• viking@infosec.pub
    link
    fedilink
    English
    arrow-up
    45
    arrow-down
    1
    ·
    8 months ago

    Lemmy is not a singular software or website, every instance on its own need to ensure compliance with their respective laws where they are domiciled.

    But if instance A is domiciled in the EU, and the content mirrored to instance B in Zimbabwe, where no right to be forgotten exists, then a user of instance A can’t invoke any laws beyond what the local admin can control.

    That’s amazing for high availability of content - it’s essentially mirrored in perpetuity - but a nightmare for privacy advocates. AFAIK there haven’t been any court cases related to deletion requests, so that’s still virgin territory.

    • 𝙲𝚑𝚊𝚒𝚛𝚖𝚊𝚗 𝙼𝚎𝚘𝚠@programming.dev
      link
      fedilink
      English
      arrow-up
      14
      arrow-down
      3
      ·
      8 months ago

      Instances located in Zimbabwe still have to comply with the GDPR, as the law applies to any entity that processes EU citizen’s personal data, regardless of where this happens. Instance B would also have to comply with a deletion request, or whatever EU member state the citizen is from will impose a fine and seize assets if necessary.

      • Zagorath@aussie.zone
        link
        fedilink
        English
        arrow-up
        13
        arrow-down
        4
        ·
        8 months ago

        This is the stupidest claim GDPR makes. It’s completely unenforceable and it’s attempting to enforce EU law in countries outside of the EU, which goes completely against any norms in international relations.

        • 𝙲𝚑𝚊𝚒𝚛𝚖𝚊𝚗 𝙼𝚎𝚘𝚠@programming.dev
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          3
          ·
          8 months ago

          It absolutely is enforceable, and the EU has already enforced it several times.

          The EU can of course try to seize assets, but in many cases they have signed a treaty with other countries stating they have the right to enforce the GDPR within their borders. Think a bit in the sense of an extradition treaty. For the US, this is the EU-US Data Privacy Framework for example.

          This means the EU absolutely can, will and has the means to enforce the GDPR abroad.

        • BigDiction@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          4
          ·
          8 months ago

          I don’t see how it could be enforced without this. If you are operating internationally, comply or block your service from regions you cannot legally operate in.

          Personally I don’t think Lemmy should comply. It’s an ad free community service with zero PII obligation besides an email and whatever IP you choose to connect from. No one has to be on Lemmy for any common social obligations.

          If you want to be forgotten then leave!

          • Zagorath@aussie.zone
            link
            fedilink
            English
            arrow-up
            6
            ·
            8 months ago

            If you are operating internationally, comply or block your service from regions you cannot legally operate in.

            Couple of problems with this. First, it’s putting the onus on a company that does not operate in Europe to figure out what European law is and to try to comply with it. Why should they have to do that? If you’re not operating in an area, you should not have to ever give any consideration whatsoever to the laws of that area.

            The second is that, unless I’m misinformed, the EU claims its law applies to any EU citizen, regardless of location. Which means if a Dutch person moves to Australia and uses Australian companies’ services, the EU says “hey, Australian company, you gotta do what this Dutch person says with their data”. Which is utterly ridiculous.