So, I’m kinda new to this Lemmy thingy and the fediverse. I like the fediverse from a technological standpoint. However, I think that, if we gain more and more traction, Lemmy (and by extend the entire fediverse) is a GDPR clusterfuck waiting to happen. With big and expensive repercussions…
Why? Well, according to GDPR, all personal data from EU users must remain in the EU. And personal data goes really far. Even an IP-address is personal data. An e-mail address is personal data. I don’t think there is jurisprudence regarding usernames, so that might be up for discussion.
Since the entire goal of the fediverse is “transporting” all data to all servers inside the ActivityPub/fediverse world, the data of a EU member will be transported all over the place. Resulting in a giant GDPR breach. And I have no idea who will be held responsible… The people hosting an instance? The developers of Lemmy? The developers of ActivityPub?
Large corporations are getting hefty fines for GDPR breaches. And since Lemmy is growing, Lemmy might be “in the spotlights” in the upcoming years.
I don’t like GDPR, and I’m all for the technological setup of the fediverse. However, I definitely can see a “competitor” (that is currently very large but loosing ground quickly) having a clear eye out to eliminate the competition…
What do y’all thing about this?
You are missing it. A TOS can fix anything it needs to. You are just disagreeing on what it needs to do. I see no reason why I as a user wouldn’t be allowed to use software that allows me to post messages to a US Server. AFAIK e.g. Facebook is not illegal in EU. You are arguing it is illegal, because they allow you to post data to the US.
edit: accidentally a word too too much
edit2: TOS is probably the wrong term, I guess I’m actually referring to a privacy policy.
Again, Facebook does not rely on their TOS. They rely on the fact that they obey to the Privacy Shield (see https://www.facebook.com/about/privacyshield). Lemmy instances do not, by default, obey to GDPR and or Privacy Shield.
Even more: (info from https://www.facebook.com/business/gdpr):
Transfers As is the case today, any transfers of personal data outside of the EEA (European Economic Area) must meet certain legal requirements. Facebook Inc. is certified under the Privacy Shield framework. Under this framework, we receive and process personal data from our advertisers in the EU. We do this in connection with certain products, including data file Custom Audiences, attribution checkup and certain offline conversion lift studies.(if the Privacy Shield is sufficient or not is a whole other discussion and not for this topic).
The whole discussion here hinges on the privacy shield having been cancelled (which the latest Schrems case did). You were the one bringing up transferring data to the US, the only reason that’s an issue, is because Privacy Shield was ended.
Oh, and for that, that would mean it’s now illegal to use it in all of Belgium, and not just schools, is that the case? We have different laws in Germany regarding institutions, students, private citizens, and even under what label one currently acts.
Well… Apparently (I did some reading), the topic was about Google Workspace for Education. A solution only used by schools.
Nobody is currently “caring” about the normal Google Workspace. So yes and no.