https://github.com/LemmyNet/lemmy/issues/4433

Should i repost this to any other /c/'s meant for this kind of things ?

EDIT: In case anyone don’t understand what this is it is an issue raised by someone on lemmy git that when an account is deleted or banned it should also delete the data the data posted by the user. And one of the main dev nutomic is blowing it of like it won’t affect me and maltfield is remainding him that it is illegal under the EU law and it also affects lemmy and moreover it is not ethical or moral . And i thought that was what lemmy was built on privacy, ethics and morals now i am dissapointed.

EDIT : For everyone saying there is no way i am not really ap roggrammer or anything but couldn’t this work :

They could just roll it out on a new version and i think most instances won’t mod it to remove that maybe some oddball ones will but not most. I know saved copies will be there but who cares no one is saving my 1000 comments but that is not the case with this .

It is copy pasted from one of my replies.

EDIT: Also it is not my intention to point finger to lemmy devs and i can differentiate their political stance and their work my only intention was to see that if this post gained enough traction they will reply or fix the issue.

EDIT : Relevant comment from @NeatNit@discuss.tchncs.de about what if other instance don’t delete your data.

So maybe those instances are breaking the law, but Lemmy by default should comply. You could say the exact same thing about any social media - scrapers can and do archive everything they can - but that doesn’t absolve the original platforms (e.g. Twitter) from having to follow the law.

EDIT : As just a person i can’t do anything about it but i am certain if everybody pitch in the lemmy devs will listen and even though everyone seems to hate lemmy devs political stance i can differentiate with politics and their work and i find @Dessalines@lemmy.ml to be very responsive so i am gonna mention him and see what he thinks about it instead of trashing lemmy devs on speculation (i don’t know nutomic’s id) even though i don’t agree wuth nutomic’s response in this case i don’t share the views of many people in the comments and don’t associate this post with them.

EDIT : I just want an option to purge my data when deleting an account that you can enable or disable.

EDIT:Ok i just woke up and am catching up with some of these replies and i wanna say i don’t share any of their views nor am i affliated with them i never wanted to trash on the dev and that is one of the main reason i posted this on casual conversation i didn’t think this would get this uncasual . All i wanted to so was draw attention to this problem so devs will act on it faster but since then i have learned lemmy politics does’nt work like that and as i am not the mod or anyththing i can’t do anything about some of the comments except make it clear i have no affliations with them. Just keep it casual people. I too want these changes but maybe geemtting on the nerve if devs isn’t the best way to achieve it.

Something @tyler@programming.dev chimed in .Your comments can be public, but your data is yours. That’s the whole point of GDPR. Think of an art gallery. The gallery does not own the art a lot of the time, they simply show it. The art is owned by the artist. If they want to take it down they can. The same thing applies here. Your data, you get to choose what happens to it in the eyes of the law.

EDIT:

I accidently left this part out so uploading it.

  • Dessalines@lemmy.ml
    link
    fedilink
    English
    arrow-up
    142
    arrow-down
    14
    ·
    8 months ago

    I’ve been tagged here, so to answer some of the questions I saw below:

    We already have a way to permanently delete / overwrite your comments when you delete your account. That’s been done for a long time., and is easily visible in lemmy-UI when you go to delete your account.

    We do federate that removal, but there’s nothing that stops a malicious server from ignoring that request. Activitypub is ultimately like email; there is no unsend email button.

    That ticket is more about image removals, which gets tricky. We recently added a table that makes sure to attach image uploads to the local user, and now what’s needed is to build out an interface for handling those also, in addition to handling the removals properly. Issue for that is here.

    Data privacy will always be an ongoing issue, and we have to handle new problems as they arise. That’s nothing new for us.

    The main issue in that ticket is that there are 2-4 of us devs working on software that is now used by over 40k ppl daily, and we’re spread extremely thin. So my personal patience for people making demands, while refusing to do anything to help out themselves, is very thin. We are not a multi-million dollar corporation with hundreds of developers. If someone wants a feature that we don’t have time to work on atm, they can help out by adding it.

    I think maltfield is well-intentioned, but they’ve also shown no interest in helping out with any of these GDPR-related requests. We have no legal expertise about the GDPR, and lemmy is not european software, it’s international software.

    • THE MASTERMIND@lemmy.todayOP
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      4
      ·
      8 months ago

      Ok i just woke up and am catching up with some of these replies and i wanna say i don’t share any of their views nor am i affliated with them i never wanted to trash on the dev and that is one of the main reason i posted this on casual conversation i didn’t think this would get this uncasual . All i wanted to so was draw attention to this problem so devs will act on it faster but since then i have learned lemmy politics does’nt work like that and as i am not the mod or anyththing i can’t do anything about some of the comments except make it clear i have no affliations with them. Just keep it casual people.

    • THE MASTERMIND@lemmy.todayOP
      link
      fedilink
      English
      arrow-up
      14
      arrow-down
      13
      ·
      edit-2
      8 months ago

      I understand your frustation and i do appreciete the work you do and in no way am i demanding anything but the way that issue was handled kinda irked me and that is why i posted here so maybe that issue would get more attention and be handled more fast. But things escalated and people started to speculate and i didn’t want it to get anymore uncasual (because of the sub) or weird so i thought i should mention you and you can provide the anwers we seek and thus end the speculation and it was turning a little uncasual for this sub .

    • Maalus@lemmy.world
      link
      fedilink
      English
      arrow-up
      18
      arrow-down
      23
      ·
      8 months ago

      If you have no expertise in european GDPR, then at least check the minimum. If you host EU users, you need to comply with it. If you can’t or don’t want to, you need to refuse them entry / access to the application. They cannot leave any data with you. And before you say “it doesn’t apply to me I can do what I want” - no you can’t, since in the US and many other countries you can still get fined for it.

      If you don’t have the resources, you need to throw a 451 response or some other general message blocking access to the EU.

      • Dessalines@lemmy.ml
        link
        fedilink
        English
        arrow-up
        40
        arrow-down
        8
        ·
        8 months ago

        If you’re a lawyer then, you should advise ppl running servers, and also chime in on that thread.

    • ColeSloth
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      25
      ·
      8 months ago

      He might be well intentioned, but how he wrote it out he sounds like some edgelord I’d rather punch in the face rather than listen to.

  • originalucifer@moist.catsweat.com
    link
    fedilink
    arrow-up
    80
    arrow-down
    6
    ·
    edit-2
    8 months ago

    dunno. if i was all that concerned about that kinda stuff i wouldnt be using a publicly, anonymously federating communication platform like lemmy

    clearly people need to stay within legal requirements, and a user wanting to delete their account should be able to do so… but youre not recalling your remotely-transmitted posts anymore than you can recall the words you shout on a street corner.

    e. ahh i see, this is about a bug they dont want to fix on lemmy because they dont feel they are gdpr targets

    so, its definitely a bug. its definitely already on their bug list, but they arent acting on it for ‘reasons’. and now that you pointed it out, they will definitely never act on it.

    • Turun@feddit.de
      link
      fedilink
      English
      arrow-up
      29
      arrow-down
      1
      ·
      8 months ago

      but youre not recalling your remotely-transmitted posts anymore than you can recall the words you shout on a street corner.

      That is true, but the user must still have the ability to delete all their comments. The fact that someone could have scraped the data is irrelevant.

      • ColeSloth
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        9
        ·
        8 months ago

        Ok. Go through and manually delete your comments.

        • Guntrigger@feddit.ch
          link
          fedilink
          English
          arrow-up
          21
          arrow-down
          2
          ·
          8 months ago

          That’s not how GDPR works. You’re legally allowed to request your data and request that it is deleted by the entity that is collecting it and in both cases the company is obliged to act on it.

    • THE MASTERMIND@lemmy.todayOP
      link
      fedilink
      English
      arrow-up
      30
      arrow-down
      18
      ·
      8 months ago

      But him blowing it off like that was spezy we should be better than reddit and let users delete their data if they want to .

      • rdyoung@lemmy.world
        link
        fedilink
        English
        arrow-up
        36
        arrow-down
        9
        ·
        edit-2
        8 months ago

        That would be ideal but reality is that because of the way the fediverse works there is no way to control what we post to instances that aren’t our home one and we definitely can’t undo the thousands of copies of those comments/posts that get copied across the fediverse.

        This is a concept that was understood in the early days of the internet and seemed to have gotten forgotten over the years. The basic concept of not being able to unring a bell.

        Basically even if a local instance lets us delete our account and all comments/posts, it would be up to every other federated instance to honor that delete transmission, we have no way to enforce that.

        • pixxelkick@lemmy.world
          link
          fedilink
          English
          arrow-up
          15
          arrow-down
          11
          ·
          8 months ago

          there is no way to control what we post to instances that aren’t our home one

          This doesn’t give the home instance a get out of jail free card for also failing to comply.

          This is pure whataboutism.

          • rdyoung@lemmy.world
            link
            fedilink
            English
            arrow-up
            8
            arrow-down
            9
            ·
            8 months ago

            First off. That’s not the definition of whataboutism. Second. It’s simply the reality we live in. It’s clear in posts like this who actually understand code and software at their core and who wouldn’t be able to name even 1 coding language aside from an oldy like cobal.

            I’m not justifying anything or saying that the right to be forgotten isn’t a worthwhile goal to strive for. What I am doing is attempting to explain reality and the unlikelyhood of OPs dream happening in the fediverse any time soon, if at all.

            I’ll close by pointing out that it’s clear you nor OP read or understood what I said about someone scraping an instance and having a copy of everything posted up to that point and the undeniable fact that you can’t delete anything from that data even if every single instance respected the delete command.

            • pixxelkick@lemmy.world
              link
              fedilink
              English
              arrow-up
              7
              arrow-down
              1
              ·
              8 months ago

              The fact you bring up scraping at all indicates you have no idea what this is about.

              Data privacy and protection isn’t about that.

              “Some third party could just…” is indeed trying to whataboutism it, it’s completely irrelevant.

              Other instance owners are completely irrelevant.

              You’ll need to wrap your head around the fact that legally lemmy has to support the takedown request per instance, not federation wide.

              If I truly wanted my data gone I’d have to make the request to each individual server. That’s fine.

              Data privacy and protection compliance means that I can request specifically server A take down my data, and still be fine with server B retaining a copy.

              If I wanted both to drop the data, I’d have to request it from both individually.

              Scrapers aren’t involved here.

              The protection isn’t about “oh no people on the internet can see my posts”

              It’s more about “oh man it came to light Server B’s owner is selling people’s data and I don’t want my data included in that”

              This is a legal requirement, id recommend lemmy instance owners check in with their local lawyers about this, because a lack of compliance could get individual instance owners in hot water, and if multiple large instance owners realize this, it should put more pressure on the debs to fix that shit.

              • rdyoung@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                arrow-down
                7
                ·
                8 months ago

                You really are having a hard time here. I’m too tired to deal with this level of idiocy. You have a nice day now.

        • THE MASTERMIND@lemmy.todayOP
          link
          fedilink
          English
          arrow-up
          6
          arrow-down
          9
          ·
          8 months ago

          They could just roll it out on a new version and i think most instances won’t mod it to remove that maybe some oddball ones will but not most. I know saved copies will be there but who cares no one is saving my 1000 comments but that is not the case with this .

          • Nomecks@lemmy.ca
            link
            fedilink
            English
            arrow-up
            11
            ·
            8 months ago

            It’s not an issue until it’s an issue. Someone will need to attempt to exercise their GDPR rights to get a change made. As others have said, it’s not so black and white as removing posts from something like Spezddit or Shitter, so the EU may need to weigh in if/when it becomes a legal issue.

          • rdyoung@lemmy.world
            link
            fedilink
            English
            arrow-up
            10
            arrow-down
            12
            ·
            edit-2
            8 months ago

            A new version of what? This is open-source software, anyone can modify and compile their own version and stay federated so long as it stays compatible. Basing compatibility on the deletion of posts/comments/accounts is way more complex than you may think and would only lead to all kinds of unforeseen issues down the road.

            All of this also doesn’t stop anyone from scraping and storing a local copy of any public available instance. Somewhere in my collection of software I have one from a couple of decades ago that does exactly that, it pulls down an entire site just based on a url, it will basically mirror a site.

            I think we would be better off focusing on 2 slightly at odds concepts.

            1. Getting used to whatever we say is out there forever and learning to be comfortable with that and not saying anything that we would be bothered by friends and coworkers seeing.

            2. Teaching people to be truly anonymous on the webs and being careful to not share enough info to be identified by their collective posts (which is easier than people realize).

            • THE MASTERMIND@lemmy.todayOP
              link
              fedilink
              English
              arrow-up
              3
              arrow-down
              7
              ·
              8 months ago

              I get that but why do you think any of the instance admin do that ? It is aldready very costly for then to host an instance unless they are selling our data i don’t see the need to and in that case there’s nothing we can do about it.

              • rdyoung@lemmy.world
                link
                fedilink
                English
                arrow-up
                4
                arrow-down
                6
                ·
                8 months ago

                Do you not see how this comment is a polar opposite of your initial post and other comments?

                No, you probably don’t and that’s what I have had to deal with online for over 30 years.

      • Sgagvefey@lemmynsfw.com
        link
        fedilink
        English
        arrow-up
        12
        arrow-down
        6
        ·
        8 months ago

        It’s not possible.

        By design, everything you posted is shared to hundreds of other servers, all of which are capable of doing anything they want with it. I can guarantee you that there are several that are archiving anything and everything that gets federated to them and will not remove that content when the original server does.

        • NeatNit
          link
          fedilink
          English
          arrow-up
          13
          ·
          8 months ago

          I can guarantee you that there are several that are archiving anything and everything that gets federated to them and will not remove that content when the original server does.

          So maybe those instances are breaking the law, but Lemmy by default should comply. You could say the exact same thing about any social media - scrapers can and do archive everything they can - but that doesn’t absolve the original platforms (e.g. Twitter) from having to follow the law.

            • maynarkh@feddit.nl
              link
              fedilink
              English
              arrow-up
              7
              ·
              edit-2
              8 months ago

              Pseudonymisation means something different from what you think in the context of the GDPR. Usernames are not pseudonyms, they are personal data (see art 4/1. “online identifiers”). Pseudonyms are something the processor introduces to disassociate data from the username like an user database ID.

              And pseudonymisation is only a method introduced to further protect data, you still need a reason to keep it. If you have no legitimate basis to keep that data, and the data subject requests a deletion, pseudonymous data also needs to be deleted.

              Also, legal practice has confirmed that social media posts absolutely do qualify as personal data.

            • NeatNit
              link
              fedilink
              English
              arrow-up
              4
              arrow-down
              1
              ·
              8 months ago

              But some people do use pseudonyms that are easy to tie to their real identity. Or sometimes, just their name. (I haven’t encountered it on Lemmy but there’s absolutely nothing to stop it from happening)

    • THE MASTERMIND@lemmy.todayOP
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      5
      ·
      8 months ago

      I don’t understand why won’t they because i pointed it out ? Also it was not treated as a bug by nutomic and i think it is more of a missing feature .also what reasons ?

      • originalucifer@moist.catsweat.com
        link
        fedilink
        arrow-up
        19
        arrow-down
        2
        ·
        8 months ago

        you triggered the spite flag.

        people are people, these people have this project theyre doin and their priorities dont match yours. it happens.

        how do you get someone to fix an issue they dont think is a priority? that can be touchy, but here i would prolly not go rolling in with big labels like legal and gdpr. maybe a lighter touch with references to moderating spam/unwanted images. i dunno… nice people can move mountains, and they arent doing the lifting.

        at the heart of the matter, you just wanted a simple call to delete images that need to go with the account.

        • THE MASTERMIND@lemmy.todayOP
          link
          fedilink
          English
          arrow-up
          6
          arrow-down
          4
          ·
          8 months ago

          you triggered the spite flag.

          What is a spite flag ? If it is what i think it is it certainly was not my goal i thought if the post gained some traction the devs will act on it .

          • m_randall@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            19
            arrow-down
            4
            ·
            8 months ago

            I apologize but I’ll be blunt - you went way over the top with your comment.

            The guy is trying to triage some tickets, made a reasonable guess at policy and was greeted by a dissertation and accusations. You then double down by posting here like there’s cause for some huge alarm. I’m a fairly big privacy advocate and even I was rolling my eyes. These type of comments make working in open source not enjoyable.

            Unsolicited advice - Take a deep breath, have reasonable conversations with people building and maintaining software, and don’t take every small offhanded comment as the sky falling.

              • m_randall@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                3
                arrow-down
                2
                ·
                8 months ago

                Not angry no. Just don’t be so quick to judge a comment made off hand by a developer triaging tickets. Bolded text and jumping to conclusions that devs don’t care helps no one. Attempt to educate instead. Not everything has to be internet outrage.

                And good on you for being introspective.

                • THE MASTERMIND@lemmy.todayOP
                  link
                  fedilink
                  English
                  arrow-up
                  4
                  ·
                  edit-2
                  8 months ago

                  I just wanted this post to get attention so devs will look into it but as things do this git out of hand and i do regret that.

          • blargerer@kbin.social
            link
            fedilink
            arrow-up
            17
            arrow-down
            3
            ·
            8 months ago

            As a dev, I’ll generally try and act on things in the order I think is best, (Or I’m told is best in projects I’m not heading) but someone being annoying about a ticket in a foss project is easily the quickest way to get me to put an issue towards the bottom of whatever priority stack its in.

              • NeatNit
                link
                fedilink
                English
                arrow-up
                9
                arrow-down
                5
                ·
                edit-2
                8 months ago

                In my opinion, no, but you absolutely should say that you might have overreacted and apologize for being a bit aggressive, but say that this still matters a lot and you are worried.

                Note, I really didn’t read any context other than the image in the OP.

          • originalucifer@moist.catsweat.com
            link
            fedilink
            arrow-up
            8
            arrow-down
            2
            ·
            8 months ago

            its the part where a human being gets annoyed with another human being thereby marking them from any future optional endeavors

            ie, annoying people get ignored.

            • THE MASTERMIND@lemmy.todayOP
              link
              fedilink
              English
              arrow-up
              5
              arrow-down
              2
              ·
              edit-2
              8 months ago

              As i said it is not my goal but if they consider it like that instead of raising a problem . Oh well what can you do about it.

  • p3n@lemmy.world
    link
    fedilink
    English
    arrow-up
    67
    arrow-down
    2
    ·
    8 months ago

    It has been my experience working with FOSS that if you really want a bug fixed, or a feature implemented, it is best to take the following steps:

    1. Fork the repository
    2. Implement the feature or bug fix in your fork
    3. Open an issue (if one does not exist already) in the upstream repository describing the feature or bug
    4. Submit a pull request with your implemented changes as a solution to the issue

    I have had a 100% success rate with these steps.

    • tyler@programming.dev
      link
      fedilink
      English
      arrow-up
      20
      arrow-down
      1
      ·
      8 months ago

      Oh boy, you’re luckier than I. I’ve contributed to hundreds of oss software for over a decade and I’d say maybe 50% of PRs get merged, sometimes taking years. 50 is probably generous.

  • teft@lemmy.world
    link
    fedilink
    English
    arrow-up
    39
    arrow-down
    6
    ·
    8 months ago

    And i thought that was what lemmy was built on privacy, ethics and morals now i am dissapointed.

    I don’t think lemmy was built on that. The original software was written by tankies so i doubt they cared about privacy, ethics, or morals. It was built as an open source decentralized alternative to other news aggregation sites.

    Everything you post to it proliferates out to every server you federate with so even when they implement this it would be trivial for someone to setup a catch all server that doesn’t obey the delete command sent from another server and store everything everyone has posted. That might be why they haven’t prioritized it. Just a guess from me though.

    • agent_flounder@lemmy.world
      link
      fedilink
      English
      arrow-up
      15
      arrow-down
      2
      ·
      8 months ago

      The original software was written by tankies so i doubt they cared about privacy, ethics, or morals.

      Oof lol

    • NeatNit
      link
      fedilink
      English
      arrow-up
      15
      arrow-down
      2
      ·
      8 months ago

      Everything you post to it proliferates out to every server you federate with so even when they implement this it would be trivial for someone to setup a catch all server that doesn’t obey the delete command sent from another server and store everything everyone has posted.

      (repeating from my reply elsewhere)

      So maybe those instances are breaking the law, but Lemmy by default should comply. You could say the exact same thing about any social media - scrapers can and do archive everything they can - but that doesn’t absolve the original platforms (e.g. Twitter) from having to follow the law.

      • THE MASTERMIND@lemmy.todayOP
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        4
        ·
        8 months ago

        Exactly . I am putting your comment on the post but you can dm or tell me hwre if you want me to take it down of course i will mention you.

  • pixxelkick@lemmy.world
    link
    fedilink
    English
    arrow-up
    32
    arrow-down
    1
    ·
    8 months ago

    ITT: people too focused on Data Privacy with respect to other posters/internet denizens.

    In reality the much bigger concern typically is the literal owner of the servers

    If 1 server owner announces they are now selling off all their copies of raw lemmy data to an AI company to train on, legally by EU data privacy laws users very much would have a leg to stand on to demand their data be deleted and if the server owner doesn’t comply, they could be in very hot water.

    This doesn’t have to be a federated problem.

    You can request Server A delete your records while being cool with Server B keeping them, because Server A is selling your data and B isn’t.

    This delete/request action doesn’t have to propagate, it can be “per server”

    • eskimofry@lemmy.world
      link
      fedilink
      English
      arrow-up
      13
      arrow-down
      4
      ·
      8 months ago

      I don’t agree. That’s a reductionist argument devoid of nuance and ignores challenges of operating decentralized social media to the scale of Lemmy or Mastadon.

      • LemmyIsFantastic@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        5
        ·
        8 months ago

        👌👍 putting your data on random servers if which many if not most do not have a commercial or liable entity is private. Right.

        • eskimofry@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          8 months ago

          As if commercial or liable entity sre actually liable in reality! Are you claiming that you have privacy on reddit for example?. Lol spez is selling your data to openai.

          Given the choices I prefer the fediverse.

    • treadful@lemmy.zip
      link
      fedilink
      English
      arrow-up
      14
      arrow-down
      7
      ·
      8 months ago

      Curious who’s downvoting you here. Why would anyone think anything here is private on an open federated protocol? Only contentious things IMO might be DMs.

      • tyler@programming.dev
        link
        fedilink
        English
        arrow-up
        29
        arrow-down
        1
        ·
        8 months ago

        Your comments can be public, but your data is yours. That’s the whole point of GDPR. Think of an art gallery. The gallery does not own the art a lot of the time, they simply show it. The art is owned by the artist. If they want to take it down they can. The same thing applies here. Your data, you get to choose what happens to it in the eyes of the law.

        • treadful@lemmy.zip
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          11
          ·
          8 months ago

          You might hold copyright. Depending on your instances ToS, you might be assigning it. But we’re not talking about if you “own” the data or whatever. This thread was about the privacy of that data on what is essentially public infrastructure.

          • tyler@programming.dev
            link
            fedilink
            English
            arrow-up
            1
            ·
            8 months ago

            This thread isn’t about privacy it’s about Private Data. Private Data doesn’t mean data that others shouldn’t see. It is explicitly defined in the gdpr as identifying data that is tied to a person. It doesn’t need to be private in the sense you are talking about. That’s where you’re getting confused.

      • Blaze@reddthat.com
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        1
        ·
        8 months ago

        Even DMs aren’t private, it’s mentioned explicitly in the Lemmy documentation, admins can read them

        • treadful@lemmy.zip
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          8 months ago

          Yeah, that’s what I meant. It’s controversial because a user might think they were private when they weren’t.

      • eskimofry@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        4
        ·
        8 months ago

        You don’t think privacy is possible with an open protocol? You still have a lot to learn.

    • Eames@feddit.de
      link
      fedilink
      English
      arrow-up
      18
      ·
      8 months ago

      Yes, it does not cover anonymized data or data that does not relate to an identifiable individual. But, if your Lemmy account is associated with a real email address, your comments and account details can be considered personal data under GDPR. The GDPR defines personal data as any information related to an identifiable person who can be directly or indirectly identified, particularly by reference to an identifier such as an email address. Even if you use a pseudonym (fake name), the fact that the account can be linked back to your real identity through the email address makes the associated data (like your comments) subject to GDPR provisions.

        • Eames@feddit.de
          link
          fedilink
          English
          arrow-up
          4
          ·
          8 months ago

          Yeah, it’s still a personal data and still considered as such under GDPR. And you’re asking the right questions: Even if a server is located outside the EU/EEA, and if it offers services to people in those regions (e.g., by providing english or german language), GDPR compliance is required. Practical implementation is a pain :)

          • cocobean@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            8 months ago

            Would deleting the email be sufficient then? So only the pseudonymous identifier remains, with no way to link back?

  • freamon@endlesstalk.org
    link
    fedilink
    English
    arrow-up
    11
    arrow-down
    3
    ·
    8 months ago

    This issue is about the fact that if you delete your account, lemmy will delete all the text in any posts and comments you’ve made. It won’t go through those comments, read any URLs you’ve uploaded pictures too, and delete them if they’ve been hosted/cached locally.

    Putting the lemmy devs response to one side for a moment: what’s the concern here? The URLs for images in picts-rs are a random hex string - if you don’t know the URL, you can’t find it, and even if you do, you wouldn’t be able to connect it to someone unless the info was literally in the image itself.

    • pixxelkick@lemmy.world
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      1
      ·
      8 months ago

      if you don’t know the URL, you can’t find it

      The owner of the server sure can.

  • TheTetrapod@lemmy.world
    link
    fedilink
    English
    arrow-up
    13
    arrow-down
    8
    ·
    8 months ago

    I think it should be an option to delete post and comment history upon account deletion, but by no means the rule. I hate finding swiss cheese threads on social media. Part of commenting on a platform like this is contributing your voice to the value of an overall discussion, and revoking that contribution is frequently more obnoxious for your fellow users than it is beneficial to you.

    • pixxelkick@lemmy.world
      link
      fedilink
      English
      arrow-up
      23
      arrow-down
      7
      ·
      edit-2
      8 months ago

      I hate finding swiss cheese threads on social media

      See the thing us, EU data privacy and protection laws don’t really give a shit though

      You feeling unhappy that chunks of a thread are missing due to someone requesting a data privacy wipe isn’t, you know, a factor that matters

      I’m sure you really wanted to know what so-and-so said, but the lack of their posts existing means they didnt want you to know what they said

      And, you know… they have the right to do that.

      • cocobean@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        8 months ago

        I think they’re saying you should have the option to delete your account and leave history intact, or delete your account and remove all history.

        • pixxelkick@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          8 months ago

          The two acts should be distinct for sure.

          You should be also able to delete all history without deleting account.

          Basically should be 2 distinct buttons/actions entirely.

  • alyth@lemmy.world
    link
    fedilink
    English
    arrow-up
    16
    arrow-down
    18
    ·
    edit-2
    8 months ago

    Lemmy is decentralised. The idea that Lemmy should implement European GDPR law makes no sense. Should Lemmy also implement every censorship law of every country?

    • Maalus@lemmy.world
      link
      fedilink
      English
      arrow-up
      27
      arrow-down
      5
      ·
      8 months ago

      If a website hosts european users, it needs to comply with GDPR. There isn’t a middleground here, whether you like it or not. If you cannot comply, you need to refuse those users by law (just as a lot of american sites do).

      • pop@lemmy.ml
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        9
        ·
        edit-2
        8 months ago

        Do you have any instances of EU going after companies without any presence in EU for not adhering to GDPR?

        Is the EU going to invade Iranian company because I complained I want to delete my data in their server? best they’ll do is block their website.

        Try using your GDPR rights on chinese websites like Aliexpress and Alibaba. I’ll wait.

        Any god damn law can be written in the books, doesn’t mean they apply universally outside of their jurisdiction.

        • Maalus@lemmy.world
          link
          fedilink
          English
          arrow-up
          9
          arrow-down
          1
          ·
          8 months ago

          Yes, I have plenty. Check every US local news site as a European, they tell you they can’t serve you. There is also a site that tracks the fines. Some of the more interesting ones that I browsed through, were the UK ministry of defense.

          Funny you say aliexpress, because aliexpress actually complies with GDPR. They have cookie notices and everything.

          You can be angry all you want. The reality is, if you host EU data, then you are beholden to GDPR. It isn’t some toothless law that you can just ignore. If someone reported lemmy.world or a similar instance, it would get hit by a fine.

    • schteph@lemmy.world
      link
      fedilink
      English
      arrow-up
      25
      arrow-down
      5
      ·
      8 months ago

      GDPR isn’t about where the site is hosted, but whether it caters to EU citizens or not. So, if a lemmy instance allows EU citizens to register and/or visit, GDPR applies to them.

    • bouh@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      8
      ·
      8 months ago

      If you consider Europe like any other country, then no matter. But what would happen if US law were to target lemmy? What if EU was to censor lemmy and forbid any company to use it?

      If you want lemmy to be yet another forgotten free software project you can continue line this.

  • Katlah@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    8
    arrow-down
    16
    ·
    8 months ago

    The Lemmy devs in general are not exactly known for being great people. Luckily the project is open source, and if they want to fuck around and find out then they can.