this post was submitted on 06 Mar 2024
348 points (100.0% liked)
Fediverse
35452 readers
78 users here now
A community to talk about the Fediverse and all it's related services using ActivityPub (Mastodon, Lemmy, KBin, etc).
If you wanted to get help with moderating your own community then head over to [email protected]!
Rules
- Posts must be on topic.
- Be respectful of others.
- Cite the sources used for graphs and other statistics.
- Follow the general Lemmy.world rules.
Learn more at these websites: Join The Fediverse Wiki, Fediverse.info, Wikipedia Page, The Federation Info (Stats), FediDB (Stats), Sub Rehab (Reddit Migration)
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It absolutely does, if the company processes data of EU residents. The US enforces GDPR themselves, as they have signed an agreement to do so. To be clear, this means that according to US law, if you are a US web host, you can abuse US customer data and the FBI will not come after you, but if you do so with EU customer data, US authorities will come after you on behalf of the EU.
Yeah it does, as soon as you are providing a service, if you have a user from the EU that's not you, it applies. And while GDPR fines are defined in a revenue percentage, there is a minimum of "up to 10 million EUR" for a violation.
Nobody is getting sued. EU data protection agencies don't "sue" people and companies. They fine them. The difference is that a lawsuit is a process where at the end you might need to pay money, but you mostly settle. A GDPR fine looks like you get a letter saying you need to pay an amount, if you want to appeal, you can do so after paying.
And it's not the devs that will be getting these fines, it's instance admins.
And this is why misskey is a mastodon instance that just blocked access if the person is from the EU, it's too much to ask for devs in a single digit that survive by donations or their own pocket money, this is a hobby for them.
Did they defederate from all instances allowing access to EU citizens? If not, they are still liable, as they are scraping EU citizen's data for federation. Even usernames are personal data according to the GDPR.
As per official EU communication:
Lemmy instances are entities that offer free services and are arguably monitoring the behaviour of individuals in the EU through federation. From the perspective of the GDPR, there is no difference between Facebook and a Lemmy instance regarding what they can or cannot do, or whether they get fined for something.
You need to read up on the GDPR yourself.
Usernames at the very least, as online identifiers.
And they don't need to be sold, just retained. GDPR applies even if there is no payment anywhere, even to non-commercial entities.
What do you think an online identifier is then? And why would the GDPR only apply if there is money made? It specifically says in multiple places free services also count.
How is IBM authoritative on this subject? And even so, this article doesn't say that usernames are not PII, it even indirectly says it is indirect PII.
Here's another random company's page saying usernames are PII: https://www.keepersecurity.com/blog/2023/06/14/what-is-personally-identifiable-information-pii/
The GDPR says it clearly and explicitly that:
And where did you read that? If anything, public usernames are easier to correlate to form identities.
Use this for starters https://www.eff.org/deeplinks/2022/12/user-generated-content-and-fediverse-legal-primer