partitions?
I think to this might be a reductive view.
the fediverse uses activypub.
ActivityPub is. a W3C raccomandation and this organisation cares about privacy.
it's likely that the protocol will, if it already doesn't, take care of it.
even if it's up to single imstamcesy is true, there are two further questions here (beyond how much it's enforceable)
should fediverse help admin in the task?
should fediverse help users to protect their privacy?
and to me the answer to both is yes.