Well, while everything tarketed to Europeans (having EU domains is enough) should follow GDPR including the right to be forgotten, the whole issue is a bit more complex than most people seem to think.
For one, things not marketed to EU citizen don’t count. And the owner of a website, this case the hoster of an instance, is responsible for this. Not the software they use (Lemmy). I don’t think Lemmy tracks you specifically, as the code is open source and people likely would’ve noticed that by now. But servers could theoretically. That’s why you need to choose a server you trust, or host your own.
An instance aimed at USA people hosted in the USA doesn’t need to be GDPR compliant while a German one hosten in Germany would. An instance aimed at the world hosted in the USA also would, but likely breaks GDPR simply by being hosted in the USA. That’s part of why big social media need EU servers.
A federated system is not in one place, and another issue is that while deletion requests could be send (and Lemmy supports this accourding to their website), it can’t be as easily enforced to be followed by third parties. Of which, there are a lot in a decentral place.
Think of this:
If I post something on Reddit, it get’s reposted to 4chan, then I remove my original post, then it’s still on 4chan. I could ask them to remove it, but that would likely be declined. Since 4chan has little to do with the EU and it’s citizen, and doesn’t actively market itself, they have little to do with the GDPR. At best you could make a copyright based claim, but that’ll change it into a whole other topic.
Federated systems similarily take eachothers content. It’s important to note that generally Federated networks don’t push their content to other instances. Instead, other instances grab them from each other. How often has federation not gone smoothly causing deleted Mastodon posts to still show up on otger instances because they grabbed the post but not the deletion request (I’ve seen it happen multiple times already).
The right to be forgotten forces them to make it anonymous and untracable upon request, but not to delete every word you ever typed. Anonymising your account and deleting traceble info only would be enough. That means, if the server you requested to deletes their part + send a request to third parties they deliberatly send info to themselves, they did their job as far as law is concerned.
Any third party that grabbed the info by themselves, would require you to send a new request to them. Considering federation works by grabbing other instances, not by pushing your instance to others, any federated post that still has your old info could still be up if changes or deletion requests haven’t been processed.
So is Lemmy bad for privacy by default? Not anymore than the rest of the web, as long as you understand that the whole point of decentral systems mean it’s not one place. Best to always keep in mind that everything on the internet is forever and public, even if you delete it or use filters on who can see it, as you can never ensure no one copies it and post it elsewhere.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
Well, while everything tarketed to Europeans (having EU domains is enough) should follow GDPR including the right to be forgotten, the whole issue is a bit more complex than most people seem to think.
For one, things not marketed to EU citizen don’t count. And the owner of a website, this case the hoster of an instance, is responsible for this. Not the software they use (Lemmy). I don’t think Lemmy tracks you specifically, as the code is open source and people likely would’ve noticed that by now. But servers could theoretically. That’s why you need to choose a server you trust, or host your own.
An instance aimed at USA people hosted in the USA doesn’t need to be GDPR compliant while a German one hosten in Germany would. An instance aimed at the world hosted in the USA also would, but likely breaks GDPR simply by being hosted in the USA. That’s part of why big social media need EU servers.
A federated system is not in one place, and another issue is that while deletion requests could be send (and Lemmy supports this accourding to their website), it can’t be as easily enforced to be followed by third parties. Of which, there are a lot in a decentral place.
Think of this: If I post something on Reddit, it get’s reposted to 4chan, then I remove my original post, then it’s still on 4chan. I could ask them to remove it, but that would likely be declined. Since 4chan has little to do with the EU and it’s citizen, and doesn’t actively market itself, they have little to do with the GDPR. At best you could make a copyright based claim, but that’ll change it into a whole other topic.
Federated systems similarily take eachothers content. It’s important to note that generally Federated networks don’t push their content to other instances. Instead, other instances grab them from each other. How often has federation not gone smoothly causing deleted Mastodon posts to still show up on otger instances because they grabbed the post but not the deletion request (I’ve seen it happen multiple times already).
The right to be forgotten forces them to make it anonymous and untracable upon request, but not to delete every word you ever typed. Anonymising your account and deleting traceble info only would be enough. That means, if the server you requested to deletes their part + send a request to third parties they deliberatly send info to themselves, they did their job as far as law is concerned.
Any third party that grabbed the info by themselves, would require you to send a new request to them. Considering federation works by grabbing other instances, not by pushing your instance to others, any federated post that still has your old info could still be up if changes or deletion requests haven’t been processed.
So is Lemmy bad for privacy by default? Not anymore than the rest of the web, as long as you understand that the whole point of decentral systems mean it’s not one place. Best to always keep in mind that everything on the internet is forever and public, even if you delete it or use filters on who can see it, as you can never ensure no one copies it and post it elsewhere.