Legally, it should mean no personally identifiable information is collected, since they are not accurately described. In practice, I'd expect at least IPs to be logged, but not used meaningfully. This is of course if the site services the EU.
this post was submitted on 07 Jan 2024
41 points (100.0% liked)
Asklemmy
1454 readers
72 users here now
A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
If the site services the EU and does not have a privacy policy it’s downright illegal according to the GDPR.
Art. 14 GDPR, “Information to be provided where personal data have not been obtained from the data subject”:
Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information […] the identity and the contact details of the controller […] the purposes of the processing for which the personal data are intended […] where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation …
Is it just me or does this not make sense? It says you must declare the purposes of the processing for which personal data are intended, but this is under the section for when no personal data is collected. How does that work?
That section is only applicable if personal data has been obtained by some means other than from the data subject. If a site doesn’t collect or process any personal information, period, then that section (and the rest of the GDPR) isn’t applicable.
load more comments
(1 replies)
It's probably made by one person or a small group of people in an unofficial capacity meaning they're not doing eveything they should. So it could mean anything really.
I believe the GDPR doesn't require quite a few of the things in that law unless the company is above a certain size. May have something to do with that.