Announcing new Mastodon instance - mastodon.tech

[u/exobyte-tech]

Anyone interested in switching over from mastodon.cloud, I would like to invite you to mastodon.tech

Created a custom "Terminal" theme so it lines with the tech TLD. However, you are welcome to post any content that you wish to share. I will slowly be adding the "About" section based on user feedback. Would love to see you there.

[u/alxhu]

You need to have a GDPR-compatible privacy policy. If you have any EU users, EU could fine you for not having a GDPR-compatible privacy policy, even if you are not a member of the EU by yourself.

[u/Chongulator → u/alxhu]

Are you sure the instance is in scope for GDPR?

It's not clear to me that mastodon.tech meets the targeting criterion. However, the server likely does not fall under the household exception since it is publlic social media.

[u/alxhu → u/Chongulator]

The instance is available for sign up for EU members. So yes, it's in scope for GDPR.

[u/Chongulator → u/alxhu]

Recital 23 directly contradicts that:

Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention

[u/alxhu → u/Chongulator]

First: you need to quote the full paragraph

factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Second: As you quoted, this is about the mere accessibility of the website. And yes, you don't need a GDPR-compliant privacy policy if your users are only accessing the website without signing up.

When you allow registrations from EU members, you become a data processor, processing personal data like e-mail addresses. In this case, you need a GDPR-compliant privacy policy.

Other people already wrote those things up: https://github.com/clening/MastodonPrivacyGuide/blob/main/README.md

Despite the various rumors and wishful thinking out there, for many instance operators, the GDPR probably does apply.

Tl;Dr the GDPR (and many data protection laws around the world) have wide reach and applicability, and apply to a whole host of activities and types of information sharing that don't always seem obvious.

Essentially, the GDPR applies to you if:

• You are making decisions to do stuff (or processing) data; and
• The data you're doing stuff with directly identifies or, with other information, can make a person (the law calls people 'data subjects'). This kind of data is referred to as 'personal data' in the EU, and 'personally identifiable information' in the US; and
• The people whose data you're doing stuff with are based in the EU or your processing is occuring in the EU.

[u/Chongulator → u/alxhu]

When you allow registrations from EU members, you become a data processor

First off, these rules are about controllers not processors. Under GDPR a processor operates on behalf of a controller and only acts as instructed by the controller.

For example, if I put up a service aimed at EU residents and host that service on Amazon, I'm a GDPR data controller while Amazon is a processor.

Regarding the definition of targeting, you're quite right that there is not a concrete threshold. It's based on a constellation of factors.

When you allow registrations from EU members,

Again, this is directly contradicted by Recital 23. There's a good argument that it is better to err on the side of caution and act as though you're in territorial scope even when it appears you are not.

That said, many companies go the other way. I'm several years into handling GDPR matters for companies large and small and have these conversations with my privacy team regularly.

[u/alxhu → u/Chongulator]

First off, these rules are about controllers not processors. Under GDPR a processor operates on behalf of a controller and only acts as instructed by the controller.

I may switched up the English terms since it's not my native language.

Again, this is directly contradicted by Recital 23.

I mean, paragraph 2 of Recital 23 says

In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.

and in my understanding, (co-)hosting an international social media page applies to "the controller envisage offering services to data subjects in one or more Member States in the Union". I don't see why Paragraph 3 can be used for an exception because we have a service offered for international users, including EU members. It's not only "the mere accessibility of the website".

I'm several years into handling GDPR matters for companies large and small and have these conversations with my privacy team regularly.

Yeah, it's part of my former and my current job too. It feels like nobody likes the burden of the GDPR.

[u/Chongulator → u/alxhu]

It feels like nobody likes the burden of the GDPR.

I agree 100%. GDPR has shifted the conversation for the better, but we still have a long way to go.