Drive we are so privacy focused here. What is to prevent myself or anybody out there, from starting to report individual instances of GDPR and CCPA.
No lemmy insurances are complying with national privacy laws and nobody is talking about it at all.
Drive we are so privacy focused here. What is to prevent myself or anybody out there, from starting to report individual instances of GDPR and CCPA.
No lemmy insurances are complying with national privacy laws and nobody is talking about it at all.
I hope you never send an e-mail overseas. Your e-mail provider would be in breach.
Just to be clear - I don’t think it is in breach but you have federated servers in various countries, some of which may be owned by entities that do business in the EU making copies of and forwarding messages that contain PII .
How would they be in breach?
You send the exact same kind of information when you send an email.
Username, host, and IP.
But e-mail is sent from one entity to another, through servers providing service for one or the other party. Most of Lemmy and Mastodon activities are publicly broadcasted and can be received and collected by any federated server.
Your email address (personal identifier) is right there in the from field. And in many cases, in the header there might be your IP address.
How is that a breach of GDPR?
Our point is, sharing the information required to make a network like this work is allowed provided you’re not sending information not required. If you right a post on a community that is shared the information about you (user id, avatar etc) is required to render that message on other federated instances. In the same way as when you send an email the from address is required so that people can reply to the email.
If we were sending IP addresses and data on your browsing preferences to other instances, there would be an argument because it is not required operate the federated network (although you know the corporate players are all justifying their sharing of exactly that data and more). But we don’t do that.
Thank you! Understand - I think the issue is there there is no documented policy on some instances, I don’t know how each instance handles / shares my data and what the retention policies etc are. I seem to remember there are more controls required depending on where the data is being transferred to. Anyway, that’s getting beyond what I am familiar with!
Yes, definitely and this has prompted me to write one up for mine. Even though right not it is just me, I am open to having around 100 active users on my instance. So this should be clear I think.
Awesome! I’m pretty sure there are some great websites with resources if you need it, although they likely come with a caveat they are not legal guidance :)
The ICO have a template. But now I need to go through and see what data is collected and check/adjust retention where relevant (http logs for example).