undefined | Better HN

0 pointsanfogoat8y ago0 comments

In the specific case of XMPP, wouldn't I need to have an agreement with every other admin who federates their XMPP server and work out what exactly our roles are as defined by GDPR? XMPP still has active development community around it so this will no doubt get much easier with time, but that's just XMPP.

0 comments

4 comments · 3 top-level

bcheung8y ago· 1 in thread

Maybe not: You need to have a "Legal Basis" and only 1 of them is the "subject has given consent" one.

There's another:

"The processing is NECESSARY FOR THE PERFORMANCE OF A CONTRACT to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"

davorak8y ago

I thought you would have to al least all the admins to agree to follow the GDPR so that data can be retrieved, corrected, and deleted on demand right?

viraptor8y ago

IANAL, but unlikely. Sending messages is the primary purpose of the service. As long as users are made aware that messages going outside of your domain are shared with 3rd parties, it's on them to make that decision. Same would apply to email, phones, etc.

mandelbulb8y ago

Look at it this way: The service you're using needs a privacy policy, that is not new. The way that policy is organized or shared is no different now, just what rights the user and what obligations the service provider has.

j / k navigate · click thread line to collapse