71
submitted 8 months ago by tazy@lemmy.tazy.xyz to c/privacy@lemmy.ml

I dont really use it much tbf just thought it was a cool project but I've just read about how lemmy instances can be fined for not complying with GDPR Read more

you are viewing a single comment's thread
view the rest of the comments
[-] a4ng3l@lemmy.world 15 points 8 months ago* (last edited 8 months ago)

Technically he must still comply especially with data subject rights / request for deletion.

Now I wonder how that would work in practice, considering the underlying technology which is akin to what I manage (telco / isp) and where a lot of principles are still vague to implement.

Like when we get request to delete personal data sometimes some has been transmitted by nature of the service and a lot of actors have legitimate interest in processing / keeping the data for a while.

But generally it’s not about the content of a transmission but more the attached metadata used for billing and such.

Anyway it’s very interesting to watch, preferably from a distance.

[-] ramble81@lemm.ee 6 points 8 months ago

Unless he gets a direct request he’s not bound by the requests other instances get. Which actually brings up something interesting. Because of the way the data is shared, someone wanting to delete data would have to contact all instances one by one which is function impossible.

[-] a4ng3l@lemmy.world 2 points 8 months ago

Yeaahhhh I don’t know about that… likely all instances are processors. And the on he subscribe to would be controller. Somewhat because to my knowledge no one really decides of particular treatment of the user data (it’s all rather communist architecturally). So maybe every instance would be join controller…

And in the end up to the (join) controller to cascade the request. That’s part of why it’s a thing of beauty to watch it happen on the feddiverse 😅

[-] ramble81@lemm.ee 0 points 8 months ago

And for any of those “processors” outside of the EU? Good luck. I could stand up a processor anywhere outside the EU, get all of the feed data and 1) good luck finding it, me, or where it’s at. And 2) removing it. There’s no centralized authority to fine.

[-] a4ng3l@lemmy.world 1 points 8 months ago

As long as they process data of European citizens it’s applicable. See all gdpr fines imposed…. Now the execution / collection would be a bitch but I could imagine à order to stop processing the data imposed to European instances…

I mean pretty crazy things can happen. See the various adequacy decisions / appeals by Mr Schrems; I cannot give guidance with a life expectancy of more than 1 year given the instability of the application of the regulation.

Not that I’m complaining ; it feeds me :)

[-] ramble81@lemm.ee 1 points 8 months ago

“Now the execution / collection would be a bitch”. That’s my point. It’s basically unenforceable as they would have to go after every federated instance on the internet, including knowing every single person that spun up their own instance, so basically this law would be pointless. It’s better leveraged against companies, not small individual entities, so good luck utilizing it.

this post was submitted on 05 Mar 2024
71 points (86.6% liked)

Privacy

31937 readers
679 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS