this post was submitted on 21 Jun 2023

14 points (85.0% liked)

Lemmy

13648 readers

9 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 5 years ago

MODERATORS

nutomic@lemmy.ml

Lemmy (and the fediverse) and GDPR: a clusterfuck waiting to happen? (lemmy.ml)

submitted 2 years ago by infamousbelgian@lemmy.ml to c/lemmy@lemmy.ml

68 comments fedilink hide all child comments

So, I’m kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussions…

Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I don’t think there is jurisprudence regarding usernames, so that might be up for discussion.

Since the entire goal of the fediverse is “transporting” all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsible… The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?

Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be “in the spotlights” in the upcoming years.

I don’t like GDPR, and I’m all for the technological setup of the fediverse. However, I definitely can see a “competitor” (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competition…

What do y’all thing about this?

top 50 comments

sorted by: hot top controversial new old

[–] apfel@lemmy.world 14 points 2 years ago (2 children)

"don't like GDPR"? What's not to like? Best thing that came out of EU regulation in a long time. And as others have noted you seem to be misinformed about what it actually says...

[–] BrokebackHampton@kbin.social 6 points 2 years ago

I also can't wrap my head around “not liking” GDPR

As a relevant example, seems like only citizens covered by GDPR will be able to request Reddit to remove all of their data from Reddit's servers since comment deleting tools and scripts are being bypassed, with loads of comments and even entire profiles getting restored by Reddit admins

[–] infamousbelgian@lemmy.ml 1 points 2 years ago (1 children)

Can you explain where I'm misinformed? I can surely be misinformed about the workings of Lemmy. However, for GDPR you will not "win" it with a simple TOS or something like that.

If even Google can't make their Workplace to follow rules in such a way that Workplace can be used according to the AVG rules in the Belgian (well, Flemish) schools, I'm pretty sure that just saying "it's in the TOS" is not enough...

But again, no expert so I hope that I am wrong.

[+] cwagner@discuss.tchncs.de 4 points 2 years ago* (last edited 2 years ago) (1 children)

[deleted]

[–] infamousbelgian@lemmy.ml 1 points 2 years ago (1 children)

You are missing the point. A TOS can't fix it. If it can, they would have done so. And for GDPR, there is no difference between schools and genpop. A citizen is a citizen...

[+] cwagner@discuss.tchncs.de 2 points 2 years ago* (last edited 2 years ago) (2 children)

[deleted]

[–] infamousbelgian@lemmy.ml 1 points 2 years ago (1 children)

Again, Facebook does not rely on their TOS. They rely on the fact that they obey to the Privacy Shield (see https://www.facebook.com/about/privacyshield). Lemmy instances do not, by default, obey to GDPR and or Privacy Shield.

Even more: (info from https://www.facebook.com/business/gdpr):

Transfers
As is the case today, any transfers of personal data outside of the EEA (European Economic Area) must meet certain legal requirements. Facebook Inc. is certified under the Privacy Shield framework. Under this framework, we receive and process personal data from our advertisers in the EU. We do this in connection with certain products, including data file Custom Audiences, attribution checkup and certain offline conversion lift studies.

(if the Privacy Shield is sufficient or not is a whole other discussion and not for this topic).

[–] sunaurus@lemm.ee 5 points 2 years ago* (last edited 2 years ago) (18 children)

And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data.

Thankfully, Lemmy instances do not transport this kind of information about their users to other instances!

load more comments (18 replies)

[–] sab@kbin.social 3 points 2 years ago (1 children)

I'm not an expert in GDPR and will leave the technical side to those who are, but the fact that the EU actively present at the Fediverse with among others the @EU_Commission represented at their official Mastodon instance, I would be surprised if the GDPR was suddenly weaponised against it.

GDPR was written with the intention of empowering users over corporations. The Fediverse has the same goal.

[–] klingelstreich@feddit.de 1 points 2 years ago* (last edited 2 years ago)

IANAL, but he GDPR is quite reasonable and if Lemmy did the right thing (c) it would not be a problem I think. Transferring data to a jurisdiction, like for example the US, where people do not enjoy the same level of data protection comes with risks for any eu citizen. Therefore, it is important that any new user of Lemmy/ActivityPub is educated on what's actually going on here and the consequences of posting on Lemmy for their personal data. Article 49, 1a) of the GDPR provides an exemption for the rule this posting is about if

the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards

Why can't we have that? Add a step to the signup process that explains the basics of how a decentralised community works: even if you sign up to a German Lemmy instance, Lemmy is a global community, your data may be transferred to any place in the world and that means that you won't be able to enjoy the rights and protection you may expect on a German server. Click the "accept the risks" button to continue. Go to this link if you ever change your mind to stop federation of your content and attempt to remove it from any place it has already been federated to.

Even cooler if we can somehow record the jurisdiction of instances and build mechanics that act on that information, e.g. during federation.

[–] ulu_mulu@lemmy.world 2 points 2 years ago (1 children)

all personal data from EU users must remain in the EU

Create your account on a EU server, problem solved.

Lemmy (fediverse in general) doesn't send account data away, and posts don't qualify as personal data, when you publish something to the internet, it's public by definition.

[–] randomaccount43543@lemmy.world 1 points 2 years ago (1 children)

GDPR Art 4.(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Posts in Lemmy do qualify as personal data because posts contain the ideas and opinions of an identifiable natural person (by their user handle). Therefore the Lemmy instances are handling personal data and must comply with the GDPR.

[–] ulu_mulu@lemmy.world 1 points 2 years ago* (last edited 2 years ago) (1 children)

Ideas and opinions are NOT identifiable information, unless you're so smart to as openly writing your personal data on a public forum (something noone should ever do, it's even bannable on reddit), your comments and posts do NOT contain and personally identifiable info, only your account does.

[–] randomaccount43543@lemmy.world 1 points 2 years ago* (last edited 2 years ago) (1 children)

Personal data is not identifiable information. Personal data is information about an identifiable person. The identifiable information is your username (“online identifier”)

[–] ulu_mulu@lemmy.world 1 points 2 years ago (1 children)

There is no way someone can link your username to who you are in person, unless it's you who write it out.

Laws don't protect people from themselves.

[–] randomaccount43543@lemmy.world 1 points 2 years ago

An individual’s social media ‘handle’ or username, which may seem anonymous or nonsensical, is still sufficient to identify them as it uniquely identifies that individual

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-are-identifiers-and-related-factors/#:~:text=An%20individual's%20social%20media%20'handle,it%20uniquely%20identifies%20that%20individual.

[–] SavvyWolf@sh.itjust.works 2 points 2 years ago (1 children)

IMO it's pretty much the same case as email. With email you send data to some remote server which may or may not reside in the EU.

I'm not really sure what argument you can make that fediverse apps but not email break gdpr.

Or even something as simple as putting your email on a public website that may be visited by someone in the US.

load more comments (1 replies)

[–] Dirk@lemmy.ml 1 points 2 years ago

What do y’all thing about this?

This is why I won't ever run any web service with public registration.

The people hosting an instance are responsible for the informed consent. So if you federate with anyone you need to make sure to inform your individual users about all of your peers, what data they process, and who's the contact for that peer.

This is of course impossible.

If anyone ever sues you, they probably effortlessly win the lawsuit.

[+] cwagner@discuss.tchncs.de 1 points 2 years ago* (last edited 2 years ago) (4 children)

[deleted]

[–] Pfpirlet@kbin.social 2 points 2 years ago* (last edited 2 years ago)

I second this. Personal data doesn't have to be kept within the boundaries of the EU, but cross-borders transfers has to comply with art. 45, art. 49 (art. 49-1,a. might be useful to back the TOS) and the Schrems ruling of the CJUE.

I don't see much troubles for the fediverse, here.

Edit. Missing word.

[–] infamousbelgian@lemmy.ml 1 points 2 years ago

Ok, so I did some checking regarding the location and stuff, since I'm clearly not informed enough about this. However, my point still stands (I think).

Copy pasted from Twilio. I guess they are better aware than I am about the rules...

The general principle for transfers is outlined in Article 44, which can be summed up as saying, if you transfer EU personal data out of the EU, make sure that this data still enjoys the same level of protection it gets under GDPR. In other words, the entity or company that you pass the data to outside the EU must be under a legally binding obligation to follow GDPR data protection principles or the equivalent. (Unlike an outright prohibition on extraterritorial data transfers, this actually makes sense. No point if having rules if those rules get tossed out the window just by moving the data out of the EU.)

and also:

This legally binding obligation can be achieved in multiple ways. Here is a sampling:

1. The entity to whom you pass the data to happens to be in a country that has data protection laws that are just as strong as GDPR (as determined by the EU Commission).
2. The entity to whom you pass the data to agrees by legally binding contract to follow GDPR principles of data protection.
3. The company has enacted Binding Corporate Rules.
4. There is some regulatory-approved code of conduct to which the entity subscribes.

So, if someone opens up an instance in, let's say, Ethiopia or the US, it is not compliant, afaik.

However, question remains about the proxy thingy of the fediverse. Is data copied/stored on other instances OR does it remain on the instance that I subscribed to. And what if that instance is located in a "non-GDPR-compliant-environment"?

load more comments (2 replies)

[–] Fermiverse@kbin.social 1 points 2 years ago

Kbin.social and feddit.de are hosted in Germany. That's why I signed up there.

[–] bentasker@kbin.social 1 points 2 years ago (1 children)

Neil Brown did quite a good write-up on the legal standing of the Fediverse late last year: https://decoded.legal/blog/2022/11/notes-on-operating-fediverse-services-mastodon-pleroma-etc-from-an-english-law-point-of-view

There's a section part way down about GDPR, but the answer is "it depends"

[–] infamousbelgian@lemmy.ml 1 points 2 years ago

Thanks! The info actually makes sense. Also, do note that every EU country has their own specific implementation of the GDPR law with very small differences. So this is written according to the UK implementation, but the BE implementation might be just a bit different.

All complicated stuff...

[–] nivenkos@lemmy.world 1 points 2 years ago

FWIW Hacker News just says it doesn't apply to them as it doesn't count as a service for just a discussion board.

But I think the right of deletion is a bigger issue than where email addresses are stored.

load more comments