▲ 157 ▼ Mastodon thinks Lemmy’s privacy stinks. What say you? (raddle.me) submitted 3 years ago by elbowmacaroni@beehaw.org to c/technology@beehaw.org 282 comments fedilink hide all child comments Federated services have always had privacy issues but I expected Lemmy would have the fewest, but it's visibly worse for privacy than even Reddit. Deleted comments remain on the server but hidden to non-admins, the username remains visible Deleted account usernames remain visible too Anything remains visible on federated servers! When you delete your account, media does not get deleted on any server
[–] CrateDane@feddit.dk 9 points 3 years ago (1 child) That is generally true, with exceptions like leaking someone else's private information. But it implicates the adjacent "right to be forgotten" rather than narrowly defined "privacy". This could be a real legal issue in the EU. permalink fedilink source parent hideshow 2 child comments replies: [–] hoshikarakitaridia@lemmy.fmhy.ml 11 points 3 years ago (2 children) It is. GDPR in the EU dictates that every user which requests their information has to get it in 30 days, and every user who removes their information has to be able to get it removed (I think the time span for that is even shorter, so more pressure for the server admins) permalink fedilink source parent hideshow 4 child comments replies: [–] retronautickz@beehaw.org 4 points 3 years ago The problem here is that your data is not only recopilated by your server and accessible to your server admins, the servers of the communities/magazines or people you interact with also recopilate any activity you have in relation to any community/magazine or user hosted in their server. So, while the admin of your server has the obligation of deleting your data if you ask for it, the other servers admins don't necessarily have that obligation. Also, I'm reading the GDPR and the "right to be forgotten" that many are quoting seems to refer to personal information only. permalink fedilink source parent [–] Umbrias@beehaw.org 3 points 3 years ago It almost definitely isn't and that's clear looking into GDPR at all. The right to be forgotten is not all powerful, and the lemmy instance your data originates on has an obligation to delete your data, that is true. However other servers may or may not have any of that obligation for a variety of reasons. Now if you go to those other servers and make the request to have your information deleted, they may have an obligation to depending on whether that data is seen as currently usable. The right to be forgotten is far weaker than you think it is, especially on public forums, under GDPR. permalink fedilink source parent
[–] hoshikarakitaridia@lemmy.fmhy.ml 11 points 3 years ago (2 children) It is. GDPR in the EU dictates that every user which requests their information has to get it in 30 days, and every user who removes their information has to be able to get it removed (I think the time span for that is even shorter, so more pressure for the server admins) permalink fedilink source parent hideshow 4 child comments replies: [–] retronautickz@beehaw.org 4 points 3 years ago The problem here is that your data is not only recopilated by your server and accessible to your server admins, the servers of the communities/magazines or people you interact with also recopilate any activity you have in relation to any community/magazine or user hosted in their server. So, while the admin of your server has the obligation of deleting your data if you ask for it, the other servers admins don't necessarily have that obligation. Also, I'm reading the GDPR and the "right to be forgotten" that many are quoting seems to refer to personal information only. permalink fedilink source parent [–] Umbrias@beehaw.org 3 points 3 years ago It almost definitely isn't and that's clear looking into GDPR at all. The right to be forgotten is not all powerful, and the lemmy instance your data originates on has an obligation to delete your data, that is true. However other servers may or may not have any of that obligation for a variety of reasons. Now if you go to those other servers and make the request to have your information deleted, they may have an obligation to depending on whether that data is seen as currently usable. The right to be forgotten is far weaker than you think it is, especially on public forums, under GDPR. permalink fedilink source parent
[–] retronautickz@beehaw.org 4 points 3 years ago The problem here is that your data is not only recopilated by your server and accessible to your server admins, the servers of the communities/magazines or people you interact with also recopilate any activity you have in relation to any community/magazine or user hosted in their server. So, while the admin of your server has the obligation of deleting your data if you ask for it, the other servers admins don't necessarily have that obligation. Also, I'm reading the GDPR and the "right to be forgotten" that many are quoting seems to refer to personal information only. permalink fedilink source parent
[–] Umbrias@beehaw.org 3 points 3 years ago It almost definitely isn't and that's clear looking into GDPR at all. The right to be forgotten is not all powerful, and the lemmy instance your data originates on has an obligation to delete your data, that is true. However other servers may or may not have any of that obligation for a variety of reasons. Now if you go to those other servers and make the request to have your information deleted, they may have an obligation to depending on whether that data is seen as currently usable. The right to be forgotten is far weaker than you think it is, especially on public forums, under GDPR. permalink fedilink source parent