⚠️ GDPR + Mastodon
Love this multi-layered thinking. For every scenario there are always many more on top of that yet to be uncovered.
Just this example would help a lot of people understand the complexity of it all, and the importance of putting time and thought into doing the right thing and staying ahead of potentially damaging actions.
@Tattooed_mummy
Oooh. Thank you for taking the time replying to all those toots. 😊
⚠️ GDPR + Mastodon
Made a clarification here. What's written in the note can of course be very personal, but I am reminded personal notes are exempt from GDPR (unless the notes are made in a professional capacity, which means I still have questions around instances run by organisations)
I also have concerns about the vulnerability of storing data in this way, but that's a separate discussion. 😅
https://social.xbm.se/@axbom/109352443364669318
⚠️ GDPR + Mastodon
With regards to whether or not it applies to hobbyists, this is a great thread:
⚠️ re: GDPR + Mastodon
Made a clarification here. You're right that personal notes are exempt from GDPR (unless the notes are made in a professional capacity, which means I still have questions around instances run by organisations)
I also have concerns about the vulnerability of storing data in this way, but that's a separate discussion. 😅
⚠️ GDPR + Mastodon
It's part of personal note so is stored on the instance of the person writing it, who in theory is the only person who should see it.
I made a clarification here. Personal notes are exempt from GDPR (unless they are made in a professional capacity, which I guess could be a potential scenario as the number of instances grow).
⚠️ GDPR + Mastodon
Yes, you're right. I made a clarification here. In most cases it would appear these notes are indeed exempt from GDPR, unless the instance is run in a professional capacity and writing those notes is done as part of company/organisation operations.
@missiggeek Sorry to have caused a lot of "mention spam" for you today.
In the end I feel there are still some critical issues with the notes feature of Mastodon I want to figure out and understand, even if GDPR doesn't apply in all these cases. 😊
Exactly. Which makes the conversation interesting and perhaps there are grey lines? A sports club, a media organisation... is it always clear when it's private or performed in a capacity as representing an organisation? Does it have to apply to a whole instance or to the specific use-case?
I guess it's similar to company email...
Good points. I feel like very little data nowadays is unstructured because the tools for sifting through it are so efficient at identifying it.
Another thought: let's say a public company sets up an instance and employees have accounts there. The employees write notes about customers who have Mastodon accounts, as part of their workplace tasks...
Is it still a private note?
⚠️ GDPR + Mastodon
A clarification on my worry about #GDPR and notes on profiles where people can write stuff like religion, address, kids' names, etc.
As @abbe98 let me know, #GDPR won't apply to personal notes, in the same way as it won't apply to private messages.
Meaning if I request my personal data from e.g. mastodon.social, notes wouldn't be included. Still an ethical conundrum to me.
Recommend @missiggeek thread on when GDPR may apply:
https://freeradical.zone/@missiggeek/109348559768938197
(deleted my original post)
@phf Oh no I enjoy the conversation. And you're likely right @abbe98 pointed out to me that there is an exemption for personal notes.
My worry is that personal data that can be very damning (political views, religion, etc) is stored digitally in notes in places where there is a responsible entity (the admin owner) but the security measures are largely unknown. How many have access?
So targeted attacks to retrieve profile info can potentially uncover a lot of personal data on large instances.
My thinking was not that I would need to know what information is stored about me. The reason i request information is to learn what information is stored in that entity's databases about me.
My first thought was that admin's would have to include any personal notes (not author's of those notes) as they could hold all that info in their database.
But as @abbe98 taught me, I would never learn (at least in that scenario and according to GDPR) that info about me is stored.
From my perspective, if I request from a server admin all the data that is stored about me on their platform, I would expect it to be revealed if someone is writing down my religion, home address, etceteras in a database they own.
Who wrote the note would likely not be revealed.
If I'm not allowed to know this, it's an interesting dilemma...
⚠️ GDPR + Mastodon
Yes, upon a request it would not be revealed who wrote it.
But if I do request, I would consider it of interest to know if someone has written down my home address, religion, children's names and more...
⚠️ GDPR + Mastodon
Even if it contains home address, religion, children's names and the like?
⚠️ GDPR + Mastodon
Hmm, so if someone writes down my address, religion, names of children, etceteras and store this on Mastodon as part of my profile information on their instance , that information would not have to be revealed to me upon a request for information from that instance admin?
⚠️ GDPR + Mastodon
Absolutely. Agreed. Who the note-writer is would not be revealed.
⚠️ GDPR + Mastodon
Made a clarification here. Personal notes are exempt from GDPR (unless the notes are made in a professional capacity, which means I still have questions around instances run by organisations)
⚠️ GDPR + Mastodon
In my head it's personal data stored about a person. Meaning they should be able to request it. So if I for example request from mastodon.social a copy of the personal information stored about me, that should include notes people have written about me. But not who has written them.
Hoping @missiggeek will clarify if I got this wrong. 😅
⚠️ GDPR + Mastodon
Made a clarification here. I am reminded that personal notes are exempt from GDPR.
(I still have concerns about the whole vulnerability of data stored in this way, but it would appear GDPR does not generally apply in these cases)
**remove**
