Matrix.org - EU

What will it take to build an open source Europe and how the Digital Commons EDIC can help

2026-10-14T14:00:00+00:00

A few years ago, it would have been unthinkable that Governments could have dedicated open source and digital commons strategies championed by ministers. But that has changed profoundly: in June, the European Commission unveiled a European Tech Sovereignty Package, which identified some €264 billion</a> spent annually on proprietary, non-European products and services as a strategic risk. The Matrix Foundation has been a driving force in this change. Last week, I was in Paris representing Matrix at an event hosted by the General Directorate for Enterprises</a> to discuss the vital role open source plays in Europe’s digital policy agenda. The event was opened by the French Minister Delegate for AI and Digital affairs Anne Le Henanff and the German State Secretary at the Federal Ministry for Digital Transformation and Government Modernisation (BMDS) Markus Richter. At the same time our Developer Relations lead, Andy Piper</a>, was in Luxembourg</a> speaking on a panel with a new European body that grew out of the Tech Sovereignty Package: the Digital Commons European Digital Infrastructure Consortium</a> (DC-EDIC).</p>

The French and German ministers opened the DGE open source event.</p> </figcaption> </figure>

The DC-EDIC was created in December last year with the mission to “develop, maintain, and scale digital commons for Europe”. The finalisation of an open call for expert advisors</a> completed the set-up of a first-of-its-kind governmental body that aims to strengthen European digital sovereignty by building, financing, and deploying open source infrastructure solutions. The DC-EDIC is an exciting opportunity for the whole of Europe to catalyse the use of digital commons and ensure the commons are sustainable.</p>

With 12 years under our belt spent building and maintaining Matrix as an open standard, taking it to the point where it serves as the backbone of communications for millions of European civil servants</a>, we have built a strong understanding of the gaps in the market and ecosystem that hold back the sustainable use of digital commons. Here are our recommendations for how the DC-EDIC can maximise the impact of its five goals</a>.</p> </span>

🔗</a>1. Build a European community</h2>
The EDIC plans to build a thriving, trusted ecosystem of open source actors, collaborating with existing open source communities and ultimately “connect[ing] deployment experience with development priorities”. That covers sharing knowledge, promoting success stories, and favouring collaboration over duplication.</p>
Whilst open source communities are used to such collaborations, the intergovernmental status of the EDIC means it could go well beyond community management and take inspiration from intergovernmental bodies in other sectors. The World Health Organization (WHO), for example, makes it easier for UN procurement agencies to make choices aligned with its quality, safety and efficacy recommendations by maintaining a list of ‘pre-qualified</a>’ medical products, as well as setting international norms and standards (such as on which medicines are ‘essential’</a> to a functioning health system). WHO also coordinates relevant actors for health emergencies, such as disease outbreaks</a>; and provides forums</a> where governments and other stakeholders can seek consensus solutions for shared challenges.</p>
Now replace “health” with “digital sovereignty” in the paragraph above and see how, beyond ensuring that the EU Member States collaborate and share experiences, the DC-EDIC could become a place of:</p>

Guidance and trust</strong>, for example by providing the tools to make appropriate choices (think pre-qualification).</p> </li>

Standard setting</strong>, by promoting best practices including the convergence towards open standards (think essential medicines).</p> </li>

Coordination</strong>, in particular around problem solving and funding (think outbreak response and governance forums).</p> </li> </ol>
Here is how the EDIC could take on these roles.</p>
🔗</a>1.1 Build a trusted ecosystem</h3>
Just as WHO provides guidance on ‘essential’ medical products, the DC-EDIC could host an index of projects and vendors that shows how each project relates to its forks and successors, and celebrates those who contribute back. We actually worked with Grist</a> to put together a proof of concept of such an index which can be found here</a> and we called Trusted Vendor Authority (TVA).</p>
🔗</a>1.2 Support the independent governance of digital commons</h3>
True digital sovereignty benefits from an independently governed commons. There are different models for doing this, but non-profit foundations such as the Python Software Foundation</a> and The Matrix.org Foundation</a> could provide a helpful starting point. These organisations provide administrative and governance support for their projects and protocol. The EDIC could:</p>

Provide guidance to Member States’ procurement on integrating governance funding into their framework, or advise law makers on the importance of the same</p> </li>

Create or support the creation of a home for essential but small open source projects that lack this kind of foundational oversight</p> </li>

Provide guidance on best practice in open source governance</p> </li>

Financially support the governance of projects which are key to Europe’s digital resilience</p> </li> </ul>
However, few users realise that this independence needs sustainable funding to last.</p>
🔗</a>1.3 Train decision makers and buyers in open source procurement</h3>
Procurement is one of the biggest hurdles the ecosystem faces: decision makers need to understand why open source matters, how to buy it, and why the best way to keep open source free is to financially support the upstream developers. The EDIC could become the reference source of guidance for different types of buyers, covering what open source brings to sovereignty, privacy and cost savings (backed by the evidence described below), and matching solutions with buyers’ needs.</p>
🔗</a>1.4 Identify challenges that all Member States share</h3>
All Member States need to solve the same issues, which makes the DC-EDIC the obvious place to find joint solutions and fund them together (see pooled funding below).</p>
🔗</a>2. Open access to funding</h2>
The institutions who can most benefit from switching their technology stack to free and open source software – governments, health insurers, civil society organizations – are often resource-constrained and might struggle with operational, cost, and expertise hurdles. The DC-EDIC can help in four ways:</p>
🔗</a>2.1 Fund and guide migration to open source</h3>
The EDIC should provide operational guidance to organisations switching to open source and, through the European Sovereign Tech Fund (EU-STF)</a>, provide financial support or even seconded experts to help them migrate. The EU-STF is one of the first two projects tackled by the DC-EDIC and was kicked-off in June as a pilot.</p>
🔗</a>2.2 Fund usability, security and compliance so digital commons can scale</h3>
Open source projects that fail to displace their vendor-locked equivalents usually stumble on the same hurdles: their usability cannot compete, or they cannot shoulder security and compliance requirements (CRA, accessibility, audits…). Promotion and ecosystem management matter too, but a user-friendly commons can grow organically without them, as VideoLAN’s VLC shows. Usability, security and compliance work could be funded by existing programmes, but it also fits squarely within the EU-STF and the DC-EDIC mission. On security, the EDIC could even play the role WHO’s pathogen surveillance network plays for outbreaks, coordinating how Member States spot and respond to vulnerabilities in the commons they share.</p>
🔗</a>2.3 Support the development of full stack solutions</h3>
For most end-users, technology that works ‘out of the box’ lowers barriers to entry. France’s LaSuite</a>, Germany’s OpenDesk</a> and the Netherlands’ MijnBureau, replacements for Microsoft 365 that use Matrix clients as their communications components, are good examples. The recent Horizon Europe calls on the creation of an Open Internet Stack will also help; the EDIC could use the European Sovereign Tech Fund to support the creation of similar projects.</p>
🔗</a>2.4 Pool funding across Member States</h3>
A true common is used across most of the Member States, which share similar needs, and may all want to fund its support or development. But no open source project can align the procurement processes of a dozen public administrations, in practice, it is lucky if funding from even one gets through. By acting as a crowdfunding platform for governments, the DC-EDIC could pool these resources.</p>
🔗</a>3. Sustain the components everyone depends on</h2>
Open source infrastructure is, as the EDIC recognises, chronically underfunded. Just as WHO’s essential medicines list tells health systems what they cannot do without, the EDIC could list the digital commons Europe depends on and make sure they are funded. Beyond the governance support described above, it could tackle two additional challenges.</p>
🔗</a>3.1 Fund guardianship</h3>
Matrix is a good example to understand why this matters. It carries the communications of civil servants across Europe: in Germany, BundesMessenger</a> and openDesk</a> serve the public administration; in France, Tchap</a> has been mandatory for all civil servants since August 2025; Swedish agencies are leveraging the interoperability of Matrix-based apps</a>; Belgium uses BEAM</a>, Luxembourg (LuxChat</a>), Poland (Merkury 2.0</a>), and Austria’s healthcare system and Switzerland’s postal service rely on it too. All of them chose Matrix because, as an open standard, it breaks vendor lock-in. Yet only one government agency, France’s Directorate for Digital Affairs (DINUM), has joined The Matrix.org Foundation as a member to support the core specification all these national governments rely on, and only since October 2025. The DC-EDIC could close this funding gap by supporting the organisations that independently maintain specifications and protocols, promote them and keep their ecosystems diverse and alive: the backbone of any digital common.</p>
🔗</a>3.2 Help digital commons become financially self-sufficient</h3>
Most open source funding goes to new technology, yet maintaining what we already rely on matters at least as much. Funding maintenance work via grants can carry its own pitfalls: critical commons become dependent on the next round of applications to continue their work. The better goal is self-sufficiency: helping commons gather resources from their own users to fund maintenance and reduce their “bus factor” (the risk that a project stalls if a few key people leave). The EU-STF can target exactly that, for example by getting commons to set up a recurring revenue stream such as Foundation membership, alongside educating the industry on how to support the commons it uses.</p>
True digital sovereignty requires interoperability and independent standards. Those standards must be sustainably financed for both proper maintenance and continued independence.</p>
🔗</a>4. Bring deployment evidence to policymakers</h2>
The EDIC will support policymakers seeking to implement new regulation, or transition their operations to open source solutions. It can do this in four ways:</p>
🔗</a>4.1 Gather deployment data across Member States</h3>
The DC-EDIC makes it easy for all the participating Member States to compare notes on which tools and technologies they use. Much as WHO’s Global Health Observatory turns national data into shared evidence, this data is gold dust for policymakers who need to see the reality on the ground.</p>
🔗</a>4.2 Commission studies on the real cost of proprietary software</h3>
Proprietary software is expensive, but exact figures on what EU governments spend are hard to come by. One indicative data point: the German federal government reportedly spent €481.4 million on Microsoft services in 2025</a>. Evidence gathering that can identify more data points, offer a comparative analysis of long-term cost differences between using e.g. Microsoft Office vs OpenDesk (or other interchangeable tech stacks), and teasing out potential savings could help organisations make the decision to migrate or not. A calculator of migration costs and savings over time would be a useful tool for CFOs and policymakers.</p>
🔗</a>4.3 Publish policy briefs on privacy and security</h3>
Governments and regulated industries have a duty of care to safeguard the privacy and security of the data that they handle. Proprietary software solutions have not always held up their end of the bargain in meeting this duty. For example, in March 2024, the European Data Protection Supervisor found that the European Commission’s use of Microsoft 365 infringes the EU Data protection law.</a> In early 2026, France banned</a> its civil servants from using Zoom, Google Meet, Microsoft Teams and other US based platforms, in the name of data sovereignty (as mentioned above, the use of Matrix-powered Tchap was already mandated). Plenty of data exists on privacy and security, but it is rarely accessible to non-experts. Short, clear policy briefs showing which solutions can guarantee security, compared with common proprietary alternatives, would offer both guidance and reassurance.</p>
🔗</a>4.4 Create a one-stop clearing house for essential information</h3>
This would bring together the trusted index of projects and vendors described above, information that helps bridge different solutions, and normative templates and other guidance documents (on migration, for example).</p>
🔗</a>5. Run concrete projects</h2>
The DC-EDIC plans to run 100-Day Challenges that produce working open source software. This is exciting and needed. We suggest that in addition to software development projects, the EDIC runs concrete, time-bound projects to address some of the contextual pieces needed, as mentioned above: pricing studies, policy briefs, the trusted index of projects and vendors, and the list of essential digital commons that should get maintenance support. New software matters, but where the EDIC can play a pivotal role is the context around that software: governance, expertise, and guidance for adoption.</p>
🔗</a>Why the DC-EDIC should act as a beacon, not a software producer</h2>
The DC-EDIC's unique value-add is in governance, not in software production. It has the power to convene the organisations with shared needs, and distil them for the benefit of the open source community.</p>
Europe already has plenty of talented open source builders, what the EDIC can uniquely do is act like a reference point, taking on the unglamorous work that keeps everyone’s lights on. WHO does not manufacture medicines; but it provides guidance on which ones are essential, and where they can be sourced from trusted manufacturers. The DC-EDIC can do the same for digital commons: help Europe choose with confidence, set the standards worth converging on, coordinate when problems are shared, and fund the components we all depend on.</p>
Matrix’s journey from a small open standard to the backbone of government communications across Europe shows both how far digital commons can go and how fragile they remain when nobody funds their guardians. The DC-EDIC is the best chance yet to change that, and The Matrix.org Foundation is looking forward to helping.</p>
In the meantime, The Matrix Conference</a> next week (20-23 October 2026) will be a great demonstration of how far the project has come: all stakeholders in the ecosystem will be gathered in Malmö, Sweden, to show off their work, share knowledge and collaborate. The conference features no less than two full days focused on the public sector Matrix ecosystem</a>. NATO, the UN, the European Commission, as well as representatives of the majority of the countries running Matrix, which were mentioned above, will make it on stage to share more about their deployments. The Matrix Conference is the main event for the Matrix ecosystem and we are looking forward to seeing both new and old friends there! A few tickets are still available</a> but hurry before they run out!</p>

Matrix for Public Sector: DINUM joins the Foundation as we launch a new forum!

2025-10-21T12:30:00+00:00

🔗</a>DINUM becoming the first government to join the Matrix.org Foundation</h2>
Today DINUM, the French Interministerial Digital Directorate, has officially announced that they were joining the Matrix.org Foundation</a> as a Silver member</a> and becomes the first government to join the Matrix.org Foundation!</p>
This is particularly exciting news as it will hopefully set an example for other public sector organisations using Matrix to communicate, and there are many of them.</p> </span>
In France, Matrix is the basis for Tchap</a>, the secure messaging system of choice for public officials. It was selected for its security, but also openness, transparency and sovereignty as it limits dependence on proprietary solutions from outside Europe.</p>
With this support, DINUM is committed to:</p>

participating in the governance of the protocol and enhancing its quality</strong>, in conjunction with other user states (Sweden, Luxembourg, the Netherlands, Germany...) and the open source business ecosystem;</li>
contributing to the development of the community versions of the various software components of the ecosystem</strong>, used by many public services;</li>
ensuring that its actions are part of a framework for sustainable investment in digital commons</strong>.</li> </ul>
DINUM has been an active contributor to projects of the Matrix ecosystem for a while, including by providing improvements to the implementation of Sliding Sync, which optimises performance and user experience; as well as the development of a community version of a border gateway, which enhances the security of the communications between distinct organisations.</p>
Stéphanie Schaer, the Interministerial Director for Digital Affairs says: “With this partnership, we are choosing to make a long-term investment in a strategic digital commons for the benefit of the European ecosystem. Matrix is an essential building block for secure and sovereign communication services. This sponsorship reflects our conviction that the digital sovereignty of the State requires direct investment in the commons.”</p>
🔗</a>Matrix for Public Sector</h2>
This announcement comes a few days after the second edition of The Matrix Conference</a>. The Conference was held in Strasbourg (France), gathering about 300 attendees, amongst which more than a dozen public sector organisations, brought together by their use of Matrix as a sovereign, secure and resilient communication protocol.</p>
The Conference saw two full days of public sector track</a>, shedding light on the various exciting deployments of Matrix by these organisations. All the talks are already available for watching here</a>, and will be soon published on the website, but you can find a list of the public sector related ones at the bottom of this post.</p>
We also took the opportunity of having many representatives of these public organisations present in person at the Conference to officially launch a Matrix for Public Sector forum</strong>. This is the very first group of its kind that the Foundation sets up and already many other industries are asking for something similar. The group will be proposed to the Governing Board for approval to potentially become an official Working Group</a>.</p>
The goal of the Matrix for Public Sector forum is for the Foundation to bring together all public sector players who have already deployed Matrix or are looking to do so, and enable them to share knowledge, learnings and experiences, generally grow the usage of Matrix in the public sector, hopefully ultimately federating all these deployments into a proper Matrix network.</p>

Launching the Matrix for Public Sector forum at the Matrix Conference 2025</p> </figcaption> </figure>
This seminal meeting gathered a dozen of organisations including representatives from France, the European Commission, Sweden, Germany, Luxembourg, the Netherlands, Belgium, the UK and Romania. The discussion focused on the type of knowledge and learning could be shared as well as how to structure the group.</p>
All this activity, concretising years of growth of Matrix in the public sector is a huge step forward for the ecosystem, and we are very much looking forward to enabling this group of users to grow. It is also great to start implementing new ways for the Foundation to support the ecosystem and we can’t wait to replicate it with other industries!</p>
And again: Welcome DINUM!</p>
Amandine</p>
🔗</a>Public sector talks at the Conference</h3>
Matrix for Public Sector</a>, Amandine Le Pape, The Matrix.org Foundation</p>
Trialing Matrix within the European Commission for resilient and sovereign communications</a>, Nicolas Dubois, European Commission</p>
Matrix French gov deployment: opening a private federation securely</a>, Mathieu Velten, Direction Interministérielle du Numérique (DINUM)</p>
Consolidating Germany’s administrative communication: Towards a joint Matrix-based architecture</a>, Dominik Braun, Federal IT-Cooperation (FITKO)</p>
Sweden’s Public Sector in Transition</a>, Anna Engström and Kenneth Edwall, Försäkringskassan</p>
Luxchat(4gov)</a>, Patrick Weber, the Luxembourg government</p>
Secure communication leveraging the Matrix protocol for UNICC and its partners</a>, Tima Soni, United Nations International Computing Centre (UNICC)</p>
Supporting TF-X with Matrix: best practices and pitfalls</a>, Jeroen Franssen, NATO ACT</p>
The German BundesMessenger</a>, Kai A. Hiller, BWI</p>
No Desk Is an Island: Enabling Cross-Border Workspace Communication</a>, Alexander Smolianitski, ZenDiS</p>
Matrix’s role in the German Healthcare System</a>, Marie Ruddeck, Gematik</p>
Nationwide Rollout of Matrix-Based Instant Messaging (TI-M) for 74 Million Statutorily Insured Citizens</a>, Jan Kohnert, Gematik</p>
Medical Care over Matrix with Delay during a Simulated Moonwalk</a>, Jan-Lukas Furmanek (FAU Erlangen; University Hospital Erlangen) and Aileen Rabsahl (European Space Agency)</p>
An Update on reaching the German Government via Matrix</a>, networkException, Federal IT-Cooperation (FITKO)</p>

The European Union must keep funding free software

2024-07-17T19:00:00+00:00

The Matrix.org Foundation is joining other organisations in calling on the European Commission to sustain its funding for the Next Generation Internet.</p>
We thank the petites singularités</a> association for their leadership in starting this open letter, and are grateful to OW2</a> for the English translation.</p>
Join us by publishing the letter on your own website and add yourself to this table</a>.</p>
🔗</a>Open letter to the European Commission</h3>
Since 2020, Next Generation Internet (NGI</a>) programmes, part of European Commission's Horizon programme, fund free software in Europe using a cascade funding mechanism (see for example NLnet's calls</a>). This year, according to the Horizon Europe working draft detailing funding programmes for 2025, we notice that Next Generation Internet is not mentioned any more as part of Cluster 4.</p> </span>
NGI programmes have shown their strength and importance to supporting the European software infrastructure, as a generic funding instrument to fund digital commons and ensure their long-term sustainability. We find this transformation incomprehensible, moreover when NGI has proven efficient and economical to support free software as a whole, from the smallest to the most established initiatives. This ecosystem diversity backs the strength of European technological innovation, and maintaining the NGI initiative to provide structural support to software projects at the heart of worldwide innovation is key to enforce the sovereignty of a European infrastructure. Contrary to common perception, technical innovations often originate from European rather than North American programming communities, and are mostly initiated by small-scaled organizations.</p>
Previous Cluster 4 allocated 27 million euros to:</p>

"Human centric Internet aligned with values and principles commonly shared in Europe" ;</li>
"A flourishing internet, based on common building blocks created within NGI, that enables better control of our digital life" ;</li>
"A structured ecosystem of talented contributors driving the creation of new internet commons and the evolution of existing internet commons".</li> </ul>
In the name of these challenges, more than 500 projects received NGI funding in the first 5 years, backed by 18 organisations managing these European funding consortia.</p>
NGI contributes to a vast ecosystem, as most of its budget is allocated to fund third parties by the means of open calls, to structure commons that cover the whole Internet scope - from hardware to application, operating systems, digital identities or data traffic supervision. This third-party funding is not renewed in the current program, leaving many projects short on resources for research and innovation in Europe.</p>
Moreover, NGI allows exchanges and collaborations across all the Euro zone countries as well as "widening countries" [^1], currently both a success and an ongoing progress, likewise the Erasmus programme before us. NGI also contributes to opening and supporting longer relationships than strict project funding does. It encourages implementing projects funded as pilots, backing collaboration, identification and reuse of common elements across projects, interoperability in identification systems and beyond, and setting up development models that mix diverse scales and types of European funding schemes.</p>
While the USA, China or Russia deploy huge public and private resources to develop software and infrastructure that massively capture private consumer data, the EU can't afford this renunciation. Free and open source software, as supported by NGI since 2020, is by design the opposite of potential vectors for foreign interference. It lets us keep our data local and favors a community-wide economy and know-how, while allowing an international collaboration. This is all the more essential in the current geopolitical context: the challenge of technological sovereignty is central, and free software allows addressing it while acting for peace and sovereignty in the digital world as a whole.</p>

Policy and regulation update 2024: Matrix and the GDPR

2024-06-06T07:00:00+00:00

If you have been following the matrix.org blog for some time, you will know that we’ve never been ones to shy away from complex topics like public policy and its impacts on Matrix. With this blog post series, our aim is to introduce a more regular cadence to our regulatory updates and to be more transparent about where we are focusing our efforts in this area.</p>
Each blog post in the series will focus on a given theme or piece of law, as well as its relevant jurisdiction. We will start this series by taking a deep dive into EU regulation, starting with the General Data Protection Regulation (GDPR). Future blog posts in the series will cover the digital services package (DMA and DSA), the incoming CRA and the highly controversial CSAM regulation. These will be followed by a series dedicated to the UK, particularly UK applications of European law such as the GDPR and ePrivacy directive, as well as the Online Safety Act and the IPA amendment bill. Finally, we will conclude the series by looking across the pond and diving into the Cloud Act, as well as KOSA and other existing proposals.</p> </span>
🔗</a>The big one</h2>
Over the last decade the most impactful - in terms of grassroots led change, not necessarily enforcement - piece of legislation was probably the GDPR. Although its initial enforcement date (May 2018) was a couple of years before I joined Element and the Matrix.org Foundation, I know that preparing for GDPR was a huge effort that led to a lot of deep thinking about the ins and outs of Matrix.</p>
These have been certainly years of learning, iterating and evolving our approach to this fascinating piece of law, and just like 6 years ago</a>, we keep receiving questions and feedback about how the GDPR applies to the Matrix protocol and how server administrators can remain compliant.</p>
We maintain the view that the GDPR was not built for a decentralised digital world, after all we are (for now!) the exception, not the rule. This does not mean, however, that we don’t make every effort possible to comply with the spirit and the letter of the law. Most organisations using the Matrix protocol will be running strictly closed federations or single servers in closed federation, which they fully control (or appoint others to support them with that control). Compliance is a lot more straightforward in this sense, so for now we will focus on those using Matrix to interact with open federation.</p>
The most difficult part of GDPR compliance for Matrix has always been article 17, right to erasure, or ‘right to be forgotten’ as it is usually known. Our view has always been that this is a relative right, which needs to take into account available technology and other applicable laws in order to be enacted. For example, if an employee leaves a company and asks for all of their data to be erased, in practice not all of that data will actually be erased, due to constraints put in place by other legal instruments (i.e. tax and fraud prevention regulations, employment law, etc.).</p>
Considering this relativity, we looked at what other ubiquitous product offerings already exist in the decentralised space, and how they address erasure. Using email as an analogy was a no-brainer in this regard: one understands that deleting an email account will delete everything from their inbox and sent folders, whilst also understanding that is impossible and not expectable to have the same data deleted from the recipients’ inbox (or the inboxes of those that might have had the same message forwarded to them).</p>
Use of technology is always associated with constant give and take and risk based decisions. Whilst we make every effort to minimise risks for the people using the Matrix protocol, the reality is that one of the main purposes of the protocol is integrity of communications and decentralisation of communications data. This is directly at odds with absolute deletion of communications.</p>
So how do we come to terms with this conflict? Following the email analogy, we address right to erasure from two different standpoints: account data and communications data. As part of the protocol, everyone is able to automatically delete their accounts and select an option to delete all of their data. First, this deletes all ‘external’ data associated with the account, such as e-mail addresses, phone numbers, IP addresses and device identifiers - effectively pseudonymising this data, aside from Matrix IDs which we will address later on. This measure follows recital 28 of the GDPR, which mentions pseudonymisation as a risk reducing measure for data subjects, which helps controllers and processors meet their data protection obligations.</p>
Now, the thornier issue of communications data. How can we apply erasure whilst maintaining the integrity of the service for remaining users? Keeping on with the email analogy, if someone deletes their sent email from their own account, you would still expect an existing thread with multiple users to work and be visible. You just would not expect the same message to leave the original account to new individuals.</p>
That is precisely how the issue is addressed in Matrix - upon deletion of an account, and request for deletion of messages, a flag is applied to the original messages which prevents it from ever being displayed to any new people. This, of course, requires cooperation from the other server administrators who might also have copies of the same message in their server instance. We make this decision by referring to recital 66 of the GDPR, which requires controllers take reasonable steps, taking into account available technology, to inform other controllers of the data subject’s request to have their data erased.</p>
One issue still remains unresolved - Matrix IDs (MXIDs) are always associated with state events (data sent by a user to modify the attributes of a given room - eg its name, its members, its avatar), which means those IDs could still leak over federation. That is a particular concern when one uses their legal name as their MXID. The solution for this is to replace the MXID with a pseudonym, maintaining the integrity of communications and fully removing any last remains of identifiable information in the system.</p>
The Synapse team has also made a lot of progress on message retention policies and media retention, both huge strides to continuously improve the privacy of Matrix users, whilst also helping server administrators comply with their legal obligations.</p>
Things have definitely progressed in the portability space, and chat export is now implemented in multiple Matrix clients, having been first implemented on Element Web in October 2021, in version 1.9.2. We look forward to seeing what the next year brings us in terms of privacy improvements.</p>
For the next post in this series we will continue discussing the EU policy landscape, although from a different perspective. We will be going through the digital services package (which includes the DSA and DMA) and what does it all mean for Matrix now that we have reached implementation stage.</p>
As always, we remain open to your feedback and thoughts. If there is anything you would like to hear more about or have a suggestion for a future blog in this series please feel free to reach out to dpo@matrix.org</a> via email, DM to @gpdr:matrix.org</a> or chat to us in the Office of the Matrix.org Foundation room</a>.</p>