Your instance has data covered by GDPR, but the data it sends to other instances is covered by the same exceptions as the data you send in a email. Without exceptions for legimitate interests it would be illegal to send an email from, say, mailbox to Gmail or Yandex Mail.
I guess that could be in regards to user profiling.
Since no fedi platform aggregates user data like “user xy always upvotes topic a, therefore I will show him more on topic a via an algorithm”, or shows algorithmic advertisements, or sells user data for advertisements etc, I don’t think it’s relevant to GDPR at the moment.
GDPR doesn’t include things you choose to make public, otherwise no social media could show your posts or username to anyone. My only doubt about Lemmy and Mastodon is about DMs where people have a reasonable expectation that they are private but they are not.
Edit: and thinking about it, even DMs probably fall into the same exception as email.
That is wrong. GDPR of course covers public information. It simply does not force platforms to hide this kind of information. But transmission of these informations without user’s consent and especially sale of these informations could possibly be prohibited by a court referencing GDPR.
But simply transmitting it for the purposes of making the protocol work, falls under legimitate purposes, like sending an email to email server in China
deleted by creator
Mastodon and Lemmy don’t actually share any data actually protected by GDPR, unless the users actively make it public (like using their real name).
Am I right in my understanding that if you run a federated Lemmy instance, you can see who has upvoted what, even on other instances?
Is that not something protected by GDPR?
No, things like your home address, your IP address, birth date, health conditions, religion, etc are PII.
Upvotes almost certainly falls into “legitimate purposes” since the data is required for moderation.
So, are you saying that Facebook holds basically no data covered by GDPR?
How’d you get that from that???
Well, ok, of that list they have my ip address, but nothing else.
They accept all of that information in one way or another.
Your instance has data covered by GDPR, but the data it sends to other instances is covered by the same exceptions as the data you send in a email. Without exceptions for legimitate interests it would be illegal to send an email from, say, mailbox to Gmail or Yandex Mail.
I guess that could be in regards to user profiling.
Since no fedi platform aggregates user data like “user xy always upvotes topic a, therefore I will show him more on topic a via an algorithm”, or shows algorithmic advertisements, or sells user data for advertisements etc, I don’t think it’s relevant to GDPR at the moment.
deleted by creator
GDPR doesn’t include things you choose to make public, otherwise no social media could show your posts or username to anyone. My only doubt about Lemmy and Mastodon is about DMs where people have a reasonable expectation that they are private but they are not.
Edit: and thinking about it, even DMs probably fall into the same exception as email.
That is wrong. GDPR of course covers public information. It simply does not force platforms to hide this kind of information. But transmission of these informations without user’s consent and especially sale of these informations could possibly be prohibited by a court referencing GDPR.
But simply transmitting it for the purposes of making the protocol work, falls under legimitate purposes, like sending an email to email server in China
Absolutely.
But if a fedi software/instance decided to do something else with this public data, it could get legally problematic. That is the point I’m making.