I've been tagged here, so to answer some of the questions I saw below:

We already have a way to permanently delete / overwrite your comments when you delete your account. That's been done for a long time., and is easily visible in lemmy-UI when you go to delete your account.

We do federate that removal, but there's nothing that stops a malicious server from ignoring that request. Activitypub is ultimately like email; there is no unsend email button.

That ticket is more about image removals, which gets tricky. We recently added a table that makes sure to attach image uploads to the local user, and now what's needed is to build out an interface for handling those also, in addition to handling the removals properly. Issue for that is here.

Data privacy will always be an ongoing issue, and we have to handle new problems as they arise. That's nothing new for us.

The main issue in that ticket is that there are 2-4 of us devs working on software that is now used by over 40k ppl daily, and we're spread extremely thin. So my personal patience for people making demands, while refusing to do anything to help out themselves, is very thin. We are not a multi-million dollar corporation with hundreds of developers. If someone wants a feature that we don't have time to work on atm, they can help out by adding it.

I think maltfield is well-intentioned, but they've also shown no interest in helping out with any of these GDPR-related requests. We have no legal expertise about the GDPR, and lemmy is not european software, it's international software.

dunno. if i was all that concerned about that kinda stuff i wouldnt be using a publicly, anonymously federating communication platform like lemmy

clearly people need to stay within legal requirements, and a user wanting to delete their account should be able to do so... but youre not recalling your remotely-transmitted posts anymore than you can recall the words you shout on a street corner.

e. ahh i see, this is about a bug they dont want to fix on lemmy because they dont feel they are gdpr targets

so, its definitely a bug. its definitely already on their bug list, but they arent acting on it for 'reasons'. and now that you pointed it out, they will definitely never act on it.

It has been my experience working with FOSS that if you really want a bug fixed, or a feature implemented, it is best to take the following steps:

1. Fork the repository
2. Implement the feature or bug fix in your fork
3. Open an issue (if one does not exist already) in the upstream repository describing the feature or bug
4. Submit a pull request with your implemented changes as a solution to the issue

I have had a 100% success rate with these steps.

And i thought that was what lemmy was built on privacy, ethics and morals now i am dissapointed.

I don't think lemmy was built on that. The original software was written by tankies so i doubt they cared about privacy, ethics, or morals. It was built as an open source decentralized alternative to other news aggregation sites.

Everything you post to it proliferates out to every server you federate with so even when they implement this it would be trivial for someone to setup a catch all server that doesn't obey the delete command sent from another server and store everything everyone has posted. That might be why they haven't prioritized it. Just a guess from me though.

ITT: people too focused on Data Privacy with respect to other posters/internet denizens.

In reality the much bigger concern typically is the literal owner of the servers

If 1 server owner announces they are now selling off all their copies of raw lemmy data to an AI company to train on, legally by EU data privacy laws users very much would have a leg to stand on to demand their data be deleted and if the server owner doesn't comply, they could be in very hot water.

This doesn't have to be a federated problem.

You can request Server A delete your records while being cool with Server B keeping them, because Server A is selling your data and B isn't.

This delete/request action doesn't have to propagate, it can be "per server"

The idea that your data is private here is a lol.

The secret trick is, abbadon420 isn't my real name.

IIRC GDPR Right to be forgotten only affects personal data

This issue is about the fact that if you delete your account, lemmy will delete all the text in any posts and comments you've made. It won't go through those comments, read any URLs you've uploaded pictures too, and delete them if they've been hosted/cached locally.

Putting the lemmy devs response to one side for a moment: what's the concern here? The URLs for images in picts-rs are a random hex string - if you don't know the URL, you can't find it, and even if you do, you wouldn't be able to connect it to someone unless the info was literally in the image itself.

Cross-posted to privacy@lemmy.ml

I think it should be an option to delete post and comment history upon account deletion, but by no means the rule. I hate finding swiss cheese threads on social media. Part of commenting on a platform like this is contributing your voice to the value of an overall discussion, and revoking that contribution is frequently more obnoxious for your fellow users than it is beneficial to you.