Re: GDPR compliance best practices?

From: Philip Oakley <philipoakley@iee.org>
Date: Jun 9, 2018, 22:50 UTC
Message-ID: <059CBAEFB9D945EE9D54BF515E963798@PhilipOakley>
In-Reply-To: <20180608025313.GA12749@thunk.org>

From: "Theodore Y. Ts'o" <tytso@mit.edu>
Sent: Friday, June 08, 2018 3:53 AM

Show 46 quoted lines

> On Fri, Jun 08, 2018 at 01:21:29AM +0200, Peter Backes wrote:
>> On Thu, Jun 07, 2018 at 03:38:49PM -0700, David Lang wrote:
>> > > Again: The GDPR certainly allows you to keep a proof of copyright
>> > > privately if you have it. However, it does not allow you to keep
>> > > publishing it if someone exercises his right to be forgotten.
>> > someone is granting the world the right to use the code and you are
>> > claiming
>> > that the evidence that they have granted this right is illegal to have?
>>
>> Hell no! Please read what I wrote:
>>
>> - "allows you to keep a proof ... privately"
>> - "However, it does not allow you to keep publishing it"
>
> The problem is you've left undefined who is "you"?  With an open
> source project, anyone who has contributed to open source project has
> a copyright interest.  That hobbyist in German who submitted a patch?
> They have a copyright interest.  That US Company based in Redmond,
> Washington?  They own a copyright interest.  Huawei in China?  They
> have a copyright interest.
>
> So there is no "privately".  And "you" numbers in the thousands and
> thousands of copyright holders of portions of the open source code.
>
> And of course, that's the other thing you seem to fundamentally not
> understand about how git works.  Every developer in the world working
> on that open source project has their own copy.  There is
> fundamentally no way that you can expunge that information from every
> single git repository in the world.  You can remote a git note from a
> single repository.  But that doesn't affect my copy of the repository
> on my laptop.  And if I push that repository to my server, it git note
> will be out there for the whole world to see.
>
> So someone could *try* sending a public request to the entire world,
> saying, "I am a European and I demand that you disassociate commit
> DEADBEF12345 from my name".  They could try serving legal papers on
> everyone.  But at this point, it's going to trigger something called
> the "Streisand Effect".  If you haven't heard of it, I suggest you
> look it up:
>
> http://mentalfloss.com/article/67299/how-barbra-streisand-inspired-streisand-effect
>
> Regards,
>
> - Ted
>

Hi Ted,

I just want to remind folks that Gmane disappeared as a regular list because of a legal challenge, the SCO v IBM Unix court case keeps rumbling on, so clarifying the legal case for: a) holding the 'personal git meta data', and b) disclosing (publishing) 'personal git meta data' under various copyright and other legal issue scenarios relative to GDPR is worth clarifying.

I'm of the opinion that the GPL should be able to allow both holding and disclosing that data, though it may need a few more clarifications as to verifying that the author is 'correct' (e.g. not a child) and if a DCO is needed, etc.

We are already looking at a change to the hash, so the technical challenge could be addressed, but may create too many logical conflicts if 'right to be forgotten' is allowed (one hash change is enough;-)

Philip