How can an instance comply with GDPR if they're federated?
How can an instance comply with GDPR if they're federated?
So if I understand GDPR correctly: If I want a service/business to remove all my personal data, they have to comply with it in a certain timespan or get in trouble with the law.
If I understand federation correctly: All posts get replicated on federated instances all over the fediverse.
My question: If I e.g. want lemmy.world to remove my data, all my posts etc are still up on lemmy.ml right? As they just have a copy of these posts?
Would I as a customer have to contact every single instance to get my data removed? Or how does GDPR compliance work with lemmy?
Or am I completely misunderstanding how GDPR works?
It sorta depends on the relationship between federated servers. If your server acts as a data controller and the servers it federated with act as a data processor, then yes indeed your admin would have to contact all those servers to get that data removed.
But I don’t think that’s what the relationship really is. I think your server publishes that data effectively publicly. At that point other servers can take a copy if they want (ie each would be a controller). So you’d have to make a request to each server to get the data removed.
Think about it like this, if you allow some print publication to print your name for some reason, some other companies might keep a copy of that data. Eg an archival company, or perhaps something less nice like a sales leads company. The publication doesn’t have a responsibility to contact them all. Even if, say, they have some relationship, like federation, or for example archival company has a subscription to the newspaper.
So if you want that data deleting you’re going to have to contact every sever that has it.
Yeah, that sounds like the most correct take. I don't think the EU will be happy with that if ActivityPub really blows up. e.g. if Threads joins the federation (and we don't defederate from their data leeching service), that would become really really complex :)
Yeah that really could end up being problematic!
Actually not sure how that’s going to go.. presumably it’ll work the same way search engines do cos it’s kinda like holding a copy of public data like they do…
-Someone correct me if I’m wrong but GDPR doesn’t apply fully to small organizations (less than 250 employees) and mostly only applies if you offer goods and services which is not the case if you’re running a Lemmy instance. If you’re an instance owner with no employees because you’re not a registered business of any sort, you’re not on the hook for anything-
Then again, I am neither European or knowledgeable in GDPR so someone please correct me if I’m wrong.
Edit: I am wrong see below
This is incorrect, GDPR is any registery, company size or even profit/nonprofit is not relevant. Even it being digital/in paper is not relevant. If EU citizen is identifiable in registery, it must comply with GDPR.
Apologies, I was reading an earlier draft of GDPR that had information on companies with fewer than 250 employees. Not sure how Lemmy instances fall under this though, do you know?
Businesses that are not engaged in processing of the personal data listed in Article 9 or Article 10 do not need to appoint a data protection officer (DPO or DPO as a Service) unless they are engaged in regular and systematic monitoring of data subjects on a “large scale”.
It isn’t a single site or host, and there is no owner. Wouldn’t that be like saying “e-mail must be GDPR compliant”?
Not as if the GDPR cares about that specifically. Whatever excuse or justification you might have, the law still applies... Mail servers also have to comply with the law.
To the point of the person you're replying to, I think it may be treated the same as email. For example, if you send an email and it gets forwarded somewhere else, all the "custodian of your data" (lets say google in this example) can do is delete any copies they have on their server. Anything outside of that is outside their responsibility/capacity.
Think of it this way. The way I see it federation is similar to an archival service storing a copy of the data. If reddit deletes all info when requested, but archive.org doesn't delete it. Well it ain't reddit's problem anymore.
Similarly, if a user request data deletion of data in their home instance located in the EU, and as long as the instance honors the request and delete their copy, that instance is not liable for other instances not honoring the deletion request. You might have to request data deletion with each individual instance that has a copy of your data, and it's only enforceable if the instance is in the EU where GDPR applies.
That's my interpretation, correct me if I'm wrong.
If archive.org, or any other web scraper is able to pull personal information from a site, it means that the site is already breaking the GDPR.
GDPR protects personal information, not public texts.
Because instance holds identifying information about EU citizens (email, nickname), it means that the instance owner is the registery holder, and they must comply with GDPR.
I believe email address of the user is not shared between the instances, what makes things quite good. Nicknames are bit more problematical, because they can be considered as personal identifier.
Some GDPR experts maybe should write template registery document that instances can use. And the delete of account should be handled between instances. Posts do not need to be deleted, but nick should be changed to [deleted]
That sounds like a good take. I have no idea if it's correct, but it sounds reasonable.
So I'd have to contact every single instance to get rid of my data, which sounds reasonable, but is practically speaking absolutely impossible.
Lemmy just sounds like a GDPR nightmare for the EU tbh.
Not sure if this is the right community to ask? It's not really a technical support question, just a general lemmy question.
The solution will be really simple and probably arrive in the next 12 months.
You just federate the removal requests too as part of the Lemmy API.
That feels potentially incomplete, because there's still the question of how to deal with an instance that refuses to honor federated removal requests, or which claims to but lies and secretly keeps a backup. If for example the legal/regulatory system was to decide that the original instance was responsible for ensuring user data is deleted even from federated servers, then the potential existence of such non-deleting servers would be a huge problem for the network as a whole.
As soon as the content moves to another server, it's their liability to comply.
If you scrape a website, the website removing a user's PII in response to a GDPR request is not contingent on you also deleting what you scraped.
Federation of removal requests would simply ease the flow of compliance for both hosts and users.
If certain hosts decide to ignore the requests and the GDPR, that's up to them.
GDPR only applies if the data can be linked to individual.
Only thing in Lemmy that identifies you, is your email. Nickname is not personal information, you cannot be identified from it. If the email is not transferred to another instances, there should not be problem with federation. If user requests GDPR erase, instance just deletes the account, and email linked to it. After this the user is not anymore identifiable, and GDPR is happy.
It seems the GDRP does not agree with you:
To what data do the EEA GDPR and the UK GDPR apply?
The EEA GDPR and the UK GDPR apply to all "personal data,” which includes any information relating to a living, identified or identifiable person. Examples include name, SSN, other identification numbers, location data, IP addresses, online cookies, images, email addresses, and content generated by the data subject.
That's not correct. The nickname is personal data, because it is possible to connect it to the person.
That is the correct answer. Companies abiding by the GDPR are not required to delete your account or content at all, only Personally Identifiable Information (PII). Lemmy instances are unlikely to ask for info such as real name, phone number, postal address, etc; the only PII I can think of is the email that some (not all) instances request. Since it’s not a required field on all instances, I’m going to guess that the value of this field does not travel to other instances.
Therefore, if you invoked the GDPR to request your PII to be deleted, all that would need to happen is for the admin of your instance to overwrite the email field of your account with something random, and it would all be in compliance. Or they could also choose the delete your account, if they prefer.
Source: I’m a software engineer who was tasked at some point with aligning multi-billion-dollar businesses to the GDPR, who had hundreds of millions of dollars in liability if they did it wrong and therefore took it very seriously. I am now a lawyer or a compliance officer, but we took our directions from them directly and across several companies, that’s what they all told us.
This was discussed in depth yesterday, removing per rule #4.
Why do you think Lemmy is GDPR compliant?
No idea. That's why I am asking.
I just feel that if Lemmy keeps growing, the EU will eventually take notice and consider implementing requirements/measures/regulations...
But I guess it's not just lemmy, but also any other fediverse (or any other decentralized) service. Just curious
Practically speaking, can they actually regulate it, beyond going after instance owners that are themselves based in the EU? I mean, they can pass laws, but given that instances are not large companies that might want to do business in Europe, I'm not sure what stops an instance owner not located within their jurisdiction from just ignoring them and not paying any levied fines or similar. They could require ISPs then block that instance or something I suppose but keeping up with an evolving list of tiny websites that don't necessarily advertise themselves much and so might slip under regulator's radar for awhile is probably much more difficult to block compared to a single corporate run site.
Not that I'm suggesting that Lemmy shouldn't make an effort to comply with regulations requiring people be able to delete their data, if anything, such a system if successful would make it harder for companies to take advantage of it by setting up servers to secretly collect what data they can, for example, I'm just questioning if it's really possible for a government to meaningfully enforce rules on some small group of random mostly volunteer people who may likely be operating from another country anyway.
the EU will eventually take notice and consider implementing requirements/measures/regulations...
The regulation is already here LOL. The GDPR is the regulation.
If somebody accuses you, then some court is going to judge.
Lemmy was created before GDPR.
Volunteers probably have not implemented GDPR and may not, or might.
GDPR was made in 2016. Lemmy is 4 years old