Re: GDPR compliance best practices?

From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Jun 8, 2018, 08:13 UTC
Message-ID: <8736xxzof3.fsf@evledraar.gmail.com>
In-Reply-To: <20180608062657.GB9383@helen.PLASMA.Xg8.DE>

On Fri, Jun 08 2018, Peter Backes wrote:

Show 15 quoted lines

> On Thu, Jun 07, 2018 at 10:53:13PM -0400, Theodore Y. Ts'o wrote:
>> The problem is you've left undefined who is "you"?  With an open
>> source project, anyone who has contributed to open source project has
>> a copyright interest.  That hobbyist in German who submitted a patch?
>> They have a copyright interest.  That US Company based in Redmond,
>> Washington?  They own a copyright interest.  Huawei in China?  They
>> have a copyright interest.
>>
>> So there is no "privately".  And "you" numbers in the thousands and
>> thousands of copyright holders of portions of the open source code.
>
> Of course there is "privately". Every single one of those who have the
> author information can keep it, privately, for themselves. But those
> that have received a request to be forgotten must not keep publishing
> it on the Internet for download or distribute it to others.

Can you walk us through how anyone would be expected to fork (as create a new project, not the github-ism) existing projects under such a regiment?

E.g. in git.git we have SOB lines for the whole history, in lieu of GNU-style copyright assignment (which is how things mainly worked back in the CVS days) someone can just clone the repository and create a hostile fork, which is one of the central ideas of free software.

In the world you're describing the history would have been expunged publicly, and no hosting site would be willing to host it. It might be gone in practical terms to anyone who just doesn't like how (in this example) the Git project is run, and thinks they can do it better.

Maybe (again, in this example) the Software Freedom Conservancy's scope would have to expand to retain this private history (right now they have nothing to do with copyright).

But then how am I going to fork the Git project if the SFC decides they don't want to cooperate with me?

As David Lang notes upthread, "the license is granted to the world, so the world has an interest in it". I wouldn't be so sure that this line of argument wouldn't work.