12 ms·

I am assuming no such thing. Just because you are not making revenue doesn’t mean that you don’t have to abide by regulation. The GDPR is intended to solve a v

I am assuming no such thing. Just because you are not making revenue doesn’t mean that you don’t have to abide by regulation. The GDPR is intended to solve a very real and present issue; if you run a side project that deals with personal data, then the fact that it makes no money doesn’t mean that your mistreatment of personal data isn’t harmful!

dleslie 9y ago
I'd rather block all EU IPs than bother to break working technology that is operated and maintained freely. How do you revoke PII from a distributed information system, like anything using a blockchain or distributed version control? You don't.
- matthewmacleod 9y ago
  You can. You just need to think about it and have the correct controls in place. If you choose to block all EU IPs instead of implementing the most basic data security and retention policies, then it’s for the best that EU users are not able to use your compromised service.
  - dleslie 9y ago
    You cannot force peers of any decentralized distributed system to forget data. They can pretend to and appear as compliant peers and yet retain the data.
    - matthewmacleod 9y ago
      Then why are you storing PII on them?
      - dleslie 9y ago
        Have you ever used git and supplied a username and email as your author? That's PII in a distributed service that cannot be revoked.
        nocha 9y ago
        That is also PII being used for the purpose it was collected for (identifying a contributor) and I believe falls under Art.6(1)(f) of the GDPR. You would likely have a hard time convincing anybody that you can apply the right to be forgotten to a git repo - especially as that particular processing can be argued to not be requiring consent once you have submitted your commits.
        dleslie 9y ago
        The author details are not necessary for the core function of git; the change itself does not need the PII. Moreover, my concern is general for when PII is in such a distributed system; git is just one example of many.
        vertex-four 9y ago
        I've always felt that git is poorly designed for that reason. At the very least, there should be an "identity block" that commits etc point into, rather than embedding names, emails, and other identity information into immutable commits. Under GDPR, that's how it would've been designed in the first place. Of course, this'll never happen without a complete fork of git. Once you've got that sorted and you can change/remove identity information, the likes of GitHub have no issue so long as they have GDPR-compliant contracts with any business partners who can access git repos. Obviously, anyone using GitHub who decides to store all identity data forever is, generally speaking, not GitHub's problem, same as someone who noted down the names of all their friends on Facebook isn't Facebook's problem.
        jimktrains2 9y ago
        > I've always felt that git is poorly designed for that reason. At the very least, there should be an "identity block" that commits etc point into, rather than embedding names, emails, and other identity information into immutable commits. Misuse of git isn't a problem inherent to git.
        vertex-four 9y ago

dleslie 9y ago

I'd rather block all EU IPs than bother to break working technology that is operated and maintained freely. How do you revoke PII from a distributed information system, like anything using a blockchain or distributed version control? You don't.

matthewmacleod 9y ago
You can. You just need to think about it and have the correct controls in place. If you choose to block all EU IPs instead of implementing the most basic data security and retention policies, then it’s for the best that EU users are not able to use your compromised service.
- dleslie 9y ago
  You cannot force peers of any decentralized distributed system to forget data. They can pretend to and appear as compliant peers and yet retain the data.
  - matthewmacleod 9y ago
    Then why are you storing PII on them?
    - dleslie 9y ago
      Have you ever used git and supplied a username and email as your author? That's PII in a distributed service that cannot be revoked.
      - nocha 9y ago
        That is also PII being used for the purpose it was collected for (identifying a contributor) and I believe falls under Art.6(1)(f) of the GDPR. You would likely have a hard time convincing anybody that you can apply the right to be forgotten to a git repo - especially as that particular processing can be argued to not be requiring consent once you have submitted your commits.
        dleslie 9y ago
        The author details are not necessary for the core function of git; the change itself does not need the PII. Moreover, my concern is general for when PII is in such a distributed system; git is just one example of many.
      - vertex-four 9y ago
        I've always felt that git is poorly designed for that reason. At the very least, there should be an "identity block" that commits etc point into, rather than embedding names, emails, and other identity information into immutable commits. Under GDPR, that's how it would've been designed in the first place. Of course, this'll never happen without a complete fork of git. Once you've got that sorted and you can change/remove identity information, the likes of GitHub have no issue so long as they have GDPR-compliant contracts with any business partners who can access git repos. Obviously, anyone using GitHub who decides to store all identity data forever is, generally speaking, not GitHub's problem, same as someone who noted down the names of all their friends on Facebook isn't Facebook's problem.
        jimktrains2 9y ago
        > I've always felt that git is poorly designed for that reason. At the very least, there should be an "identity block" that commits etc point into, rather than embedding names, emails, and other identity information into immutable commits. Misuse of git isn't a problem inherent to git.
        vertex-four 9y ago