3 ms·

Except this isn't limited to ads is it? From the post it sounds like the ruling covers any user content. If someone uploads personal data to Github now Github i

by tensor 10mo ago

Except this isn't limited to ads is it? From the post it sounds like the ruling covers any user content. If someone uploads personal data to Github now Github is liable. In fact, why wouldn't author names on open source licenses count as PII?

free_bip 10mo ago
You could always sue GitHub to find out. Personally, I'm not buying the slippery slope argument. I could be wrong of course but that's the great thing about opinions: you're allowed to be wrong :)
o11c 10mo ago
The author of the article is claiming it extends beyond ads. That does not appear to be what the court actually said, however. And I 100% believe that all advertisements should require review by a documented human before posting, so that someone can be held accountable. In the absence of this it is perfectly acceptable to hold the entire organization liable.
- iamnothere 10mo ago
  The ruling is about an advertisement, but: > There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR. So site operators probably need to assume it doesn’t just apply to ads if they have legal exposure in the EU.
fweimer 10mo ago
The judgement is a bit more nuanced than that: https://curia.europa.eu/juris/document/document_print.jsf?mode=req&pageIndex=0&docid=306764&part=1&doclang=EN&text=&dir=&occ=first&cid=14888943 https://curia.europa.eu/juris/document/document_print.jsf?mo... The court uses the phrase “an online marketplace, as controller” in key places. This suggest to me that there can be online marketplaces that are not data controllers. The court cites several contributing factors to treat the platform as data controller: they reserved additional rights to upload content, they selected the ads to display. Github only claims limited rights in uploaded content, and I'm not sure if they have any editorialized (“algorithmic”) feeds where Github selects repository content for display. That may make it less likely that they would be considered data controllers. On the other hand, licensing their repository database for LLM training could make them liable if personal data ends up in models. I don't think that's necessarily a bad thing.
- compiler-guy 10mo ago
  Github does include some small amount of algorithmic feeds in its recommendation engines. I have half-a-dozen projects "Recommended for you" on my github home page. I doubt that is enough to trigger this ruling, but algorithmic content is absolutely pervasive these days.
bonzini 10mo ago
> why wouldn't author names on open source licenses count as PII? They are but you can keep PII if it is relevant to the purpose of your activity. In this case the author needs you to share his PII, in order to exercise his moral and copyright rights.
iamnothere 10mo ago
Yeah, it sounds like mirroring a repo to GitHub would violate this, as author names and emails are listed in commit history.

by tensor 10mo ago

free_bip 10mo ago

You could always sue GitHub to find out. Personally, I'm not buying the slippery slope argument. I could be wrong of course but that's the great thing about opinions: you're allowed to be wrong :)

o11c 10mo ago

The author of the article is claiming it extends beyond ads. That does not appear to be what the court actually said, however. And I 100% believe that all advertisements should require review by a documented human before posting, so that someone can be held accountable. In the absence of this it is perfectly acceptable to hold the entire organization liable.

iamnothere 10mo ago
The ruling is about an advertisement, but: > There’s nothing inherently in the law or the ruling that limits its conclusions to “advertisements.” The same underlying factors would apply to any third party content on any website that is subject to the GDPR. So site operators probably need to assume it doesn’t just apply to ads if they have legal exposure in the EU.

fweimer 10mo ago

The judgement is a bit more nuanced than that: https://curia.europa.eu/juris/document/document_print.jsf?mode=req&pageIndex=0&docid=306764&part=1&doclang=EN&text=&dir=&occ=first&cid=14888943 https://curia.europa.eu/juris/document/document_print.jsf?mo... The court uses the phrase “an online marketplace, as controller” in key places. This suggest to me that there can be online marketplaces that are not data controllers. The court cites several contributing factors to treat the platform as data controller: they reserved additional rights to upload content, they selected the ads to display. Github only claims limited rights in uploaded content, and I'm not sure if they have any editorialized (“algorithmic”) feeds where Github selects repository content for display. That may make it less likely that they would be considered data controllers. On the other hand, licensing their repository database for LLM training could make them liable if personal data ends up in models. I don't think that's necessarily a bad thing.

compiler-guy 10mo ago
Github does include some small amount of algorithmic feeds in its recommendation engines. I have half-a-dozen projects "Recommended for you" on my github home page. I doubt that is enough to trigger this ruling, but algorithmic content is absolutely pervasive these days.

bonzini 10mo ago

> why wouldn't author names on open source licenses count as PII? They are but you can keep PII if it is relevant to the purpose of your activity. In this case the author needs you to share his PII, in order to exercise his moral and copyright rights.

iamnothere 10mo ago

Yeah, it sounds like mirroring a repo to GitHub would violate this, as author names and emails are listed in commit history.