EDIT: In case anyone don't understand what this is it is an issue raised by someone on lemmy git that when an account is deleted or banned it should also delete the data the data posted by the user. And one of the main dev nutomic is blowing it of like it won't affect me and maltfield is remainding him that it is illegal under the EU law and it also affects lemmy and moreover it is not ethical or moral . And i thought that was what lemmy was built on privacy, ethics and morals now i am dissapointed.

EDIT : For everyone saying there is no way i am not really ap roggrammer or anything but couldn't this work :

They could just roll it out on a new version and i think most instances won't mod it to remove that maybe some oddball ones will but not most. I know saved copies will be there but who cares no one is saving my 1000 comments but that is not the case with this .

It is copy pasted from one of my replies.

EDIT: Also it is not my intention to point finger to lemmy devs and i can differentiate their political stance and their work my only intention was to see that if this post gained enough traction they will reply or fix the issue.

EDIT : Relevant comment from @NeatNit@discuss.tchncs.de about what if other instance don't delete your data.

So maybe those instances are breaking the law, but Lemmy by default should comply. You could say the exact same thing about any social media - scrapers can and do archive everything they can - but that doesn’t absolve the original platforms (e.g. Twitter) from having to follow the law.

EDIT : As just a person i can't do anything about it but i am certain if everybody pitch in the lemmy devs will listen and even though everyone seems to hate lemmy devs political stance i can differentiate with politics and their work and i find @Dessalines@lemmy.ml to be very responsive so i am gonna mention him and see what he thinks about it instead of trashing lemmy devs on speculation (i don't know nutomic's id) even though i don't agree wuth nutomic's response in this case i don't share the views of many people in the comments and don't associate this post with them.

EDIT : I just want an option to purge my data when deleting an account that you can enable or disable.

EDIT:Ok i just woke up and am catching up with some of these replies and i wanna say i don't share any of their views nor am i affliated with them i never wanted to trash on the dev and that is one of the main reason i posted this on casual conversation i didn't think this would get this uncasual . All i wanted to so was draw attention to this problem so devs will act on it faster but since then i have learned lemmy politics does'nt work like that and as i am not the mod or anyththing i can't do anything about some of the comments except make it clear i have no affliations with them. Just keep it casual people. I too want these changes but maybe geemtting on the nerve if devs isn't the best way to achieve it.

Something @tyler@programming.dev chimed in .Your comments can be public, but your data is yours. That’s the whole point of GDPR. Think of an art gallery. The gallery does not own the art a lot of the time, they simply show it. The art is owned by the artist. If they want to take it down they can. The same thing applies here. Your data, you get to choose what happens to it in the eyes of the law.

EDIT:

I accidently left this part out so uploading it.

top 50 comments

sorted by: hot top controversial new old

[–] dessalines@lemmy.ml 128 points 9 months ago (13 children)

I've been tagged here, so to answer some of the questions I saw below:

We already have a way to permanently delete / overwrite your comments when you delete your account. That's been done for a long time., and is easily visible in lemmy-UI when you go to delete your account.

We do federate that removal, but there's nothing that stops a malicious server from ignoring that request. Activitypub is ultimately like email; there is no unsend email button.

That ticket is more about image removals, which gets tricky. We recently added a table that makes sure to attach image uploads to the local user, and now what's needed is to build out an interface for handling those also, in addition to handling the removals properly. Issue for that is here.

Data privacy will always be an ongoing issue, and we have to handle new problems as they arise. That's nothing new for us.

The main issue in that ticket is that there are 2-4 of us devs working on software that is now used by over 40k ppl daily, and we're spread extremely thin. So my personal patience for people making demands, while refusing to do anything to help out themselves, is very thin. We are not a multi-million dollar corporation with hundreds of developers. If someone wants a feature that we don't have time to work on atm, they can help out by adding it.

I think maltfield is well-intentioned, but they've also shown no interest in helping out with any of these GDPR-related requests. We have no legal expertise about the GDPR, and lemmy is not european software, it's international software.

load more comments (13 replies)

[–] originalucifer@moist.catsweat.com 74 points 9 months ago* (last edited 9 months ago) (20 children)

dunno. if i was all that concerned about that kinda stuff i wouldnt be using a publicly, anonymously federating communication platform like lemmy

clearly people need to stay within legal requirements, and a user wanting to delete their account should be able to do so... but youre not recalling your remotely-transmitted posts anymore than you can recall the words you shout on a street corner.

e. ahh i see, this is about a bug they dont want to fix on lemmy because they dont feel they are gdpr targets

so, its definitely a bug. its definitely already on their bug list, but they arent acting on it for 'reasons'. and now that you pointed it out, they will definitely never act on it.

[–] Turun@feddit.de 28 points 9 months ago (3 children)

but youre not recalling your remotely-transmitted posts anymore than you can recall the words you shout on a street corner.

That is true, but the user must still have the ability to delete all their comments. The fact that someone could have scraped the data is irrelevant.

load more comments (3 replies)

[–] THE_MASTERMIND@lemmy.today 12 points 9 months ago (2 children)

But him blowing it off like that was spezy we should be better than reddit and let users delete their data if they want to .

[–] rdyoung@lemmy.world 27 points 9 months ago* (last edited 9 months ago) (6 children)

That would be ideal but reality is that because of the way the fediverse works there is no way to control what we post to instances that aren't our home one and we definitely can't undo the thousands of copies of those comments/posts that get copied across the fediverse.

This is a concept that was understood in the early days of the internet and seemed to have gotten forgotten over the years. The basic concept of not being able to unring a bell.

Basically even if a local instance lets us delete our account and all comments/posts, it would be up to every other federated instance to honor that delete transmission, we have no way to enforce that.

[–] pixxelkick@lemmy.world 4 points 9 months ago (4 children)

there is no way to control what we post to instances that aren’t our home one

This doesn't give the home instance a get out of jail free card for also failing to comply.

This is pure whataboutism.

load more comments (4 replies)

load more comments (5 replies)

[–] Sgagvefey@lemmynsfw.com 6 points 9 months ago (1 children)

It's not possible.

By design, everything you posted is shared to hundreds of other servers, all of which are capable of doing anything they want with it. I can guarantee you that there are several that are archiving anything and everything that gets federated to them and will not remove that content when the original server does.

[–] NeatNit@discuss.tchncs.de 13 points 9 months ago (3 children)

I can guarantee you that there are several that are archiving anything and everything that gets federated to them and will not remove that content when the original server does.

So maybe those instances are breaking the law, but Lemmy by default should comply. You could say the exact same thing about any social media - scrapers can and do archive everything they can - but that doesn't absolve the original platforms (e.g. Twitter) from having to follow the law.

load more comments (3 replies)

[–] surewhynotlem@lemmy.world 5 points 9 months ago

Sounds like we need a lawsuit to decide who is correct.

Anyone in the EU feeling feisty?

load more comments (17 replies)

[–] p3n@lemmy.world 65 points 9 months ago (1 children)

It has been my experience working with FOSS that if you really want a bug fixed, or a feature implemented, it is best to take the following steps:

Fork the repository
Implement the feature or bug fix in your fork
Open an issue (if one does not exist already) in the upstream repository describing the feature or bug
Submit a pull request with your implemented changes as a solution to the issue

I have had a 100% success rate with these steps.

[–] tyler@programming.dev 19 points 9 months ago (1 children)

Oh boy, you’re luckier than I. I’ve contributed to hundreds of oss software for over a decade and I’d say maybe 50% of PRs get merged, sometimes taking years. 50 is probably generous.

load more comments (1 replies)

[–] teft@lemmy.world 33 points 9 months ago (3 children)

And i thought that was what lemmy was built on privacy, ethics and morals now i am dissapointed.

I don't think lemmy was built on that. The original software was written by tankies so i doubt they cared about privacy, ethics, or morals. It was built as an open source decentralized alternative to other news aggregation sites.

Everything you post to it proliferates out to every server you federate with so even when they implement this it would be trivial for someone to setup a catch all server that doesn't obey the delete command sent from another server and store everything everyone has posted. That might be why they haven't prioritized it. Just a guess from me though.

[–] agent_flounder@lemmy.world 13 points 9 months ago

The original software was written by tankies so i doubt they cared about privacy, ethics, or morals.

Oof lol

[–] NeatNit@discuss.tchncs.de 13 points 9 months ago (2 children)

Everything you post to it proliferates out to every server you federate with so even when they implement this it would be trivial for someone to setup a catch all server that doesn’t obey the delete command sent from another server and store everything everyone has posted.

(repeating from my reply elsewhere)

So maybe those instances are breaking the law, but Lemmy by default should comply. You could say the exact same thing about any social media - scrapers can and do archive everything they can - but that doesn’t absolve the original platforms (e.g. Twitter) from having to follow the law.

load more comments (2 replies)

load more comments (1 replies)

[–] pixxelkick@lemmy.world 31 points 9 months ago

ITT: people too focused on Data Privacy with respect to other posters/internet denizens.

In reality the much bigger concern typically is the literal owner of the servers

If 1 server owner announces they are now selling off all their copies of raw lemmy data to an AI company to train on, legally by EU data privacy laws users very much would have a leg to stand on to demand their data be deleted and if the server owner doesn't comply, they could be in very hot water.

This doesn't have to be a federated problem.

You can request Server A delete your records while being cool with Server B keeping them, because Server A is selling your data and B isn't.

This delete/request action doesn't have to propagate, it can be "per server"

[–] LemmyIsFantastic@lemmy.world 28 points 9 months ago (2 children)

The idea that your data is private here is a lol.

[–] eskimofry@lemmy.world 9 points 9 months ago (2 children)

I don't agree. That's a reductionist argument devoid of nuance and ignores challenges of operating decentralized social media to the scale of Lemmy or Mastadon.

load more comments (2 replies)

[–] treadful@lemmy.zip 7 points 9 months ago (3 children)

Curious who's downvoting you here. Why would anyone think anything here is private on an open federated protocol? Only contentious things IMO might be DMs.

[–] tyler@programming.dev 28 points 9 months ago (3 children)

Your comments can be public, but your data is yours. That’s the whole point of GDPR. Think of an art gallery. The gallery does not own the art a lot of the time, they simply show it. The art is owned by the artist. If they want to take it down they can. The same thing applies here. Your data, you get to choose what happens to it in the eyes of the law.

load more comments (3 replies)

[–] Blaze@reddthat.com 5 points 9 months ago (3 children)

Even DMs aren't private, it's mentioned explicitly in the Lemmy documentation, admins can read them

load more comments (3 replies)

load more comments (1 replies)

[–] abbadon420@lemm.ee 23 points 9 months ago (1 children)

The secret trick is, abbadon420 isn't my real name.

[–] THE_MASTERMIND@lemmy.today 13 points 9 months ago (1 children)

Shit i should'nt have used my real one.

[–] BloodSlut@lemmy.world 11 points 9 months ago

real name does not check out

[–] Micromot@feddit.de 9 points 9 months ago (1 children)

IIRC GDPR Right to be forgotten only affects personal data

[–] pdnq@feddit.de 18 points 9 months ago (3 children)

Yes, it does not cover anonymized data or data that does not relate to an identifiable individual. But, if your Lemmy account is associated with a real email address, your comments and account details can be considered personal data under GDPR. The GDPR defines personal data as any information related to an identifiable person who can be directly or indirectly identified, particularly by reference to an identifier such as an email address. Even if you use a pseudonym (fake name), the fact that the account can be linked back to your real identity through the email address makes the associated data (like your comments) subject to GDPR provisions.

load more comments (3 replies)

[–] freamon@endlesstalk.org 8 points 9 months ago (1 children)

This issue is about the fact that if you delete your account, lemmy will delete all the text in any posts and comments you've made. It won't go through those comments, read any URLs you've uploaded pictures too, and delete them if they've been hosted/cached locally.

Putting the lemmy devs response to one side for a moment: what's the concern here? The URLs for images in picts-rs are a random hex string - if you don't know the URL, you can't find it, and even if you do, you wouldn't be able to connect it to someone unless the info was literally in the image itself.

[–] pixxelkick@lemmy.world 10 points 9 months ago

if you don’t know the URL, you can’t find it

The owner of the server sure can.

[–] Fudoshin 6 points 9 months ago* (last edited 9 months ago) (1 children)

Cross-posted to privacy@lemmy.ml

load more comments (1 replies)

[–] TheTetrapod@lemmy.world 5 points 9 months ago (1 children)

I think it should be an option to delete post and comment history upon account deletion, but by no means the rule. I hate finding swiss cheese threads on social media. Part of commenting on a platform like this is contributing your voice to the value of an overall discussion, and revoking that contribution is frequently more obnoxious for your fellow users than it is beneficial to you.

[–] pixxelkick@lemmy.world 16 points 9 months ago* (last edited 9 months ago) (3 children)

I hate finding swiss cheese threads on social media

See the thing us, EU data privacy and protection laws don't really give a shit though

You feeling unhappy that chunks of a thread are missing due to someone requesting a data privacy wipe isn't, you know, a factor that matters

I'm sure you really wanted to know what so-and-so said, but the lack of their posts existing means they didnt want you to know what they said

And, you know... they have the right to do that.

[–] THE_MASTERMIND@lemmy.today 4 points 9 months ago

I agree with you not everyone lives to serve OP

load more comments (2 replies)

load more comments