Having a bug tracker in that walled garden is the biggest problem. It demonstrates what I’m talking about: digital rights being disregarded.

Git itself is not proprietary so all the projects can survive without GitHub if the need arises. Ad

You’re neglecting the exclusion that’s inherent in Github when the need to bounce does NOT arise.

Also worth adding that during the war in Gaza some of us boycott Israel. Which implies boycotting Microsoft.

Additionally, you don’t need an account to view the repository or its discussions.

Advocating read-only access is comparable to endorsing only freedom 1 and 2, not freedom 0 or 4. Which is precisely what I’m talking about: FOSS projects that discard digital rights and partake in digital exclusion for some convenience frills.

There is of course a walled garden for participation and it is an issue, however it doesn’t compare to discord, which is much, much worse.

Bug trackers have more of a monopoly on bug reports than discord has on discussions. There are countless decentralized discussions about free software all over the place – threadiverse, probably facebook, ad hoc phpbb forums, IRC, usenet, mastodon, mailing lists, conferences like FOSDEM … and rightfully so. Discussions don’t need the centralization that bug trackers do. General discussions also do not have the degree of importance to QA that bug tracking does.

Case in point, when bugs are reported outside of Github, they don’t get noticed by developers and triaged.

There’s not really much point in using a self hosted gitea or codeberg or sourcehut if you want the barrier of entry to be as low as possible for potential contributors.

Of course there is.

But GitHub has more features (like discussions), provides better hosting and ease of use.

Bingo. Prioritizing convenience features above digital rights principles is exactly why Github’s walled garden dominates over forges that have a lower barrier of entry.

The focus of any open source project should be on development of the software, not the software which supports its development.

Again, people to setting aside their principles is exactly what I’m talking about.

I give a shit.

There are not enough of you. Evidenced by ~95%+ of noteworthy FOSS projects being jailed in Github’s walled garden.

from the article:

In short, using Discord for your free software/open source (FOSS) software project is a very bad idea. Free software matters — that’s why you’re writing it, after all. Using Discord partitions your community on either side of a walled garden, with one side that’s willing to use the proprietary Discord client, and one side that isn’t. It sets up users who are passionate about free software — i.e. your most passionate contributors or potential contributors — as second-class citizens.

Interesting to do a “s/Discord/Github/” replace on the above. Same situation yet hardly anyone gives a shit.

So yes, Drew DeVault is right. But he overestimates people’s commitment to free world digital rights principles and consistency thereof.

You might want to crosspost your story to [email protected]. But if you do that be clever with your phrasing so as to not seem to be asking for advice, but rather for information. E.g. is there any case law for this situation…

(I’m assuming you’re in the UK because other commenters focused on UK law)

There really needs to be a resource where data subjects can pool their evidence and collaborate on GDPR actions against common data controllers.

Thanks!

The To: address in the header would be interesting. Of course, you wouldn’t want to disclose it verbatim here but it might be useful to have a rough idea. Was it [email protected] or some variation of that, or was it more like [email protected]? Some people here think it doesn’t matter, that it’s inherently personal info, but the European Commission says it matters. It’s not hard and fast; there are varying shades of gray here. Maybe they kept logs of your IP address and maybe that makes a difference. You might want to read WP136 (I have yet to read that).

I would love to see action taken against Reddit, if anything just to burden their lawyers and create some costs for them. But I doubt it will go anywhere. GDPR enforcement is such a shit-show in Europe. Even dealing with clearly blatant violations that are wholly internal to Europe which should irrefutably incur penalties, simple obvious cases are being ignored by DPAs. So I have little confidence that this cross-border case against a non-EU data controller would actually get results when the law is not really concrete. The one factor in your favor is that Reddit is somewhat high-profile which might take a DPA’s interest.

I don’t think a “delete my account” button constitutes an Article 17 request. It removes the purpose of processing to some extent, which then relies on the data minimization principle (Art.5). Reddit can do a bit of hand-waving to make excuses like needing to retain your email address in case one of your posts sparks a legal inquiry. Your case would be stronger if you had submitted an explicit Art.17 request to Reddit.

From the email:

Per our lawyercats, we are not able to respond to further inquiries or questions.

I wonder if that statement might be actionable. Art.12 and 13 require Reddit to identify a data controller with a point of contact and to tell you your GDPR rights (IIUC). And here they are outright stating in effect “we don’t want to hear from you”. I would stress that in your GDPR complaint, not just the misuse of your email which you expected to be deleted. But note they do provide an address at the bottom of that msg. Although that angle of attack might require Reddit having a way to know you have ties to a GDPR region after the supposedly “deleted” your acct.

Also, I would look into any anti-spam laws your country has. There may be a higher degree of legal actionability there.

I’m trying to get to the bottom of this because a chunk of my data & activity is tied to nothing but my email address which always deliberately excludes personal identifiers and I do everything over Tor.

GDPR recital 26 seems the most relevant. It’s complicated but note that the GDPR clearly does not apply to legal persons (aka moral persons aka companies). So a data controller must at a minimum have a way of knowing the account belongs to a natural person. Which IMO requires being linked to other data like IP address. Though even that is a fuzzy because IP databases on whether an IP address is residential boils down to guesswork.

Tempting to read wp136 which predates the GDPR but seems quite relevant. It’s possibly the most exact answer unless there is a closely related CJEU ruling.

Right, so e-mail address together with IP address would then make the e-mail that of an identifiable user under Art.4(1). So the OP needs to find out if an IP address was logged and retained in connection with the email address.

See https://infosec.pub/comment/6975469

That phrase (“user identifying information”) does not appear in the GDPR text that I have. Do you have a page or section reference?

According to the Commission, “an email address such as [email protected];” is an example of “personal data” [presumably from Art.4(1)]. But it’s interesting to note that that example obviously ties the address to an identifiable person. Is that the OP’s case? (I can’t see their Cloudflare-jailed screen shot)

The EC also says “an email address such as [email protected]” is not an example of personal data.

This should really be covered by an EDPB Guideline, but I’m not finding one.

If I create an anonymous account but put what looks like a real name in the username field, and sign all posts with that real-looking name, who’s to say it’s really my name? Then suppose I lose my internet connection but want to exercise my right to be forgotten. The GDPR enables people to make an Art.17 request in writing but the GDPR also mandates that data controllers identify who the request comes from (so Mallory does not request deletion of Alice’s records). If a user ad hoc puts their name on everything then mails a request with a copy of their ID card which matches the name they put on everything, it’s a bit off because a company who does not ID users would not normally have the infrastructure in place to support GDPR requests. (and that’s a good thing… it’s good that there’s incentive to support the practice of offering anonymous accounts) But here’s the other problem: the ID mechanism itself must be minimal. A data controller cannot demand a full copy of your ID card if they can verify using something less intrusive like date of birth to verify you. Perhaps in this case a copy of the ID card would be necessary. OTOH, names are not generally unique, which would mean I could use my ID card to request deletion of all records of other people who have the same name.

As a practical matter, we also have to figure that DPAs are extremely lazy. I’ve filed many Art.77 reports with strong irrefutable evidence and the cases just sit for years. I cannot see a DPA being motivated to work on a case that Reddit can easily defend. OP’s best move is to look at local anti-spam laws (I’m guessing it’s spam… I do not have access to the Cloudflared image the OP posted).

(edit) more clarity here, hopefully → https://infosec.pub/comment/6975469

Kind of. Yes you really should make an Art.17 request to ensure having a strong GDPR case in the event of non-compliance, but technically there is still an Art.5 data minimization rule that applies to data that is no longer needed for performance of the contract.

So cool to hear that Brazil has a GDPR equivalent. That (and the fact that Bolsanaro got booted) makes me want to live there.

Embarrassing that the US can’t get on the ball with this.

Delete is not same thing, as requesting to destroying all identifiable data of you.

This is what I don’t get. How are Reddit accounts not pseudo/anonymous? Back when I had an account (~5+ years ago at latest) they had nothing personally identifiable on me, in which case there are no GDPR rights to speak of. Even if I were to make an Art.17 request and go above and beyond by supplying a copy of my ID card with the request, Reddit would have no way to even verify that my ID is associated to the acct.

I think the whole discussion is moot when the data is “anonymous”.

But suppose they had the OP’s name on file linked to the acct thus making the GDPR applicatable. There would still be a violation under GDPR Art.5 (minimization) and Art.25 (protection by design). But it is probably quite difficult to make a minimization case; lawyers have to work hard. Much stronger and effective to make an Art.17 claim, which indeed requires making the request.

It’s in the GDPR jurisdiction but Reddit accounts are anonymous AFAIK. IMO the GDPR does not protect anonymous data.

/cc @[email protected]

The GDPR is a not a directive. It’s a regulation. Nontheless, I read that the GDPR was specifically mirrored into UK law with a couple minor modifications.

But to answer @[email protected], AFAIK the #GDPR does not apply in this situation anyway because Reddit accounts are “anonymous”. The GDPR only protects identified people.

/cc @[email protected]

You are on a privacy-offending Cloudflare site (#LemmyWorld), so Tor users are blocked from seeing your Cloudflare-jailed image. If you care about privacy you will bounce from that instance.

Without seeing the image, I have to ask how an anonymous user gets #GDPR rights. Or has #Reddit started supporting an identification mechanism of some kind? When I start the reg process, it asks for an email address, username, and pw, not a first + lastname (but my test stopped when a Google reCAPTCHA push was attempted). I have zero sympathy for Reddit – they are rotten to the core scumbags, but I do not see how the GDPR can be applied to anonymous accounts.

(edit) I gather from other comments you must have posted an email. Would be great if you could copy the text of the email into the body of your post so everyone can see it and so people using screen readers can hear it. Thanks!