Source: https://wiki.xmpp.org/web/index.php?title=GDPR&oldid=10086&diff=prev
Timestamp: 2019-07-19 22:39:55
Document Index: 368041147

Matched Legal Cases: ['art. 9', 'art. 6', 'art. 9', 'art. 9', 'Art. 9', 'art. 9', 'art. 9', 'art. 6', 'art. 9', 'art. 6']

Difference between revisions of "GDPR" - XMPP WIKI
Revision as of 15:51, 29 March 2018 (view source)
Revision as of 21:36, 29 March 2018 (view source)
m (→‎C2S:)
* User metadata:
** minimal: stored during connection
** typical: stored with account, spam detection, expose to other users (last activity)
** typical: stored with account, spam detection, expose to other users (presence, last activity)
* User content:
** minimal: roster/bookmarks with account, PEP in RAM only, offline messages until first client connects
Revision as of 21:36, 29 March 2018
3.1.5.1 C2S:
3.1.5.2 S2S:
7 Lawyer Questions
7.1 LQ1 user-sent content and art. 9.1
7.2 LQ2 transfer to other controller and art. 6.1b / 6.1f
Next meeting of the people involved is scheduled on April 6th 2018 at 13:15 CEST in xmpp:xsf@muc.xmpp.org
On may the 25th of 2018 the new EU General Data Protection Regulation (GDPR) will be enforced. This page is a growing page, collecting the research done on the consequences of the GDPR for XMPP and the XSF. There are three fields where the GDPR probably will have an impact and that will be of concert to the XSF:
timestamp of last available presence
Related articles: 6.1a, 6.1b, 9.1, 9.2a, 13.4, 13
What legal grounds for the processing are possible partly depends on the question whether user-sent content falls under art. 9.1 or not. We need legal advice here (See LQ1 below)
If user-sent data IS NOT subject to art. 9.1: Art. 9.1b can be used as ground for processing, so the permission is implicitly granted when signing up for the XMPP service. The EULA must then contain information about the information processed.
If user-sent data IS subject to art. 9.1: The ground for processing has to be art. 9.2, explicit consent.
Consent, as in article 6.1a or 9.2 is problematic as giving consent to other servers is harder and not widespread.
Can transfer to and processing by an other server also be covered by art. 6.1b? See LQ2 below. Also possibly relevant: 6.1f, see also https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/
Note by Winfried: we should here distinguish between the ground for the transfer to the other server itself and the ground for processing by the other server.
The processing of personal data to the extent strictly necessary and proportionate
It could be argued that storing very sensitive personal information, albeit for a short time, unencrypted, visible to anyone with access to the backend server (and perhaps more), does not constitute proportional data protection measure, knowing how sensitive the information can be in some cases. It could therefore also be argued, that the processing “reveals” this information to
unauthorized persons, by the way it is implemented. It could therefore be argued, that such processing is contrary to what is required by article 9.
Even with consent, "proportional means of protection" is required, so encryption (i.e., full-disk) might be necessary to check that box. If user-sent content is subject to art. 9.1, then the "proportional" from "proportional means of protection" becomes harder.
Article 35?
See recital 49:
Data should not be stored for more time than necessary.
I think what we *at the very minimum* learn from this given the technical means in the XMPP network is: you absolutely must not do any kind of data mining on message content which might come from federation.
Read chapter 5 about transfer of personal data
Note by Winfried: see also discussion about art. 6.1f above. Maybe we should rephrase this question.
Retrieved from "https://wiki.xmpp.org/web/index.php?title=GDPR&oldid=10086"