<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>I would appreciate a more complete answer to Brian’s question. GDPR and CCPA deal with “personal information” under statutory authority in various jurisdictions. Neither relies on copyright law to control access to or use of personal information. So is CAL relying only on contractual law stated in the license agreement to provide restrictions on the use or distribution of such data? Where is the constitutional or statutory authority to control <b>data</b> used by a copyrighted or patented work of software? Is this in principle like the attempt of software licenses to control the uses of APIs? Both may be an overreach. Strong wishes and heartfelt goals may not be sufficient authority to do something with intellectual “property,” if property it actually is short of trade secrets or personal information.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This reveals how little I understand about this topic and about CAL.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>/Larry<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b>From:</b> License-review <license-review-bounces@lists.opensource.org> <b>On Behalf Of </b>VanL<br><b>Sent:</b> Thursday, February 13, 2020 12:03 PM<br><b>To:</b> License submissions for OSI review <license-review@lists.opensource.org><br><b>Subject:</b> Re: [License-review] For approval: The Cryptographic Autonomy License (Beta 4)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi Brian,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On Thu, Feb 13, 2020 at 1:56 PM Brian Behlendorf <<a href="mailto:brian@behlendorf.com">brian@behlendorf.com</a>> wrote:<o:p></o:p></p><p class=MsoNormal><br>Has anyone considered the PII and GDPR/CCPA/etc implications of the CAL? <br>Could there be scenarios where the CAL requires behavior that the GDPR <br>prevents?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The CAL was written with particular care to be compatible with the GDPR and CCPA, and carefully use similar language. In fact, the first version had a interpretive aid specifying that complying with specific paragraphs of the GDPR would also result in a compliant delivery of user data under the CAL. That paragraph was removed due to misunderstandings about its effects, but it is still true.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<br>Van<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>