Comment

Summary The company has sent invitations to contacts uploaded by its users without their consent or any other legal basis.

Let’s see, in the EU and was a company that sold and processed data.

All you have done is provided that companies that hold pii in the EU have been fined before.

I’ll ask again, please provide a instance of a person who holds no pii operating a forum or instance that is free, sells no data and makes no profit off the instance being fined.

source

Sort:hotnew top

maynarkh@feddit.nl ⁨8⁩ ⁨months⁩ ago
I was going to write a long ass answer to this, but tbh I’m tired of you asking the same question over and over again while not providing any source for your claims.

Lemmy holds PII. Usernames and other online identifiers are PII according to GDPR Art 4/1 and legal practice as well. Photos people upload of themselves, people claiming to be Jews or from some country in comments are all PII. You have just said “oh but they are not” without backing up your claims. If nothing else, the fact that Reddit, the site which this is a clone of, holds PII should convince you if the relatively plain words of the law don’t.

Lemmy processes data. According to GDPR Art 4/1 data processing does not involve sales of data, just “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”. Again, you have not found anything to back up your claim that “it actually doesn’t and selling and processing is the same”.

GDPR applies to nonprofits, even non-commercial entities, private individuals, government institutions as evidenced by fines. You claim an exception for “forum owners for free instances” without even trying to back it up, and are asking me to prove a negative, again without providing any evidence of your own.

So the real question is, let’s say you’re an admin of some instance that grows to some noticeable size. Would you trust your gut feeling of “I hate EU regulations, and they shouldn’t apply to me either” before some random country you probably never heard of sends you a letter that you pay them some large amount of money? Or would you implement basic delete functionalities on your website and sleep easy?
source