5 ms·

What about github? What happens if someone that have been a contributor to several projects and then says to github that they have to remove the data that is in

by he0001 8y ago

What about github? What happens if someone that have been a contributor to several projects and then says to github that they have to remove the data that is in those repositories. However they just cannot go in and erase history in companies repos?

KozmoNau7 8y ago
Code is not personal data. All they need to clean up is the contributer's name and contact information.
- he0001 8y ago
  But that still requires to rewrite history in the repos [0]. What if the commits are signed etc. [0] https://www.git-tower.com/learn/git/faq/change-author-name-email https://www.git-tower.com/learn/git/faq/change-author-name-e...
  - KozmoNau7 8y ago
    Ideally, they simply change the data for that user's identity, and everything that pulls it gets the anonymous info instead.
    - he0001 8y ago
      How?
      - KozmoNau7 8y ago
        Anything can be scripted.
        he0001 8y ago
        Well, I don’t think Github can rewrite the history of a customers’ repo just like that.
        frockington 8y ago
        Agreed, that would set a dangerous precedent that would force many to consider alternatives
extra88 8y ago
There are a number of exceptions to the Right to be Forgotten provisions.
- he0001 8y ago
  The exceptions are if there is an different law that supersedes GDPR. However none of them are indefinitely so sooner or later GDPR will apply.
  - extra88 8y ago
    From Article 17, Right to erasure (‘right to be forgotten’) [0], "the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; If one can argue the personal data is still necessary, e.g. for the purpose of attribution in a repo, then the controller is not obliged to erase it. Paragraph 3 is all about exceptions including ones for freedom of expression and "establishment, exercise or defence of legal claims," e.g. copyright or other IP. [0] https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
    - he0001 8y ago
      But attribution is not permanent legal requirement it’s eventually going to expire. And copyright or IP is about the owner of the repository, but not the personal information in a repository. I find it hard that “copyright” or IP applies to personal information unless you are the one owning it, which you don’t if you work for a company. However it could be kind of funny if you work another company contributing to a project owned by another company. About “defense of legal claims”, removing people from the history will only strengthen your claim as the owner of the repo? I’m not convinced that paragraph 3 actually applies here, not sure what exact claims can be done for keeping that information as it is. And can github “hide” behind such vague exceptions?
      - extra88 8y ago

by he0001 8y ago

KozmoNau7 8y ago

Code is not personal data. All they need to clean up is the contributer's name and contact information.

he0001 8y ago
But that still requires to rewrite history in the repos [0]. What if the commits are signed etc. [0] https://www.git-tower.com/learn/git/faq/change-author-name-email https://www.git-tower.com/learn/git/faq/change-author-name-e...
- KozmoNau7 8y ago
  Ideally, they simply change the data for that user's identity, and everything that pulls it gets the anonymous info instead.
  - he0001 8y ago
    How?
    - KozmoNau7 8y ago
      Anything can be scripted.
      - he0001 8y ago
        Well, I don’t think Github can rewrite the history of a customers’ repo just like that.
        frockington 8y ago
        Agreed, that would set a dangerous precedent that would force many to consider alternatives

extra88 8y ago

There are a number of exceptions to the Right to be Forgotten provisions.

he0001 8y ago
The exceptions are if there is an different law that supersedes GDPR. However none of them are indefinitely so sooner or later GDPR will apply.
- extra88 8y ago
  From Article 17, Right to erasure (‘right to be forgotten’) [0], "the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; If one can argue the personal data is still necessary, e.g. for the purpose of attribution in a repo, then the controller is not obliged to erase it. Paragraph 3 is all about exceptions including ones for freedom of expression and "establishment, exercise or defence of legal claims," e.g. copyright or other IP. [0] https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
  - he0001 8y ago
    But attribution is not permanent legal requirement it’s eventually going to expire. And copyright or IP is about the owner of the repository, but not the personal information in a repository. I find it hard that “copyright” or IP applies to personal information unless you are the one owning it, which you don’t if you work for a company. However it could be kind of funny if you work another company contributing to a project owned by another company. About “defense of legal claims”, removing people from the history will only strengthen your claim as the owner of the repo? I’m not convinced that paragraph 3 actually applies here, not sure what exact claims can be done for keeping that information as it is. And can github “hide” behind such vague exceptions?
    - extra88 8y ago