[License-discuss] GDPR and code authors...

[Gil Yehuda]

Along these lines, I recently heard a discussion about the relationship
between GDPR and contributor license agreements (CLAs). If someone signs a
CLA with a foundation or other entity to contribute code, could they
request their "data" back (the signed CLA, their github ID, etc.)? Do CLA
signature websites need to have user consent terms, etc?

Does anyone here have a pointer to a clear statement about how GDPR impacts
the little things we do in the world of open source -- like CLA management?

Thanks.
*Gil Yehuda: *I help with externally facing technology at Oath.


On Tue, Aug 14, 2018 at 9:19 AM Alex Rousskov <
rousskov at measurement-factory.com> wrote:

> On 08/14/2018 06:39 AM, Antoine Thomas wrote:
>
> > A famous cartoon about coders and development is joking today about the
> > right for coders to delete their personal data in a project, because of
> > GDPR in Europe. For an open source project, it would mean to have to
> > create an "anonymous" coder to transfer contributions.
>
> GDPR rights are no absolute -- there are many reasonable exclusions. In
> most cases, code contribution metadata would fall under one or more of
> those exclusions IMHO.
>
> And most code submissions (rather than their metadata) are not covered
> by GDPR at all. Thus, there should be virtually no GDPR-driven copyright
> transfers.
>
>
> > This lead to a few questions:
> >  - Is this technically possible with GIT?
>
> Technically, everything is possible with git ;-). However, altering
> project history creates serious technical and non-technical problems,
> especially for projects with many distributed independent developers and
> for automation. This is one of the reasons I hope that GDPR exclusions
> would apply.
>
>
> >  - What kind of IP and license issues could this generate? For project
> > owners ? For users and service companies?
>
> Virtually none, I hope. GDPR should not affect code ownership in most
> cases, and virtually all exceptional situations where serious problems
> could arise should fall under GDPR exceptions.
>
>
> > I hope this will stay a joke, or that this is not a serious threat.
>
> One of the older open source projects I work on does get a constant
> trickle of removal requests. So far, they were mostly about mailing list
> postings rather than code submissions. I am sure there will be
> code-related metadata removal requests as well, so this is not just a
> joke. However, I hope that GDPR exceptions provide a reasonable defense
> against unreasonable demands to rewrite DVCS (e.g., git) history.
>
> IANAL. TINLA.
>
> Alex.
>
> _______________________________________________
> License-discuss mailing list
> License-discuss at lists.opensource.org
>
> http://lists.opensource.org/mailman/listinfo/license-discuss_lists.opensource.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensource.org/pipermail/license-discuss_lists.opensource.org/attachments/20180814/7a3ef482/attachment.html>