Hacker News Reader

Comment by rainbowmverse | Hacker News Reader

You can do DMs, but it's possible for admins with sufficient access on each recipient's instance to read them.

edit: I didn't see that this was in the context of GDPR.

GDPR does not imply end-to-end encryption. Instance administrators on each and every service that isn't E2EE have the technical possibilities to read users' messages simply because they are not encrypted, and that behavior is GDPR-compliant.

Ok, that sounds like they don't comply with the GDPR then.

Also, doesn't ActivityPub allow closed groups?

Just as GDPR-incompliant as e-mail then, or any social media platform that's not e2e encrypted?

Yes, which is why you can't use email to send sensitive personal data anymore.

That doesn't mean your mail provider isn't GDPR compliant. And with the proper agreements and technical steps in place, a business sending personal data via e-mail could be totally fine to. (a big one would be requiring transport encryption, which is a sensible choice for ActivityPub too, and made by implementations, e.g. Mastodon)

It's specific to the use case and what guarantees you have, and not a strict property of a protocol.

What technical steps? My business used to send personal data to normal people via email (their own data). Now we can't do that anymore.

Why can't you do that? GDPR does not require end-to-end email encryption.

Yes you can.

What do you do instead? Ship it to them on CD?

They need to log in to access the information.

Sounds silly and inconvenient that you can't send their own info to their own email. Recommend you go back to what you did before. If you receive any GDPR letters, sort it out then.

Reply on news.ycombinator.com