So it’s possible for fediverse instances to comply with the GDPR. What makes one think it wouldn’t be doable?

That’s not even remotely enough, even assuming that the information is sufficient.

Mastodon is in a much better place, on account of how federation works there. It might still not be enough. Lemmy instances would have to stop all federation with instances beyond the territorial reach of the GDPR or equivalent. Federation within that territory should only happen based on a contractual agreement between the owners, probably with every user given an explicit choice to opt out.

(and keeping in mind the nature of federation meaning the only stuff my instance sends out is the stuff that I write)

The stuff you write is personal data as long as it can be connected to your identity and so protected under the GDPR. But that’s a problem for other people.

Your problem is the personal data of other people that come under your control. For starters, you need to answer this question: What legal basis do you have for processing that data?

For those of us who love federation and privacy and want to federate while complying with the GDPR - what must be done?

They need legal experts on the team. As GDPR-fans will tell you, data protection is a fundamental human right. We don’t let just anyone perform surgery, so don’t expect that just anyone should be able to run a social media site.

Complying with the GDPR is challenging at the best of times. When you handle personal data, some of it sensitive, at the scale of a fediverse instance, it becomes extremely hard.

Strictly speaking, it’s impossible. EG you need to provide information about what you do with the data in simple language. The information also needs to be complete. If the explanation is too long and people just click accept without reading, that’s not proper consent. You need to square that circle in a way that any judge will accept. That’s impossible for now. Maybe in a few years, when there’s more case law, there’ll be a solid consensus.

Complying as well as possible will require the input of legal experts, specialized in the law of social media sites. The GDPR is not the only relevant law. There’s also the DSA, quite possibly other stuff I am not aware of, and local laws.

Definite problems, I can see:

1. Under german law, an instance owner has to provide an address, that may be served legal papers.
2. It’s possible to embed images, but under the GDPR, there must not be connections to 3rd party servers without consent. In fact, all out-going links are a problem.
3. Federation itself. You can’t federate with instance, if you haven’t made sure that they comply with GDPR.

Still, the archival nature of decentralized communities is one of the primary objectives of the technology. It’s arguably the defining feature of any decentralized thing that no one controls everything so things are meant to stay “forever”. Otherwise Bitcoin would be completely ilegal since there’s no way to delete information there.

What do you do if someone in the US refuses to delete and maybe gives you that argument about freedom of expression? That’s right. You pay damages to your user because you screwed it up.

Not really, again, the text of the law states that if the information has been made public the company must inform whoever they made the data public to:

Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

AFAIK Lemmy federated deletions, whether an instance acts on it or not is another matter.

But GDPR doesn’t work like you think, let me give you an example, say you sent an email from provider A to someone on provider B, then you decide to delete that email account, the email you sent will still be in provider B, even if company A deletes all of your information that email is still there and won’t get deleted. This is fine with GDPR, otherwise no email provider could operate here. Same goes for other federated or decentralized technologies.