<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Oct 15, 2017 at 4:48 PM, Bruce O'Neel <span dir="ltr"><<a href="mailto:bruce.oneel@pckswarms.ch" target="_blank">bruce.oneel@pckswarms.ch</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>Hi,<br></div><div><br></div><div>Thanks to Stephan's pointer to the <a href="http://eugdpr.org" target="_blank">eugdpr.org</a> website. I've spent some time with this and have some comments below.<br></div><div><br></div><div>First, the GDPR will apply if we let EU residents go to the Squeak websites. Given the popularity of Squeak in the EU that means GDPR regardless of where we physically host it.<br></div><div><br></div><div>Second I think we're going to run into a computer geek view of the world not agreeing with the EU view of the world. Ie, you sent an email to a public mailing list with your full contact info that is archived forever. What words in that last sentence did you not understand? <br></div></blockquote><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div></div><div><br></div><div>The things I think we have to comply with are:<br></div><div><br></div><div>1. Consent. The users have to know what they are giving us. Cookie notifications on the main webpage and some sort of page that describes what we log for access like IP addresses, etc. We also have to make clear how long info is stored. So if the webserver keeps that last 30 days of IP address logs than that has to be clear. We also have an age problem. We will need parental consent if there are users under 16. For the wiki, mailing lists etc we need to be clear what additional info is gathered. This is probably the easy one.<br></div><div><br></div><div>2. Breach notification, Right to Access, and Right to be forgotten are going to be harder.<br></div><div><br></div><div>The places where we collect more personal info than just IP address are for the Wiki, the Mailing lists, and the bug tracker. In all three cases we would need to have enough info that:<br></div><div><br></div><div>1. For breach notification we can actually notify folks. We would need to collect email addresses in all cases for that to work.<br></div></blockquote><div><br></div><div><div>Increasing the amount of personal data held by collecting additional email address solely to advise of a breach seems counter productive to the GDPR's spirit of data minimisation.</div><div><br></div><div>I can't imagine that normal traffic to public mail lists could be construed to pose "high risk to the rights and freedoms of natural persons". So 34.1 [1] might not apply, and a public mail list announcement may suffice rather than a personalise notice.<br></div><div><br></div><div>[1] <a href="https://gdpr-info.eu/art-34-gdpr/">https://gdpr-info.eu/art-34-gdpr/</a></div></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div></div><div>2. For right to access we would have to be able to show ALL the info we've kept on a particular user. All posts to the email lists, all swiki entries, etc.<br></div></blockquote><div><br></div><div>This information is already publicly available. Don't subjects implicitly already have "access" ?</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div></div><div>3. And for right to be forgotten we would have to allow users to delete ALL the data we've captured. All swiki entries, all archived email, etc. This is probably the hardest.<br></div></blockquote><div><br></div><div><div>Balancing this is the "right to freedom of expression and information, including processing for journalistic purposes" [2] and "archiving purposes in the public interest" [3].</div><div><br></div><div>[2] <a href="https://gdpr-info.eu/art-85-gdpr/">https://gdpr-info.eu/art-85-gdpr/</a></div><div>[3] <a href="https://gdpr-info.eu/art-89-gdpr/">https://gdpr-info.eu/art-89-gdpr/</a> </div></div><div><br></div><div>cheers -ben (ianal)</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div></div><div><br></div><div>For number 2, the right to access, would all be easiest if the wiki, email and bug trackers had a unified account, but, it probably would be ok if one had three accounts. None the less you have to be able to see all your entries in all three.<br></div><div><br></div><div>Number 3 is the trickiest especially with the mailing list archive. People's postings and signatures get copied into other threads and other's emails. It might be hard to keep the archives in that case. Getting this one right starts sounding like an AI research problem.<br></div></blockquote><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div></div><div><br></div><div>Someone asked about the DPO (Data Protection Officer). The way I read <a href="http://www.eugdpr.org/gdpr-faqs.html" target="_blank">http://www.eugdpr.org/<wbr>gdpr-faqs.html</a> is no, we do not need this.</div><div>There are other issues but I think these are the most important.<br></div><div><br></div><div>NB: I am not an expert, though I do spend some time professionally on this, and, will be spending more time in the future. This advice is worth every centime you've paid for it as well.<br></div><div><br></div><div>cheers<br></div><div><br></div><div>bruce</div><span class="gmail-"><div><br></div><div><br></div><div><br></div><div><br></div><div><i>13 October 2017 20:18 Peter Crowther <<a href="mailto:peter@ozzard.org" target="_blank">peter@ozzard.org</a>> wrote:</i><br></div></span><blockquote class="gmail-m_-3680701081223931240infmailquote"><div dir="ltr"><div><span class="gmail-"><div>I'd also favour EU, but then *somebody* will have to ensure that we comply with GDPR for any personal information that we store - and I don't know who that would be. Hence my question.<br></div><div><br></div></span><span class="gmail-"><div>I wouldn't recommend UK at the moment due to the regulatory turbulence of Brexit.<br></div></span></div><div>- Peter<br></div></div><span class="gmail-"><div class="gmail_extra"><div><br></div><div class="gmail_quote"><div>On 13 October 2017 at 15:37, Tobias Pape <span dir="ltr"><<a href="mailto:Das.Linux@gmx.de" target="_blank">Das.Linux@gmx.de</a>></span> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><span><br>> On 06.10.2017, at 10:35, Peter Crowther <<a href="mailto:Peter@ozzard.org" target="_blank">Peter@ozzard.org</a>> wrote:<br> ><br> > What personal information is stored, if any?<br> ><br> <br> </span>What?</div><div><span><br>> What regulatory environment do we wish to be in?<br> <br> </span>Dunno. I'm just trying to keep things running.</div><div><br></div><div>I'd favour EU, but that's actually none of my business…<br></div><div><br></div><div class="gmail-m_-3680701081223931240HOEnZb"><div class="gmail-m_-3680701081223931240h5"><div><br></div><div>><br></div><div>> Cheers,<br></div><div>><br></div><div>> - Peter<br></div><div>><br></div><div>> On 4 October 2017 at 19:29, tim Rowledge <<a href="mailto:tim@rowledge.org" target="_blank">tim@rowledge.org</a>> wrote:<br></div><div>> We have been informed that our sponsored servers are virtually certain to go away at the end of the year. Rackspace has been providing space via the Software Conservancy Foundation but are withdrawing and we cannot afford their normal fees.<br></div><div>><br></div><div>> So, tell us where we can get space and support to run <a href="http://squeak.org" rel="noreferrer" target="_blank">squeak.org</a>, the swiki, etc.<br></div><div>><br></div><div>> tim<br></div><div>> --<br></div><div>> tim Rowledge; <a href="mailto:tim@rowledge.org" target="_blank">tim@rowledge.org</a>; <a href="http://www.rowledge.org/tim" rel="noreferrer" target="_blank">http://www.rowledge.org/tim</a><br></div><div>> All computers run at the same speed...with the power off.<br></div><div>><br></div><div>><br></div><div>><br></div><div>><br></div><div>><br></div><div><br></div><div><br></div></div></div></blockquote></div><div><br></div></div><div><><br></div></span></blockquote><div><br></div><div id="gmail-m_-3680701081223931240editorUserSignature" style="display:none"><br></div><br><br>
<br></blockquote></div><br></div></div>