So, Iā€™m kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussionsā€¦

Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I donā€™t think there is jurisprudence regarding usernames, so that might be up for discussion.

Since the entire goal of the fediverse is ā€œtransportingā€ all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsibleā€¦ The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?

Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be ā€œin the spotlightsā€ in the upcoming years.

I donā€™t like GDPR, and Iā€™m all for the technological setup of the fediverse. However, I definitely can see a ā€œcompetitorā€ (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competitionā€¦

What do yā€™all thing about this?

  • apfel@lemmy.world
    link
    fedilink
    English
    arrow-up
    21
    arrow-down
    1
    Ā·
    2 years ago

    ā€œdonā€™t like GDPRā€? Whatā€™s not to like? Best thing that came out of EU regulation in a long time. And as others have noted you seem to be misinformed about what it actually saysā€¦

    • BrokebackHampton@kbin.social
      link
      fedilink
      arrow-up
      4
      Ā·
      2 years ago

      I also canā€™t wrap my head around ā€œnot likingā€ GDPR

      As a relevant example, seems like only citizens covered by GDPR will be able to request Reddit to remove all of their data from Redditā€™s servers since comment deleting tools and scripts are being bypassed, with loads of comments and even entire profiles getting restored by Reddit admins

    • infamousbelgian@lemmy.mlOP
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      3
      Ā·
      2 years ago

      Can you explain where Iā€™m misinformed? I can surely be misinformed about the workings of Lemmy. However, for GDPR you will not ā€œwinā€ it with a simple TOS or something like that.

      If even Google canā€™t make their Workplace to follow rules in such a way that Workplace can be used according to the AVG rules in the Belgian (well, Flemish) schools, Iā€™m pretty sure that just saying ā€œitā€™s in the TOSā€ is not enoughā€¦

      But again, no expert so I hope that I am wrong.

      • cwagner
        link
        fedilink
        English
        arrow-up
        12
        arrow-down
        1
        Ā·
        edit-2
        1 year ago

        deleted by creator

        • infamousbelgian@lemmy.mlOP
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          3
          Ā·
          2 years ago

          You are missing the point. A TOS canā€™t fix it. If it can, they would have done so. And for GDPR, there is no difference between schools and genpop. A citizen is a citizenā€¦

          • cwagner
            link
            fedilink
            English
            arrow-up
            6
            arrow-down
            1
            Ā·
            edit-2
            1 year ago

            deleted by creator

            • infamousbelgian@lemmy.mlOP
              link
              fedilink
              English
              arrow-up
              1
              Ā·
              2 years ago

              Again, Facebook does not rely on their TOS. They rely on the fact that they obey to the Privacy Shield (see https://www.facebook.com/about/privacyshield). Lemmy instances do not, by default, obey to GDPR and or Privacy Shield.

              Even more: (info from https://www.facebook.com/business/gdpr):

              Transfers
              As is the case today, any transfers of personal data outside of the EEA (European Economic Area) must meet certain legal requirements. Facebook Inc. is certified under the Privacy Shield framework. Under this framework, we receive and process personal data from our advertisers in the EU. We do this in connection with certain products, including data file Custom Audiences, attribution checkup and certain offline conversion lift studies.
              

              (if the Privacy Shield is sufficient or not is a whole other discussion and not for this topic).

              • infamousbelgian@lemmy.mlOP
                link
                fedilink
                English
                arrow-up
                2
                Ā·
                2 years ago

                Wellā€¦ Apparently (I did some reading), the topic was about Google Workspace for Education. A solution only used by schools.

                Nobody is currently ā€œcaringā€ about the normal Google Workspace. So yes and no.