4 ms·

That seems like it could possibly be a GDPR violation, couldn't it?

luckylion 4y ago
Because of the other person's messages becoming readable to a third party (the admin of the new server)? Interesting question. Would it be?
- polio 4y ago
  I mean it seems like the "Mastodon protocol" could just specify that admins should have no expectation of privacy when they communicate in their official capacity. I'd expect the protocol to eventually support account migrations to allow for the best user experience, resilient to the caprices of power-tripping moderators or just badly run servers.
  - luckylion 4y ago
    I don't know the system at all, but aren't the DMs between regular users (or at least also)? Like, you and me are on mastodon.example.org and I'm sending you a message. I can read it (in my sent messages), you can read it (in your inbox) and the admin of that server can read it. But we both agreed to that by signing up to that service. If I now move to mastodon.example.com and somehow migrate my messages, that server's admin would be able to read them, but you never consented to them having access to (part of) your private messages. It's similar to email, but we tend to put high requirements on running an email server (concerning data / privacy). I have no idea how that works out on Mastodon, whether it's closer to email or closer to Twitter DMs. E2E messages would probably be best, but then you make it harder for yourself to combat spam and harassment, I assume.
    - lapcat 4y ago
      > But we both agreed to that by signing up to that service. > If I now move to mastodon.example.com and somehow migrate my messages, that server's admin would be able to read them, but you never consented to them having access to (part of) your private messages. Why do you think there's consent in the first case but not the second case? You voluntarily choose your new instance just as much as you did your old instance.
      - luckylion 4y ago
        > Why do you think there's consent in the first case but not the second case? You voluntarily choose your new instance just as much as you did your old instance. I choose it, but you didn't, and if I migrate private messages exchanged between us, that would affect your personal information. Just migrating my public posts will not be an issue. I don't know if private messages would be. §20 states in 4 "The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others."
        lapcat 4y ago
        Well, to be clear, whenever you send or receive a DM, the admins of both instances can read them. Do people who send DMs even pay attention to who is the admin of the receiver's instance? Probably not. Anyway, the ability to import public posts would be a big improvement.
- EMIRELADERO 4y ago
  No, because of data portability rights. https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/
ruined 4y ago
you can download them, there's just no way to import them into your new account.
- EMIRELADERO 4y ago
  GDPR has data portability rights that include the right to ask the data controller to transmit your data to another, if "technically feasible".
  - jeremyjh 4y ago
    Exporting a json file is certainly transmitting the data.
    - EMIRELADERO 4y ago
      That's a separate right. Article 20, Section 1 states: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided[...] Separately, Article 2 states: In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
      - Messier43 4y ago
        Currently it's not technically feasible: https://github.com/mastodon/mastodon/issues/12423 https://github.com/mastodon/mastodon/issues/12423
      - Linosaurus 4y ago
        None of those say that the destination server is forced to import anything. This part specifically mentions the controller you originally gave data to, but says nothing about whom you now want to import it to: > without hindrance from the controller to which the personal data have been provided
sircastor 4y ago
Is Mastodon.lol engaged in commercial or professional services? It may not be applicable. This is an interesting intersection of services that aren’t necessarily a business. A lot of modern privacy laws are built around the idea that you’re making money from people, and stand to lose that income. I’m not sure that GDPR offers anything different.
- patapong 4y ago
  Here is the article defining the material scope of the GDPR: https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/ It does not seem to make any difference whether the service is engaged in commercial or professional services.
duckmysick 4y ago
Who should we report then? The instance owner or the protocol developers?

Because of the other person's messages becoming readable to a third party (the admin of the new server)? Interesting question. Would it be?

polio 4y ago
I mean it seems like the "Mastodon protocol" could just specify that admins should have no expectation of privacy when they communicate in their official capacity. I'd expect the protocol to eventually support account migrations to allow for the best user experience, resilient to the caprices of power-tripping moderators or just badly run servers.
- luckylion 4y ago
  I don't know the system at all, but aren't the DMs between regular users (or at least also)? Like, you and me are on mastodon.example.org and I'm sending you a message. I can read it (in my sent messages), you can read it (in your inbox) and the admin of that server can read it. But we both agreed to that by signing up to that service. If I now move to mastodon.example.com and somehow migrate my messages, that server's admin would be able to read them, but you never consented to them having access to (part of) your private messages. It's similar to email, but we tend to put high requirements on running an email server (concerning data / privacy). I have no idea how that works out on Mastodon, whether it's closer to email or closer to Twitter DMs. E2E messages would probably be best, but then you make it harder for yourself to combat spam and harassment, I assume.
  - lapcat 4y ago
    > But we both agreed to that by signing up to that service. > If I now move to mastodon.example.com and somehow migrate my messages, that server's admin would be able to read them, but you never consented to them having access to (part of) your private messages. Why do you think there's consent in the first case but not the second case? You voluntarily choose your new instance just as much as you did your old instance.
    - luckylion 4y ago
      > Why do you think there's consent in the first case but not the second case? You voluntarily choose your new instance just as much as you did your old instance. I choose it, but you didn't, and if I migrate private messages exchanged between us, that would affect your personal information. Just migrating my public posts will not be an issue. I don't know if private messages would be. §20 states in 4 "The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others."
      - lapcat 4y ago
        Well, to be clear, whenever you send or receive a DM, the admins of both instances can read them. Do people who send DMs even pay attention to who is the admin of the receiver's instance? Probably not. Anyway, the ability to import public posts would be a big improvement.
EMIRELADERO 4y ago
No, because of data portability rights. https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/

ruined 4y ago

you can download them, there's just no way to import them into your new account.

EMIRELADERO 4y ago
GDPR has data portability rights that include the right to ask the data controller to transmit your data to another, if "technically feasible".
- jeremyjh 4y ago
  Exporting a json file is certainly transmitting the data.
  - EMIRELADERO 4y ago
    That's a separate right. Article 20, Section 1 states: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided[...] Separately, Article 2 states: In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
    - Messier43 4y ago
      Currently it's not technically feasible: https://github.com/mastodon/mastodon/issues/12423 https://github.com/mastodon/mastodon/issues/12423
    - Linosaurus 4y ago
      None of those say that the destination server is forced to import anything. This part specifically mentions the controller you originally gave data to, but says nothing about whom you now want to import it to: > without hindrance from the controller to which the personal data have been provided

sircastor 4y ago

Is Mastodon.lol engaged in commercial or professional services? It may not be applicable. This is an interesting intersection of services that aren’t necessarily a business. A lot of modern privacy laws are built around the idea that you’re making money from people, and stand to lose that income. I’m not sure that GDPR offers anything different.

patapong 4y ago
Here is the article defining the material scope of the GDPR: https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/ It does not seem to make any difference whether the service is engaged in commercial or professional services.

duckmysick 4y ago

Who should we report then? The instance owner or the protocol developers?