Was there even a mass exodus? I largely avoid Reddit now, but I do kind of doubt that they’ve been hurt in any meaningful way by all the protests and people leaving…
It’s currently impossible to follow a GDPR information delete request for example, because you can’t delete the info from other instances.
What makes it impossible? Why would any given instance maintainer be responsible for the data on someone else’s instance? Would it not fall on the GDPR requester to make that request of each individual instance?
So then if someone requests that Gmail delete all their email data, is Google then responsible for making sure any emails sent out from it’s server to another is also deleted from those external servers?
Just in case you guys are wondering, there’s probably dozens of us enjoying the fuck out of this conversation. Thank you for asking questions I wouldn’t think of asking. On behalf of all three of us lurking.
I don’t have the answer but I think of it like this.
Email is essentially a direct conversation between you and someone in the same room but you may extend (cc) to those people in the house. There is an implicit “I am including you in the conversation”
Lemmy on the other hand is more akin to talking to someone in a crowded bar but the conversation is recorded and anyone over the world has the ability to listen to the conversation at any given time.
Apples and oranges.
See https://gdpr-info.eu/issues/right-to-be-forgotten/
Once the “controller has made the personal data public”, they have legal obligations. When you send an email, you are not making it public.
Essentially yes, it’s called the Right to Erasure or the Right to be Forgotten. If the user is in a country that adheres to GDPR and the company controlling the data operates in a country that also uses GDPR, then that right applies.
The only reason Google/Gmail wouldnt delete (or wouldn’t be able to delete) some of your data would be if they had a lawful or legitimate basis for holding onto it.
I can’t think of a reason Google would give for hanging on to your data but that doesn’t mean there isn’t one, but they’d have to notify you of that reason as part of their response to your request.
Unless these instances are showing ads and selling data, I’m pretty sure they’re protected from the law. Not only that but if you’re not hosting in the EU that law doesn’t apply to you.
See https://gdpr-info.eu/issues/right-to-be-forgotten/
Once the “controller has made the personal data public”, they have legal obligations.
Yes, but “the controller” is one instance, and it’s certainly easy for one instance to allow a user to be forgotten. You can purge the user from the instance. Then they are forgotten, as far as the instance is concerned.
As an example, just because someone makes a GDPR request on YouTube to delete a video, does not require Google to actually remove the video from the whole internet. There are plenty of websites that archive content which are unaffected by that GDPR request. It’s the exact same thing with different Lemmy instances, just because you ask lemm.ee to delete your content does not mean that lemmy.world needs to delete your content.
The GPDR doesn’t require Lemmy to remove personal data from the entire internet. But when a Lemmy instance gives data to other Lemmy instance, there are legal responsibilities.
https://gdpr-info.eu/art-17-gdpr/ Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
==========
Maybe this is open to interpretation, but I feel that the same Federation protocol that federates out my personal data (my posts and comments), should also federate out my delete requests. I’m unsure why this would be controversial.
