Re: GDPR compliance best practices?

From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Jun 3, 2018, 12:59 UTC
Message-ID: <87tvqk81qp.fsf@evledraar.gmail.com>
In-Reply-To: <20180603112557.GA6564@helen.PLASMA.Xg8.DE>

On Sun, Jun 03 2018, Peter Backes wrote:

Show 11 quoted lines

> On Sun, Jun 03, 2018 at 12:45:25PM +0200, Ævar Arnfjörð Bjarmason wrote:
>> protection". I.e. regulators / prosecutors are much likely to go after
>> some advertising company than some project using a Git repo.
>
> Well, it is indeed rather unlikely that one particular git repo project
> will be targeted, but I guess it is basically certain that at least
> some of them will be.
>
> It is the same as a lottery, it's very unlikely you win the jackpot,
> yet someone wins it every few months. We should care about the entire
> community, not be too selfish.

I'm not trying to be selfish, I'm just trying to counter your literal reading of the law with a comment of "it'll depend".

Just like there's a law against public urination in many places, but this is applied very differently to someone taking a piss in front of parliament v.s. someone taking a piss in the forest on a hike, even though the law itself usually makes no distinction about the two.

Show 12 quoted lines

>> Since the Author is free-form this sort of thing doesn't need to be part
>> of the git data format. You can just generate a UUID like
>> "5c679eda-b4e5-4f35-b691-8e13862d4f79" and then set user.name to
>> "refval:5c679eda-b4e5-4f35-b691-8e13862d4f79" and user.email to
>> "refval:5c679eda-b4e5-4f35-b691-8e13862d4f79".
>
> Well, this is merely pseudonymization, not anonymization. Note that the
> UUID, innocent as it may look, is not in any way less "personal data"
> than the author string itself. Your proposal would thus not actually
> solve the problem, only slightly transform it. Only when you truly
> anonymize (see my proposal about one way to to it), you can completely
> evade the GDPR.

In this example once you'd delete the UUID ref you don't have the UUID -> author mapping anymore (and b.t.w. that could be a many to one mapping).

This seems perfectly acceptable to be since the spirit of the GDPR is to prevent easy Googling of who did what in the past, not to prevent someone with tremendous resources from say doing a textual analysis of all git.git commits to find out who authored what.

Show 16 quoted lines

>> Sites that are paranoid about the GDPR could have a pre-receive hook
>> rejecting any pushes from EU customers unless their commits were in this
>> format.
>
> This won't work either. The GDPR makes each data processor directly
> responsible in relation to the data subject. So it does not matter at
> all who is pushing, it matters who is in the author field of the
> commits that were pushed. And since you don't have any information
> about whether those authors are residing within the EU or not, you have
> to assume they are and you have to obey the GDPR. Even if you are
> outside the EU and do not have any subsidiaries within the EU, the GDPR
> sill applies as long as you are processing personal data of EU citizen.
> Perhaps the authorities in your country will refuse to obey letters of
> request if the EU authorities try to enforce the GDPR on an
> international scope, but if you have a record of GDPR violation and you
> ever set foot on EU territory, you are fair game.

I think again that this is taking too much of a literalist view. The intent of that policy is to ensure that companies like Google can't just close down their EU offices weasel out of compliance be saying "we're just doing business from the US, it doesn't apply to us".

It will not be used against anyone who's taking every reasonable precaution from doing business with EU customers.

What do you imagine that this is going to be like? That some EU citizen is going to walk into a small business in South America one day, which somehow is violating the GPDR, and when that business owner goes on holiday to the EU they're going to get detained? Not even the US policy against Cuba is anywhere remotely close to that.

Show 5 quoted lines

>> Instead I'll have a daily UUID issued from a government API
>
> Heaven forbid. ;) There is an old German proverb, warning that even
> humorous trolling might be dangerous: "Man soll den Teufel nicht an die
> Wand malen!" ;)