all personal data from EU users must remain in the EU
Create your account on a EU server, problem solved.
Lemmy (fediverse in general) doesn't send account data away, and posts don't qualify as personal data, when you publish something to the internet, it's public by definition.
GDPR Art 4.(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Every post and comment in Lemmy qualifies as personal data because they contain the ideas and opinions of an identifiable natural person (by their user handle). Therefore the Lemmy instances are handling personal data and must comply with the GDPR.
Ideas and opinions are NOT identifiable information, unless you're so smart to as openly writing your personal data on a public forum (something noone should ever do, it's even bannable on reddit), your comments and posts do NOT contain and personally identifiable info, only your account does.
Personal data is not identifiable information. Personal data is information about an identifiable person. The identifiable information is your username (“online identifier”)
There is no way someone can link your username to who you are in person, unless it's you who write it out.
Laws don't protect people from themselves.
An individual’s social media ‘handle’ or username, which may seem anonymous or nonsensical, is still sufficient to identify them as it uniquely identifies that individual
And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data.
Thankfully, Lemmy instances do not transport this kind of information about their users to other instances!
Maybe not IP addresses, but every post and comment you make is your personal data.
Public posts and comments are, well, public (and there's no expectation from users that their posts and comments would be private, considering the nature of what Lemmy is).
The only way to not transport public posts and comments to the rest of the internet (including but not limited to other Lemmy instances) would be to completely disconnect an instance from the internet 😅
GDPR does not distinguish between public or private data.
GDPR handles public data through propagation. If you download public data that is GDPR covered, the data you downloaded also becomes GDPR covered. You are required to follow all GDPR regulations while handling the downloaded data.
Remember, GDPR covers almost all "collected personal data". It does not matter if the data was originally public, and how/where the data was collected. It's all covered.
However, Lemmy instances may still be exempt from GDPR as they are non-commercial: https://gdpr-info.eu/recitals/no-18/
IANAL as usual.
Since the entire goal of the fediverse is “transporting” all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place.
It doesn't work like that, think of your instance being a proxy to the fediverse
Is it? I read somewhere that data effectively gets "copied" to the different instances? But that might be wrong info :p
You're right. If someone from feddit.de subscribes to a lemmy.world community, the entire content of that community is going to be copied to the feddit.de server and that's the exact issue OP is referring to.
Then it should be the responsibility of the EU people to avoid joining the fediverse. I do not see a practical way to align with GDPR. The effort is non-trivial and the rewards are extremely minimal.
From your perspective, what should be the way out?
Then it should be the responsibility of the EU people to avoid joining the fediverse.
The instances are providing their services in the EU, so it's legally up to them to comply with the GDPR.
From your perspective, what should be the way out?
Honestly, no idea. I'm not even sure if Lemmy in its current shape violates the GDPR in the first place, but if I were the admin of a large feddit instance in the EU I would make sure to get advise from a GDPR consultant.
Everything about Lemmy; bugs, gripes, praises, and advocacy.
For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.