The GDPR doesn't apply only to services hosted in the EU, but any services handling the data of an EU citizen.

This is why some news outlets in the US just decided to block EU users all together, out of laziness.

IANAL, but the GDPR doesn't cover pseudonymous data. Actually the GDPR encourages data processors (= services) to use pseudomization.

Personally identifiable information are IPs, email addresses, street address, name, date of birth, ... Lemmy only collect IPs and email addresses. And these are not shared between instances.

Whether the service is hosted in the EU or not, as long as it serves EU users, lemmy should provide a way to delete emails and ip information in a self serving way. (maybe by deleting the account) In the mean time, instances admins have to fulfil requests to delete emails/ips of EU citizens from the database.

I am not a lawyer and definitely not anyone’s lawyer providing legal advices, but I’ve done a little bit of work around implementing GDPR compliance at my jobby job. My understanding is that you must inform users when you’re sending their data out to third party processors, and they, too, must be GDPR complaint.

So if your instance is sending information that is covered under GDPR out to other instances, you much call out those instances as data processors, and ensure they’re complaint before you add them. When you add one, I think you’re also supposed to inform users that you’re adding a new data processor via some form of notice addressed to them. Furthermore, at time of deletion, you’d also need to inform your data processors of the request, such that their compliance workflow can be followed.

In my mind, strictly speaking, what Lemmy is doing could work if the “cluster” of GDPR compliant instances doesn’t federate out to the broader non-GDPR compliant instances. So, lots of manual maintaining the allowed federation instances, each time you add a new instance, you’d then need to inform your users… once you receive a deletion request, you’d need to use the ban with purge option to purge everything on your instance, and pass that on to all federated instances. The key distinction here is ensuring your federated instances honours your purge request, which is hard to verify.

The end result is that you’d essentially be creating your own bubble of the fediverse isolated from the rest of the fediverse… which is not an ideal outcome but that’s what happens when you let regulators decide what to do on things they don’t understand…

Actually I wonder if the end result would end up essentially being, you can only federate with other GDPR compliant instances that you trust will respect the GDPR and honor federated data delete requests.

The core of the issue is that just by the virtue of running, an instance collects a stupid amount of data. I was baffled at how many user accounts my instance had discovered mere hours after starting it up.

Edit: row counts after just a week of running my private instance with only 3 users:

The profiling potential is scary, so users should be really careful with basically every interaction on the Fediverse, including votes. I bet the feds are having a field day monitoring what's going on on exploding-heads and lemmygrad.

The protocol would seem unlikely to satisfy the concept of "necessary". It's entirely possible for the protocol to be impossible to implement whilst not complying with GDPR. Might require the development of something more sharded - data pulling in real time, etc.

That definitely seems like it might be along the right lines - Though GDPR (rightly so) was designed to leave the power in the hands of the user/customer, you're right, it doesn't account for things like the fediverse. I wonder if something else put in the legal section would actually cover it

This is already implemented in lemmy 0.18.1 for comments and posts!

Good idea!

Intersting you bring that up copyright. I was looking at Peertube just earlier today and I was wondering how on earth some of the larger instances are dealing with copyright. There is no way they can watch every second of content that gets uploaded

I think you're right though. Unless you get lucky/unlucky, its highly unlikely your instance is ever going to be used by many people, and therefore for most it'll probably be a grey area.

If it did however, you need to not only "administer" that instance, both from a front and backend point of view, but there are also things like copyright to deal with.

Very interesting, they actually seem to have thought this aspect through. Fully supportive of the fediverse and wouldn't ever want to ever scaremonger or push people to not want to hosting their own instance, but with the explosion of Lemmy instances - At a certain point I am guessing someone will want to look into this in more detail.

Whether its a change in regulation or helping people be responsible with data - Holding PID of some kind (in this case emails) does need to be done responsibly

The main issue would be thay users can post personally identifiable information themselves.

For example, I can say that my social security number is 1234 and that would be personal data if it was true.

I'm not a lawyer, but i think i remember something that the gpdr rights cannot be just waived.

Since the user can just delete their own posts, it shouldn't be a problem, but what do I know.

No, public websites are explicitly not covered by this exemption even if no profit motive is involved.

Interesting - The Wiki article seems to make it out to be less about commercial that the actual links to the articles provided. I'll keep reading, thank you

Yes I think you’re right, but also IANAL. From what I learned in a mandatory class at work, I think the GDPR only covers commercial activity. GDPR is supposed to protect citizens when engaging in commerce:

an entity or more precisely an "enterprise" has to be engaged in "economic activity" to be covered by the GDPR.

Lemmy doesn’t charge a subscription fee or sell ads (yet), so it’s acting as a kind of personal messaging system for communicating between people. The GDPR explicitly says it doesn’t regulate personal messaging systems like email. I think Lemmy would fall under that exemption clause.