3 ms·

> For GitLab.com users: as we roll out this update you will be prompted to accept our new Terms of Service. Until the new Terms are accepted access to the web

> For GitLab.com users: as we roll out this update you will be prompted to accept our new Terms of Service. Until the new Terms are accepted access to the web interface and API will be blocked. Blocking service until the user consents is illegal under GDPR, especially when the consent is requested for data collection that is not essential for providing the service, such as telemetry and analytics. https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/ > “Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”

buboard 7y ago
Is this personal data?
- dessant 7y ago
  Unless they anonymize absolutely everything, including our IP addresses, then yes, it is personal data. https://about.gitlab.com/privacy/ https://about.gitlab.com/privacy/ > Third party tracking services gather certain simple, non-personally identifying information over time, such as your IP address, browser type, internet service provider, referring and exit pages, timestamp, and similar data about your use of the Website. We do not link this information to any of your personal information such as your user name. They don't have to link your IP address to your name, because the IP address itself is already an identifier and so considered personal data.
  - aaomidi 7y ago
    Even then it just takes a very small amount of effort to argue that the anonymized data is still personal and can be linked back to individuals with a bit of statistical analysis.
- woolly 7y ago
  In addition to dessant's links, the European Commission has a good page which lists out examples (including IP address) of what is considered personal data[1]. [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- Nextgrid 7y ago
  Anything that can be used to identify the user is considered personal data. Even something innocent enough like screen resolution can be personal data if you’ve got someone with a unique browser window size (let’s say they have a custom window manager that makes the window slightly smaller than the common screen resolution, and it never changes because it’s a filing window manager and they always keep the browser in the same place).
Xelbair 7y ago
Despite using gitlab i'll probably report them to my country's organization that handles GDPR violations.
- dkersten 7y ago
  If I get locked out for not agreeing to their ToS before I'm finished migrating away, I'll be reporting them too. Then, when I'm done migrating, I will be doing a GDPR request for my data and another right of erasure request.

buboard 7y ago

Is this personal data?

dessant 7y ago
Unless they anonymize absolutely everything, including our IP addresses, then yes, it is personal data. https://about.gitlab.com/privacy/ https://about.gitlab.com/privacy/ > Third party tracking services gather certain simple, non-personally identifying information over time, such as your IP address, browser type, internet service provider, referring and exit pages, timestamp, and similar data about your use of the Website. We do not link this information to any of your personal information such as your user name. They don't have to link your IP address to your name, because the IP address itself is already an identifier and so considered personal data.
- aaomidi 7y ago
  Even then it just takes a very small amount of effort to argue that the anonymized data is still personal and can be linked back to individuals with a bit of statistical analysis.
woolly 7y ago
In addition to dessant's links, the European Commission has a good page which lists out examples (including IP address) of what is considered personal data[1]. [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
Nextgrid 7y ago
Anything that can be used to identify the user is considered personal data. Even something innocent enough like screen resolution can be personal data if you’ve got someone with a unique browser window size (let’s say they have a custom window manager that makes the window slightly smaller than the common screen resolution, and it never changes because it’s a filing window manager and they always keep the browser in the same place).

Xelbair 7y ago

Despite using gitlab i'll probably report them to my country's organization that handles GDPR violations.

dkersten 7y ago
If I get locked out for not agreeing to their ToS before I'm finished migrating away, I'll be reporting them too. Then, when I'm done migrating, I will be doing a GDPR request for my data and another right of erasure request.