@the IDK the answer either but boosted the post in case someone seeing it can reply.

[crissy@tech.lgbt]

@the IDK the answer either but boosted the post in case someone seeing it can reply. Curious to also know the response, thanks
cc: @Em0nM4stodon

[yawnbox@disobey.net]

@Crissy @the @Em0nM4stodon

It’s my opinion that every Mastodon server is a joint controller of personal data under GDPR.

Single-user instances receiving personal data from people you interact with, and includes even special category data if people are discussing their religion or sexuality, that’s all data you temporarily store and process for your use.

Activitypub nor Mastodon discloses to data subjects who all has recieved their data, so it would be very challenging for a data subject to identify and communicate with all Mastodon instances.

Regardless, under GDPR, as a joint controller, you must be responsive to the rights of data subjects.

It’s also in my opinion that, however, Activitypub is a synchronous technology— meaning, when a data subject deletes a post, that deletion should sync (tombstone?) to federated servers who implement the same protocol spec.

But this is a tech that hasn’t been tested in court as far as I know. Just because it’s legally untested, and just because it would be difficult for a data subject to find small instances and make demands based on EU fundamental rights, wouldn’t make joint controllers not responsible to be responsive to data subjects.

There’s no way for a data subject to know if your server is a small or large instance receiving and processing their personal data, or if you do any potentially unlawful processing (not required for the fulfillment of the Activitypub protocol— data subjects have a lawful right to ask and the onus is on the data controller) so again, it’s important to be responsive to requests.

[evan@cosocial.ca]

@yawnbox @Crissy @the @Em0nM4stodon I think the idea is that remote servers are secondary processors, and your own server has a responsibility to notify them when you delete your data, but no more. That said, I think we should have some kind of ack for deletion that says that the server actually deleted it.