2 ms·

GDPR and GIT: Should we have personally identifiable usernames/emails in Git?

tremon 5y ago
Yes, because of https://en.wikipedia.org/wiki/Moral_rights_(copyright_law) https://en.wikipedia.org/wiki/Moral_rights_(copyright_law): > The moral rights include the right of attribution, the right to have a work published anonymously or pseudonymously, and the right to the integrity of the work Attribution and integrity are guaranteed by Git's committer and hash fields, so it's just complying with the law here. If the artist wants to publish anymously or psuedonymounsly they can do so by choosing the committer name and e-mail appropriately, but to suggest that git is somehow violating the GDPR here is a stretch.
dahart 5y ago
I’d love to hear the case against, what reasons are you thinking of, and how would you imagine git working without PII (personally identifiable information)? In the general case, since you’re asking about all git, I’m not sure it makes sense, but there probably are some cases where it might. (And maybe you’re stumbling onto a business opportunity…) My reasons for thinking the default status-quo username/email setup is not generally an issue wrt GDPR are: - GDPR is for EU residents, not git repos that don’t have any contributors residing in the EU. - GDPR mainly applies to “professional or commercial” organizations of more than 250 people, insofar as they sell within the EU or “monitor” EU residents. - Git is a tool anyone can use, and it’s not a company or organization, so there isn’t any way to enforce GDPR against git per se. - Many git repos are private, only accessible within a company or organization, so no need to keep out PII. - Emails & usernames in git are already opt-in, mostly. People using github can use throwaway identifiers, if they want. But it usually makes more sense to want your public git contributions to be personally identifiable and publicly associated with you, so that people can reach you, for people building resumes with OSS contributions, etc. It might make sense for public repos that are associated with a company or professional org to hide emails (and maybe usernames too, but usernames are not automatically PII, and anyway you’d need some kind of author identifier). Your question does potentially bring up what I think is an interesting problem with GDPR which is the ability to revoke permission to PII. Someone could opt-in to a company’s public repo with their email, and later want to revoke it, which would be problematic with git in a public repo, to say the least.

Yes, because of https://en.wikipedia.org/wiki/Moral_rights_(copyright_law) https://en.wikipedia.org/wiki/Moral_rights_(copyright_law): > The moral rights include the right of attribution, the right to have a work published anonymously or pseudonymously, and the right to the integrity of the work Attribution and integrity are guaranteed by Git's committer and hash fields, so it's just complying with the law here. If the artist wants to publish anymously or psuedonymounsly they can do so by choosing the committer name and e-mail appropriately, but to suggest that git is somehow violating the GDPR here is a stretch.

dahart 5y ago

I’d love to hear the case against, what reasons are you thinking of, and how would you imagine git working without PII (personally identifiable information)? In the general case, since you’re asking about all git, I’m not sure it makes sense, but there probably are some cases where it might. (And maybe you’re stumbling onto a business opportunity…) My reasons for thinking the default status-quo username/email setup is not generally an issue wrt GDPR are: - GDPR is for EU residents, not git repos that don’t have any contributors residing in the EU. - GDPR mainly applies to “professional or commercial” organizations of more than 250 people, insofar as they sell within the EU or “monitor” EU residents. - Git is a tool anyone can use, and it’s not a company or organization, so there isn’t any way to enforce GDPR against git per se. - Many git repos are private, only accessible within a company or organization, so no need to keep out PII. - Emails & usernames in git are already opt-in, mostly. People using github can use throwaway identifiers, if they want. But it usually makes more sense to want your public git contributions to be personally identifiable and publicly associated with you, so that people can reach you, for people building resumes with OSS contributions, etc. It might make sense for public repos that are associated with a company or professional org to hide emails (and maybe usernames too, but usernames are not automatically PII, and anyway you’d need some kind of author identifier). Your question does potentially bring up what I think is an interesting problem with GDPR which is the ability to revoke permission to PII. Someone could opt-in to a company’s public repo with their email, and later want to revoke it, which would be problematic with git in a public repo, to say the least.