Hello fellow Lemmings!
Title. Is it possible for Lemmy to abide by the GDPR given that you can’t delete info from other instances?
Reposting what I posted here a while ago.
Companies abiding by the GDPR are not required to delete your account or content at all, only Personally Identifiable Information (PII). Lemmy instances are unlikely to ask for info such as real name, phone number, postal address, etc; the only PII I can think of is the email that some (not all) instances request. Since it’s not a required field on all instances, I’m going to guess that the value of this field does not travel to other instances.
Therefore, if you invoked the GDPR to request your PII to be deleted, all that would need to happen is for the admin of your instance to overwrite the email field of your account with something random, and it would all be in compliance. Or they could also choose the delete your account, if they prefer.
Source: I’m a software engineer who was tasked at some point with aligning multi-billion-dollar businesses to the GDPR, who had hundreds of millions of dollars in liability if they did it wrong and therefore took it very seriously. I am not a lawyer or a compliance officer, but we took our directions from them directly and across several companies, that’s what they all told us.
On the other hand, the GDPR’s concept of “personal data” is extremely broad, much more so than the US concept of PII. Personal data is any information relating to an identifiable person. Pseudonymous info is still personal under this definition. Online usernames or social media handles are identifiers, and any linked info (e.g. posts, comments, likes) is personal data as well.
So Lemmy and other Fediverse stuff is well within the GDPR’s material scope.
However, the GDPR’s “right to erasure /to be forgotten” is more nuanced. It doesn’t quite always apply (though usually does). OP very likely has the right to request deletion from individual instances.
Posts have been published through federation. The GDPR anticipates this (I think in Art 17(2)): if personal data has been made public by the data controller, and erasure is requested, then the data controller is obliged to take reasonable steps to notify other controllers of this.
The ActivityPub protocol has built-in support for sending out such deletion notifications, and last time I checked Lemmy implements this. Of course the receiving instance might not honor this, but that’s outside of the responsibility of the initial data controller.
While I’m not entirely convinced that everything here is 100% compliant, federation is less of a compliance issue than it might seem.
If that turns out to be an actual problem, the GDPR is overreaching and should be changed. After they get rid of the stupid cookie banner policy though.
