3 ms·

As others stated, as long as data is associated with your account (regardless of what content) it is personal data. When companies like github.com do not follo

As others stated, as long as data is associated with your account (regardless of what content) it is personal data. When companies like github.com do not follow the GDPR and do that notoriously I am sure the fines can be raised by the administrators without changing any laws. As you can see here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ there are actually some juicy fines already. I mean 50.000.000 EUR is not much for Google but still better than nothing considering "Insufficient legal basis for data processing" was not even a real issue before GDPR. BTW this is also a nice GDPR fine reason: "Insufficient technical and organisational measures to ensure information security" (e.g. British Airways was fined with 22 million). I never did that, but did file a complaint at your national Data Protection Authority? https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

that_guy_iain 5y ago
> I never did that, but did file a complaint at your national Data Protection Authority? https://ec.europa.eu/info/law/law-topic/data-protection/refo https://ec.europa.eu/info/law/law-topic/data-protection/refo... Yea, it got forwarded to the Dutch authority because they're based in Holland. It took almost 2 years for the entire process. Basically the dutch couldn't really care and didn't understand the techincal facts of the matter and just believe Github's legal team when they said code is not personal data without knowing each commit has my name and email. The account has my photo and name. And that I was doing a personal data request and export request. Because my national agency had to forward it I couldn't file an appeal because my national agency just forwarded it and didn't actually do anything or make any decision they just relayed the decision. For me, the key take away was I asked for all information they had that was relating to me. They said no and the dutch authories thought that was a-ok.
- chromanoid 5y ago
  Mmh in this case the third bullet point from https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... is relevant ... :/ > take legal action against the DPA - If you believe that the DPA has not handled your complaint correctly or if you aren’t satisfied with its reply or if it doesn’t inform you with regard to the progress or outcome within 3 months from the day you lodged your complaint, you can bring an action directly before a court against the DPA.
mytailorisrich 5y ago
It's not that clear-cut. There are debates as to what "relates to" (wording of GDPR) means, and that seems to be open to interpretation depending on context and data. Unless there is a definitive decision on this, I think it is reasonable to claim that source code is not personal data.

that_guy_iain 5y ago

> I never did that, but did file a complaint at your national Data Protection Authority? https://ec.europa.eu/info/law/law-topic/data-protection/refo https://ec.europa.eu/info/law/law-topic/data-protection/refo... Yea, it got forwarded to the Dutch authority because they're based in Holland. It took almost 2 years for the entire process. Basically the dutch couldn't really care and didn't understand the techincal facts of the matter and just believe Github's legal team when they said code is not personal data without knowing each commit has my name and email. The account has my photo and name. And that I was doing a personal data request and export request. Because my national agency had to forward it I couldn't file an appeal because my national agency just forwarded it and didn't actually do anything or make any decision they just relayed the decision. For me, the key take away was I asked for all information they had that was relating to me. They said no and the dutch authories thought that was a-ok.

chromanoid 5y ago
Mmh in this case the third bullet point from https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... is relevant ... :/ > take legal action against the DPA - If you believe that the DPA has not handled your complaint correctly or if you aren’t satisfied with its reply or if it doesn’t inform you with regard to the progress or outcome within 3 months from the day you lodged your complaint, you can bring an action directly before a court against the DPA.

mytailorisrich 5y ago

It's not that clear-cut. There are debates as to what "relates to" (wording of GDPR) means, and that seems to be open to interpretation depending on context and data. Unless there is a definitive decision on this, I think it is reasonable to claim that source code is not personal data.