7 ms·

Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. If this application doesn't collect any such data for its

by jhgb 4y ago

Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. If this application doesn't collect any such data for its author, then this point goes away. If you are using the software, then you're processing your own data. I'm not sure that provenance of your tools has any bearing on it. Even just 2(c) in [1] would disqualify it.

ggeorgovassilis 4y ago
> Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. According to the data privacy statement (DPS) it does more than that, refer to chapter "Set-Up and Configure Your Email": Thunderbird collects your email domain and other technical data to set-up and configure your email account. Other information, like your name, your email messages, and your account’s address book are stored locally on your computer and never sent to us. "Thunderbird" means the email client, not the web service ("us"). The DPS cleanly separates between data stored locally on the client and data shared with the servers - the DPS addresses both scenarios and it explains which data is stored locally, so their interpretation is that GDPR covers data processed by the application which does not leave the client, too. > If this application doesn't collect any such data for its author, then this point goes away The Thunderbird DPS seems to think otherwise, as it describes the locally stored data even if it isn't submitted to the web service. Maybe the DPS doesn't intend to apply a legal interpretation to local data and mentions local data only for contrast to shared data, which the DPS definitely cares about? Hence my in-earlier-comment comment that this might be just ass-covering without legal weight.
- jhgb 4y ago
  I was talking purely about what the GDPR might require you to do. That Thunderbird tells you more in no way necessarily means that GDPR requires it. GDPR doesn't prevent you from voluntary disclosing information. With extremely high likelihood, telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do. Not to mention that privacy statements don't necessarily have to satisfy just one party. A single privacy statement may incorporate clauses to satisfy all the local requirements that an internationally operating entity making that statement is obligated to satisfy.
  - ggeorgovassilis 4y ago
    > telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do That's exactly what the GDPR enforces. You give the app personally identifying data, so the app needs to disclose what it does with the data because storing it on the computer and not sending it anywhere is still data processing. In this case the data privacy statement needs to tell the user that the data is stored but not shared. If you're not doing anything with the data, then don't ask for it.
    - jhgb 4y ago
      Please show me where the GDPR talks about the behavior of software as opposed to the behavior of legal entities. To my knowledge, GDPR puts limits on what legal entities do to other people. Software is not a legal entity.

by jhgb 4y ago

ggeorgovassilis 4y ago

> Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. According to the data privacy statement (DPS) it does more than that, refer to chapter "Set-Up and Configure Your Email": Thunderbird collects your email domain and other technical data to set-up and configure your email account. Other information, like your name, your email messages, and your account’s address book are stored locally on your computer and never sent to us. "Thunderbird" means the email client, not the web service ("us"). The DPS cleanly separates between data stored locally on the client and data shared with the servers - the DPS addresses both scenarios and it explains which data is stored locally, so their interpretation is that GDPR covers data processed by the application which does not leave the client, too. > If this application doesn't collect any such data for its author, then this point goes away The Thunderbird DPS seems to think otherwise, as it describes the locally stored data even if it isn't submitted to the web service. Maybe the DPS doesn't intend to apply a legal interpretation to local data and mentions local data only for contrast to shared data, which the DPS definitely cares about? Hence my in-earlier-comment comment that this might be just ass-covering without legal weight.

jhgb 4y ago
I was talking purely about what the GDPR might require you to do. That Thunderbird tells you more in no way necessarily means that GDPR requires it. GDPR doesn't prevent you from voluntary disclosing information. With extremely high likelihood, telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do. Not to mention that privacy statements don't necessarily have to satisfy just one party. A single privacy statement may incorporate clauses to satisfy all the local requirements that an internationally operating entity making that statement is obligated to satisfy.
- ggeorgovassilis 4y ago
  > telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do That's exactly what the GDPR enforces. You give the app personally identifying data, so the app needs to disclose what it does with the data because storing it on the computer and not sending it anywhere is still data processing. In this case the data privacy statement needs to tell the user that the data is stored but not shared. If you're not doing anything with the data, then don't ask for it.
  - jhgb 4y ago
    Please show me where the GDPR talks about the behavior of software as opposed to the behavior of legal entities. To my knowledge, GDPR puts limits on what legal entities do to other people. Software is not a legal entity.