Hacker News Reader

Comment by viraptor | Hacker News Reader

So which parts of the GDPR do you actually disagree with in case of this XMPP service? Mostly you need to tell people what you collect, allow removing accounts and history, and tell them if you're sending the data to third-parties. If you're running a private service you most likely already fulfill those requirements. Where's the annoyance?

View on HN

In the specific case of XMPP, wouldn't I need to have an agreement with every other admin who federates their XMPP server and work out what exactly our roles are as defined by GDPR? XMPP still has active development community around it so this will no doubt get much easier with time, but that's just XMPP.

IANAL, but unlikely. Sending messages is the primary purpose of the service. As long as users are made aware that messages going outside of your domain are shared with 3rd parties, it's on them to make that decision. Same would apply to email, phones, etc.

Maybe not: You need to have a "Legal Basis" and only 1 of them is the "subject has given consent" one.

There's another:

"The processing is NECESSARY FOR THE PERFORMANCE OF A CONTRACT to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"

I thought you would have to al least all the admins to agree to follow the GDPR so that data can be retrieved, corrected, and deleted on demand right?

Look at it this way: The service you're using needs a privacy policy, that is not new. The way that policy is organized or shared is no different now, just what rights the user and what obligations the service provider has.

Reply on news.ycombinator.com