So, Iā€™m kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussionsā€¦

Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I donā€™t think there is jurisprudence regarding usernames, so that might be up for discussion.

Since the entire goal of the fediverse is ā€œtransportingā€ all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsibleā€¦ The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?

Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be ā€œin the spotlightsā€ in the upcoming years.

I donā€™t like GDPR, and Iā€™m all for the technological setup of the fediverse. However, I definitely can see a ā€œcompetitorā€ (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competitionā€¦

What do yā€™all thing about this?

  • hardypart@feddit.deEnglish
    0Ā·
    1 year ago

    Now if you want to change that, youā€™ll have to request a GDPR deletion from every instance you posted it to.

    Thatā€™s the interesting point. Do I really have to do that or should I be able to rely on my instance owner thatā€™s located in the EU to take care of that? Iā€™m pretty sure none of us can answer this question. Decentralized services like the Fediverse are probably a new challange for GDPR experts.

    • Scaldart@lemmy.worldEnglish
      1Ā·
      1 year ago

      Iā€™m not supposing to have any answers either, but from a personal standpoint it seems rather selfish to even entertain the idea of making an instance owner do that. Itā€™s not like these people are getting paid for a service (aside from donations, in some cases); theyā€™re hosting in the spirit of the fediverse. Why would I pawn legal work off to them?

      • hardypart@feddit.deEnglish
        1Ā·
        1 year ago

        it seems rather selfish to even entertain the idea of making an instance owner do that.

        I think you truly underestimate the GDPR, which is fine, because you donā€™t run a huge Lemmy instance. I just hope the admins of the big instances are taking it more seriously, otherwise this could indeed blow up in their faces one day.

      • hardypart@feddit.deEnglish
        01Ā·
        1 year ago

        Sure, but I in the end itā€™s not their responsibility.

        You guys sound so confident, itā€™s not even funny. GDPR is a huge topic and everyone who already had to deal with it even marginally knows that OPā€™s fear is absolutely plausible. The GDPR doesnā€™t give a shit about causing major inconviences or huge workload for platform admins. Ever heard about the GDPR nightmare letter?

          • hardypart@feddit.deEnglish
            01Ā·
            1 year ago

            edit: In the end, though, of course this is my opinion. IANAL.

            Same here. Iā€™m not sure if Iā€™m right, but neither should anyone else here be sure about this topic.

            But I also know that essentially all serious issues with GDPR are because of companies wanting to violate your privacy, not because a user is using a product as intended.

            What if the product is designed in a way that violates the GDPR? Again, Iā€™m not sure about that, just like OP. We will see how things will turn outā€¦ But as an admin of a large instance Iā€™d be carful for sure.

              • hardypart@feddit.deEnglish
                0Ā·
                1 year ago

                Which I completely disagree with.

                I never said that Lemmy is designed in that way, I just say that we canā€™t be sure.

                If this violates, then every tweeting software, every reddit third-party app would also be ā€œdesigned to violateā€,

                Where and how do Twitter or Reddit third party apps store personal data?