this post was submitted on 06 Aug 2023
4 points (100.0% liked)
Announcements
23287 readers
4 users here now
Official announcements from the Lemmy project. Subscribe to this community or add it to your RSS reader in order to be notified about new releases and important updates.
You can also find major news on join-lemmy.org
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I asked in the other thread about GDPR.
Nobody thinks it's very interesting but if instances don't follow gdpr, the entire network is at risk of legal consequences.
So please bring this up, even though it's not very fun.
Neither @[email protected] or I are too familiar with the GDPR, so we don't know everything that it requires. Lemmy doesn't do any logging of IPs or other sensitive info, but of course instance runners could be doing their own logging / metrics via their webservers.
We have a
Legalsection under admin settings, that's an optional markdown field, that can probably be used for it. We'd need someone with GDPR expertise though to help put things together. Lemmy is international software, not european-specific, so we have to keep that in mind when supporting GDPR.As a person who oversaw the implementation of GDPR in a large software house (which wasn't EU specific, but had to in order to operate legally in the EU), the requirements were:
For us, this was multiple ad companies. We had to e-mail each one, ask them about their GDPR implementation (most of them were somewhere between "we're thinking about it" and "we have an e-mail address you can send something automated to and we'll get to it sometime within the next month"), and then build an automated back-end system to either query their APIs for automated deletion, or craft/send e-mails for the more primitive companies.
As far as the data being deleted, it was anonymized IDs that were tied to their advertising IDs from their mobile phones. I used to try and argue that "no, it's anonymous" - but we also had some player data (these were games) associated with that, so we ended up just clearing house and deleting everything on request.
So, legally, this means every instance - in order to be GDPR compliant - would have to inform every instance it federates with that a user wants their data deleted. If you're not doing that, you're not fully compliant.
Kind of shitty, but that's how it went for me. (this was back when GDPR was first being released)
Edit: Also, the one month thing was relevant: you have 30 days to delete GDPR stuff after receiving a data clear request. I don't recall what the time was for a "see my data" request. Presumably, though, on Lemmy the latter is superfluous as all your data is already present on your profile page. An account export option would be enough to satisfy that.
Im not a lawyer so I dont know about GDPR. Do you know how similar platforms such as Mastodon handle it?
Hard to say exactly what Mastodon does, but mastodon.social's privacy policy should give you some direction in how they handle data: https://mastodon.social/privacy-policy
As mastodon.social is based in Germany, they will know about GDPR and have to follow it to the letter.
That sounds like its something for instance admins to handle, nothing we as developers need to care about. Maybe we should add a privacy policy for lemmy.ml but thats it.
Yea it is ultimately on the admins, but Lemmy just needs to not make it hard to comply with GDPR. So it's up to admins to raise issues when Lemmy is seen as an obstacle to compliance, and it's up to devs to listen and implement compliance features.
You don't have to bother with GDPR until you're a certain size company
That's what I thought too until I looked it up. It applies to individuals as well.