The text does technically give the reason on the first page:

It is not a regular language and hence cannot be parsed by regular expressions.

Here, “regular language” is a technical term, and the statement is correct.

The text goes on to discuss Perl regexes, which I think are able to parse at least all languages in LL(*). I’m fairly sure that is sufficient to recognize XML, but am not quite certain about HTML5. The WHATWG standard doesn’t define HTML5 syntax with a grammar, but with a stateful parsing procedure which defies normal placement in the Chomsky hierarchy.

This, of course, is the real reason: even if such a regex is technically possible with some regex engines, creating it is extremely exhausting and each time you look into the spec to understand an edge case you suffer 1D6 SAN damage.

I found an academic article (Vogel et al 2019) that analyses this phrase. Key points:

• when the German legislator uses geschäftsmäßig, this demonstrates a clear difference in intention from gewerbsmäßig or gewohnheitsmäßig

• the article quotes Franz von Liszt 1881, and this definition seems to be accepted to this day:

  Die Gewerbsmäßigkeit charakteriſiert ſich einerſeits durch die auf öftere Wiederholung gerichtete Abſicht, andrerſeits durch die Abſicht des Thäters, ſich durch dieſe Wiederholung eine, wenn auch nicht regelmäßig oder dauernd fließende Einnahmsquelle zu verſchaffen […].

  Die Geſchäftsmäßigkeit teilt mit der Gewerbsmäßigkeit die auf regelmäßige Wiederholung gerichtete Abſicht, dagegen fehlt die Abſicht, ſich eine ſtändige Einnahmsquelle zu eröffnen. Ob die einzelnen Handlungen honoriert werden oder nicht, iſt gleichgültig.

• the term geschäftsmäßig is significant for §5 TMG, but has also reached wider attention in the discussion around the decriminalization of assisted suicide.

So the key defining aspect is the auf regelmäßige Wiederholung gerichtete Absicht, the intention directed towards regular repetition.

This meaning in legalese German is divorced from everyday language.

§ 5 TMG has the interesting construction of “geschäftsmäßige, in der Regel gegen Entgelt angebotene Telemedien”. So the TMG does not seem to care whether you have a profit motive, only that other people might provide this kind of service for a profit motive. If other people would provide instances of Discord bots in order to get donations, that might already bring you in scope.

This is not legal advice, but it seems like your options are to either avoid running an instance of the bot, only running it in a private context without access from a wider public, or sucking it up and providing the necessary documentation.

And no, it is probably not possible to use a PO box because you don’t live or work at that address. The general expectation seems to be for the address in an imprint to be ladungsfähig, so that you can be served there. This random lawyer’s website writes:

Unter der Anschrift in diesem Zusammenhang ist die Postleitzahl, der Ort, die Straße und die Hausnummer zu verstehen, nicht ausreichend ist die Angabe eines Postfachs.

That’s not the correct criterion. There are multiple German laws that require imprint-style disclosures.

Some of them are indeed specific to commercial activities.

But the Impressumspflicht typically means §5 TMG which requires an Impressum for

geschäftsmäßige, in der Regel gegen Entgelt angebotene Telemedien

Rough English translation:

Telemedia offered in a business-like manner, typically for remuneration

Critically, “geschäftsmäßig” does not mean “commercial” or “profit-oriented”. In particular, nonprofit organizations also act geschäftsmäßig.

IANAL, but it doesn’t sound like your service wouldn’t be geschäftsmäßig.

All of this is irrelevant anyway because you very likely have to publish a privacy notice per Art 13 or Art 14 GDPR. This must include the identity and contact details of the data controller (i.e., you). The German data protection authorities expect that the identity includes your real name and a ladungsfähige Anschrift (address where you can be served), so pretty much exactly what would be included in an Impressum anyway.

Die Website ist relevant genug um einen kurzen Wikipedia-Artikel zu haben: https://de.wikipedia.org/wiki/Caschys_Blog Aber ja, man muss den Blog nicht gut finden.

Original der Meldung findest du etwa hier: https://workspaceupdates.googleblog.com/2023/07/adding-line-numbers-to-google-docs.html

On the other hand, the GDPR’s concept of “personal data” is extremely broad, much more so than the US concept of PII. Personal data is any information relating to an identifiable person. Pseudonymous info is still personal under this definition. Online usernames or social media handles are identifiers, and any linked info (e.g. posts, comments, likes) is personal data as well.

So Lemmy and other Fediverse stuff is well within the GDPR’s material scope.

However, the GDPR’s “right to erasure /to be forgotten” is more nuanced. It doesn’t quite always apply (though usually does). OP very likely has the right to request deletion from individual instances.

Posts have been published through federation. The GDPR anticipates this (I think in Art 17(2)): if personal data has been made public by the data controller, and erasure is requested, then the data controller is obliged to take reasonable steps to notify other controllers of this.

The ActivityPub protocol has built-in support for sending out such deletion notifications, and last time I checked Lemmy implements this. Of course the receiving instance might not honor this, but that’s outside of the responsibility of the initial data controller.

While I’m not entirely convinced that everything here is 100% compliant, federation is less of a compliance issue than it might seem.

Synology’s DSM has built-in MFA support, though it also has some features for external identity management. I don’t think Keycloak and so on would be compatible though.