• Obinice@lemmy.world
    link
    fedilink
    English
    arrow-up
    52
    ·
    8 months ago

    How exactly does Lemmy remain in compliance with laws regarding, for example, a user’s right to have all data associated with their account deleted (right to erasure, etc), or ensure that it is only kept for a time period reasonable while the user is actively using your services (data protection retention periods, etc)?

    It’s not a big deal for me, just strange to think Lemmy of all places would be built to be so anti user’s data rights. The user is ultimately the one that decides what is done with their information/property, after all.

    • viking@infosec.pub
      link
      fedilink
      English
      arrow-up
      45
      arrow-down
      1
      ·
      8 months ago

      Lemmy is not a singular software or website, every instance on its own need to ensure compliance with their respective laws where they are domiciled.

      But if instance A is domiciled in the EU, and the content mirrored to instance B in Zimbabwe, where no right to be forgotten exists, then a user of instance A can’t invoke any laws beyond what the local admin can control.

      That’s amazing for high availability of content - it’s essentially mirrored in perpetuity - but a nightmare for privacy advocates. AFAIK there haven’t been any court cases related to deletion requests, so that’s still virgin territory.

      • 𝙲𝚑𝚊𝚒𝚛𝚖𝚊𝚗 𝙼𝚎𝚘𝚠@programming.dev
        link
        fedilink
        English
        arrow-up
        14
        arrow-down
        3
        ·
        8 months ago

        Instances located in Zimbabwe still have to comply with the GDPR, as the law applies to any entity that processes EU citizen’s personal data, regardless of where this happens. Instance B would also have to comply with a deletion request, or whatever EU member state the citizen is from will impose a fine and seize assets if necessary.

        • Zagorath@aussie.zone
          link
          fedilink
          English
          arrow-up
          13
          arrow-down
          4
          ·
          8 months ago

          This is the stupidest claim GDPR makes. It’s completely unenforceable and it’s attempting to enforce EU law in countries outside of the EU, which goes completely against any norms in international relations.

          • 𝙲𝚑𝚊𝚒𝚛𝚖𝚊𝚗 𝙼𝚎𝚘𝚠@programming.dev
            link
            fedilink
            English
            arrow-up
            8
            arrow-down
            3
            ·
            8 months ago

            It absolutely is enforceable, and the EU has already enforced it several times.

            The EU can of course try to seize assets, but in many cases they have signed a treaty with other countries stating they have the right to enforce the GDPR within their borders. Think a bit in the sense of an extradition treaty. For the US, this is the EU-US Data Privacy Framework for example.

            This means the EU absolutely can, will and has the means to enforce the GDPR abroad.

          • BigDiction@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            4
            ·
            8 months ago

            I don’t see how it could be enforced without this. If you are operating internationally, comply or block your service from regions you cannot legally operate in.

            Personally I don’t think Lemmy should comply. It’s an ad free community service with zero PII obligation besides an email and whatever IP you choose to connect from. No one has to be on Lemmy for any common social obligations.

            If you want to be forgotten then leave!

            • Zagorath@aussie.zone
              link
              fedilink
              English
              arrow-up
              6
              ·
              8 months ago

              If you are operating internationally, comply or block your service from regions you cannot legally operate in.

              Couple of problems with this. First, it’s putting the onus on a company that does not operate in Europe to figure out what European law is and to try to comply with it. Why should they have to do that? If you’re not operating in an area, you should not have to ever give any consideration whatsoever to the laws of that area.

              The second is that, unless I’m misinformed, the EU claims its law applies to any EU citizen, regardless of location. Which means if a Dutch person moves to Australia and uses Australian companies’ services, the EU says “hey, Australian company, you gotta do what this Dutch person says with their data”. Which is utterly ridiculous.

      • SorteKanin@feddit.dk
        link
        fedilink
        English
        arrow-up
        14
        ·
        8 months ago

        GDPR does not depend on business size, there are just a few stricter requirements when you have more than 250 employees. But most of the GDPR still applies to my knowledge.

      • TheObviousSolution@lemm.ee
        link
        fedilink
        English
        arrow-up
        7
        arrow-down
        2
        ·
        edit-2
        8 months ago

        Uhuh, suuureeeee. Tell that to any number of fines that has yearly been issued by my country’s GDPR oversight agency on ordinary citizens.

        GDPR only applies when people file reports and when there are lawsuits. There’s literally no shortage of articles of people fined for GDPR violations, all people need to do is search for them.

        When someone files the inevitable court case, please let me know. I have some admin behavior bullshit I will be willing to personally get in contact with the lawyers about that I think could help it.

          • TheObviousSolution@lemm.ee
            link
            fedilink
            English
            arrow-up
            13
            arrow-down
            2
            ·
            8 months ago

            You confuse things. Just read: https://www.compliancejunction.com/gdpr-guideline-for-companies-with-less-than-250-employees/

            If you think that your company can simply ignore the introduction of the GDPR and continue as before, well, think again. Any company that is found not to be complying with regulations of GDPR can be penalized with heavy fines, or a company may have to suspend or stop processing personal data. In fact, many companies are not yet ready for GDPR because they figure this legislation will not influence their company.

            DPR compliance is as important for companies with less than 250 employees as it is for large multi-national corporations. Consequently, many companies have chosen to appoint a Data Protection Officer (DPO) to address to the GDPR requirements or appoint a consultancy company to get their GDPR preparations started before delegating the role to an existing employee. For further information about this option, please refer to our article “Do Small Companies Need to Appoint a DPO under GDPR?”

            Not sure how you think individual people can get fined under the GDPR but companies with less than 250 employees can’t. This is just about the only exemption:

            Article 30 of GDPR is about a data inventory record and provides one potential exception for Organisations with less than 250 employees. This is a limited exemption which states that Organisations with less than 250 employees may be exempt from maintaining a data Inventory or record of processing activities. This Exemption is a minor exemption and only applies for Organisations with less than 250 employees in certain circumstances where there is no processing that is likely to result in a risk to the rights and freedoms of data subjects, the processing is only occasional, excludes special categories of personal data and personal data related to criminal convictions. The Full text of Article 30 is below. This limited exemption should in no means be interpreted by Organisations with less than 250 employees as an authorisation to ignore overall GDPR Compliance.

    • ILikeBoobies@lemmy.ca
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      20
      ·
      8 months ago

      Because Federation is a terrible idea

      But think of Reddit, they can delete a post but a bunch of archived websites will still have it. That doesn’t make Reddit non-compliant

      • r3df0x ✡️✝☪️@7.62x54r.ru
        link
        fedilink
        English
        arrow-up
        29
        ·
        8 months ago

        Why is federation bad? It’s the only way to decentralize without having everyone scattered across millions of sites.

        The days prior to 2014 are gone and for the most part, the overwhelming majority of people don’t want to register across dozens of sites. Everyone naturally gravitates toward massive content silos where they can get everything in one place.

        • Gabu@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          8 months ago

          It’s not bad in principle, but so far there hasn’t been an implementation that fully addresses all relevant issues.

        • ILikeBoobies@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          5
          ·
          edit-2
          8 months ago

          For the health of the internet you want people scattered across millions of websites

          And the need for regulations that limit active users isn’t a reason to contribute further to the problem

          Preventing congregation weakens the effectiveness of disinformation and propaganda campaigns, and protects against bullying

          • r3df0x ✡️✝☪️@7.62x54r.ru
            link
            fedilink
            English
            arrow-up
            3
            ·
            8 months ago

            For the health of the internet you want people scattered across millions of websites

            I don’t understand this point. Federation brings everyone together. I don’t understand why it’s bad for everyone to spread out.

            Preventing congregation weakens the effectiveness of disinformation and propaganda campaigns, and protects against bullying

            This is a contradiction. This is an argument for having everyone decentralized rather then together in massive content silos.

            • ILikeBoobies@lemmy.ca
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              8 months ago

              This is an argument for having everyone decentralized rather then together in massive content silos.

              Yes, if everyone is together it is much easier for misinformation to spread

              If a Russian content farm was to try and get a message out would it be easier if they made one post seen by millions or thousands of posts seen by a few thousand people

              Even Lemmy mods know federation is a bad thing because their answer to preventing the above is defederating