So, Iām kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussionsā¦
Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I donāt think there is jurisprudence regarding usernames, so that might be up for discussion.
Since the entire goal of the fediverse is ātransportingā all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsibleā¦ The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?
Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be āin the spotlightsā in the upcoming years.
I donāt like GDPR, and Iām all for the technological setup of the fediverse. However, I definitely can see a ācompetitorā (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competitionā¦
What do yāall thing about this?
ādonāt like GDPRā? Whatās not to like? Best thing that came out of EU regulation in a long time. And as others have noted you seem to be misinformed about what it actually saysā¦
I also canāt wrap my head around ānot likingā GDPR
As a relevant example, seems like only citizens covered by GDPR will be able to request Reddit to remove all of their data from Redditās servers since comment deleting tools and scripts are being bypassed, with loads of comments and even entire profiles getting restored by Reddit admins
Can you explain where Iām misinformed? I can surely be misinformed about the workings of Lemmy. However, for GDPR you will not āwinā it with a simple TOS or something like that.
If even Google canāt make their Workplace to follow rules in such a way that Workplace can be used according to the AVG rules in the Belgian (well, Flemish) schools, Iām pretty sure that just saying āitās in the TOSā is not enoughā¦
But again, no expert so I hope that I am wrong.
deleted by creator
You are missing the point. A TOS canāt fix it. If it can, they would have done so. And for GDPR, there is no difference between schools and genpop. A citizen is a citizenā¦
deleted by creator
deleted by creator
Wellā¦ Apparently (I did some reading), the topic was about Google Workspace for Education. A solution only used by schools.
Nobody is currently ācaringā about the normal Google Workspace. So yes and no.
Again, Facebook does not rely on their TOS. They rely on the fact that they obey to the Privacy Shield (see https://www.facebook.com/about/privacyshield). Lemmy instances do not, by default, obey to GDPR and or Privacy Shield.
Even more: (info from https://www.facebook.com/business/gdpr):
Transfers As is the case today, any transfers of personal data outside of the EEA (European Economic Area) must meet certain legal requirements. Facebook Inc. is certified under the Privacy Shield framework. Under this framework, we receive and process personal data from our advertisers in the EU. We do this in connection with certain products, including data file Custom Audiences, attribution checkup and certain offline conversion lift studies.(if the Privacy Shield is sufficient or not is a whole other discussion and not for this topic).
deleted by creator