Isn't the key operating word here business?

With no advertising on the line and no operations currently in place operating at anything but a loss there isn't a commercial interest at stake.

My statement about it being up to those running instances is mean in terms of it's up to them to read the legislation and come to a conclusion. If I were hosting an instance I'd certainly assume it applied, though I doubt there has been any case testing its implementation in this sort of situation.

I can see someone starting a lawsuit against a standards incompliant server that ignores deletes and edits, though.

I wonder if the first data breach will draw the attention of a regulator. We're all using essentially alpha software, with no privacy notice, I doubt there are RoPAs or DPIAs, I doubt there is a DPO.. all those things might upset someone like the ICO in the UK if a breach were to occur.

Edit: saying that, I'm not sure any breach would even be reportable given what data is collected by Lemmy.