Here is the information I have on your user ID as an operator of a remote instance.

1: Your username and home instance (and a separate link to your profile page on your home instance)
2: Your avatar
3: Your about info
4: Date/time of your last activity (but that I think will be the last time you were seen by my instance, interacting in a community I also have here), so not shared really.

I took a look at the json returned from your home instance, and again the info is profile page, username, information required for communication between instances with the only PII present being the username, the about and an icon and image.

Here’s why I’m going to say this isn’t likely to be a problem as such. This is the same as on reddit, if I look at a post a user makes I can click on the user and get access to this level of public information. Also under GDPR and DPA based on advice from the ICO data sharing isn’t forbidden, but the minimum required to fulfil the function of that sharing should be sent. I think the above data meets that. There isn’t information we don’t need to work a distributed network like this.

I think the point about making a privacy policy visible is a good one. It should make it clear how the network works, and what kind of information is shared with federated instances (and also available to the public, the user query is publicly available). But the data that is federated is the same as is publicly available.

Now I do feel like there’s the scope for a lot of manual work. For example, federation sometimes means that edits/deletes don’t make it. It can be caused by problems on both sides of the connection. So if you want all your data deleted. Sure I could delete all posts and your user info here. And even make requests to the home instances that they delete them too. But, some might remain on remote instances, and I don’t know who would be responsible for that. Some grey areas remain.