So, I’m kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussions…

Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I don’t think there is jurisprudence regarding usernames, so that might be up for discussion.

Since the entire goal of the fediverse is “transporting” all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsible… The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?

Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be “in the spotlights” in the upcoming years.

I don’t like GDPR, and I’m all for the technological setup of the fediverse. However, I definitely can see a “competitor” (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competition…

What do y’all thing about this?

  • apfel@lemmy.worldEnglish
    10·
    1 year ago

    “don’t like GDPR”? What’s not to like? Best thing that came out of EU regulation in a long time. And as others have noted you seem to be misinformed about what it actually says…

    • BrokebackHampton@kbin.social
      3·
      1 year ago

      I also can’t wrap my head around “not liking” GDPR

      As a relevant example, seems like only citizens covered by GDPR will be able to request Reddit to remove all of their data from Reddit’s servers since comment deleting tools and scripts are being bypassed, with loads of comments and even entire profiles getting restored by Reddit admins

    • infamousbelgian@lemmy.mlOPEnglish
      21·
      1 year ago

      Can you explain where I’m misinformed? I can surely be misinformed about the workings of Lemmy. However, for GDPR you will not “win” it with a simple TOS or something like that.

      If even Google can’t make their Workplace to follow rules in such a way that Workplace can be used according to the AVG rules in the Belgian (well, Flemish) schools, I’m pretty sure that just saying “it’s in the TOS” is not enough…

      But again, no expert so I hope that I am wrong.

      • cwagner@discuss.tchncs.deEnglish
        51·
        1 year ago

        If even Google can’t make their Workplace to follow rules

        If even a company whose whole point it is to violate your privacy and profile you, can’t manage your data without violating it and profiling you… What?

        Also, Schools are not the same as genpop.

        edit: typo: can -> can’t

        • infamousbelgian@lemmy.mlOPEnglish
          21·
          1 year ago

          You are missing the point. A TOS can’t fix it. If it can, they would have done so. And for GDPR, there is no difference between schools and genpop. A citizen is a citizen…

          • cwagner@discuss.tchncs.deEnglish
            31·
            1 year ago

            You are missing it. A TOS can fix anything it needs to. You are just disagreeing on what it needs to do. I see no reason why I as a user wouldn’t be allowed to use software that allows me to post messages to a US Server. AFAIK e.g. Facebook is not illegal in EU. You are arguing it is illegal, because they allow you to post data to the US.

            edit: accidentally a word too too much

            • cwagner@discuss.tchncs.deEnglish
              1·
              1 year ago

              And for GDPR, there is no difference between schools and genpop. A citizen is a citizen…

              Oh, and for that, that would mean it’s now illegal to use it in all of Belgium, and not just schools, is that the case? We have different laws in Germany regarding institutions, students, private citizens, and even under what label one currently acts.

              • infamousbelgian@lemmy.mlOPEnglish
                1·
                1 year ago

                Well… Apparently (I did some reading), the topic was about Google Workspace for Education. A solution only used by schools.

                Nobody is currently “caring” about the normal Google Workspace. So yes and no.

            • infamousbelgian@lemmy.mlOPEnglish
              1·
              1 year ago

              Again, Facebook does not rely on their TOS. They rely on the fact that they obey to the Privacy Shield (see https://www.facebook.com/about/privacyshield). Lemmy instances do not, by default, obey to GDPR and or Privacy Shield.

              Even more: (info from https://www.facebook.com/business/gdpr):

              Transfers
As is the case today, any transfers of personal data outside of the EEA (European Economic Area) must meet certain legal requirements. Facebook Inc. is certified under the Privacy Shield framework. Under this framework, we receive and process personal data from our advertisers in the EU. We do this in connection with certain products, including data file Custom Audiences, attribution checkup and certain offline conversion lift studies.

              (if the Privacy Shield is sufficient or not is a whole other discussion and not for this topic).

              • cwagner@discuss.tchncs.deEnglish
                1·
                1 year ago

                The whole discussion here hinges on the privacy shield having been cancelled (which the latest Schrems case did). You were the one bringing up transferring data to the US, the only reason that’s an issue, is because Privacy Shield was ended.