Aren’t you also supposed to ensure that the third-party handling the PII is also GDPR compliant before the user consents to sharing it? Pretty sure my work training said so, but they could be erring on the safe side.
If not, that sounds like a giant loophole: you could just ask for consent, funnel all the data out of reach from the GDPR, and do all the analytics and profiling you want. Like, when Threads joins, what’s stopping them from swallowing all your user’s data? They can get it, they’re implicitly allowed to process it, and yet the data is now unencumbered from any further consent requests by the user. They don’t even have a way of knowing if the user is potentially from the EU.
Meta would of course be obligated to delete the data if the user goes to them and requests it to be deleted, but they might not even know Meta’s processing their data, and there’s a lot of privacy enthusiasts on Lemmy.
How can a user possibly consent to this properly, other than practically waiving their GDPR rights, which the law doesn’t allow?
Is there any new documentation around on that topic from actual lawyers analyzing the implications? It feels everything GDPR I see is opinions and personal interpretations of the law, which may be biased towards “it’s probably okay” as obviously we all want the fediverse to succeed.
In particular, ActivityPub pushes the data out for the most part, so one can’t argue “well I can’t stop people scraping my site illegally”, one could argue that instance admins should vet new instances before opening the data firehose.
It feels very much like depending on the case, and who got harmed how, a judge could decide the admins should have put technical safeties. I mean, we’re in the era of holding porn sites responsible for letting minors access the site and demanding they ID everyone to make sure. Lawmakers barely understand technology, let alone something like the Fediverse. I could see things go sour real fast.