2

I'm extracting a sub-dataset from the GH Archive dataset. The GH Archive dataset, I quote, "includes material that may be subject to third party rights."

In my sub-dataset, I never extract "contents" (file contents, commit messages...), only metadata. Here's the exhaustive list of stuff I currently extract:

  • repository name,
  • repository metadata such as stars count, forks count, watchers count,
  • commit author(s), i.e. their github login,
  • commit created_at datetime

Under what license can I offer my sub-dataset? For example, would I be able to commercially sell this data?

As a follow-up, same question but for this additional data:

  • user email (if available), user bio, user city/country, user company.

Is there any place I can get official licensing information for this type of data?

Improve this question
2
  • 2
    I'm quite sure that you will not have the right to gather, store or distribute user e-mail, bio, country and company information under GDPR. You have no consent of the party to both store, aggregate and distribute those private information and you might become eligible to nice fines. Additionally you might also violate GitHub TOS and become liable to damages there, too (dunno, check them!)
    – planetmaker
    May 17, 2021 at 14:38
  • Good point, makes sense for user info. Just had a look at the TOS, I could find the mention that GH owns IP of all their own content docs.github.com/en/github/site-policy/…, but not sure if repo/commit metadata falls into that category.
    – johnnewman
    May 17, 2021 at 14:54

2 Answers 2

Reset to default
1

You don’t need one. (Probably. I’m just a language lawyer, not a regular lawyer.)

GitHub is a US company, and since you didn’t use the spelling ‘licence’, I assume you are US-based as well, so I’m going to work with the assumption that only US law applies. Under this assumption, it’s probably safe to assume that those metadata are in the public domain, you don’t need a license for them, and you cannot license them to anyone else yourself under copyright law. If you included things like contents of commits or user avatars, those may be potentially copyrightable, but mere names, dates and addresses are not.

The reason for this is that under the US legal tradition, copyright has been applicable only to results of creative effort, and not to mere collections of otherwise uncopyrightable information, however large. The relevant clause of the US Constitution that enables the creation of copyright and patent laws only authorises it to ‘promote the Progress of Science and useful Arts’; a more direct legal justification is the court case Feist v. Rural, which established that mere aggregation of data does not create copyrightability. The US also does not recognise sui generis database rights in a way that some other jurisdictions (especially those in the EU) do.

That said, other kinds of laws and agreements may still be applicable. The Open Database License, for example, attempts to implement copyleft-like provisions under contract law. There are some important differences from copyright law, however: the most important is that you can’t force someone to follow a contract they haven’t agreed to. If you share information with A under a contract, and A shares that information with B, there is little you can do to compel B to respect the contract.

There may also be privacy laws that apply, but which I have not touched upon above at all. Because this data set is based on already-public information, their applicability seems rather doubtful to me, but I would still consult a real expert to be sure.

Improve this answer
2
  • 1
    "Only US law applies"... as long as nobody mentioned by name is European, or the data collected end up in some other jurisdiction, or... The 'net (and Github in particular) have world-wide reach. You can't just assume the jurisdiction of your corner of the world.
    – vonbrand
    May 20, 2021 at 2:12
  • @vonbrand European law doesn't apply just because a European is mentioned. I'd point out that most people do assume their local jurisdiction, and e.g. Saudi law on men and women working together or various countries' laws on maps (usually contradictory) are often ignored, as are differences in copyright law.
    – prosfilaes
    Sep 1, 2022 at 18:52
0

That is something to take up with the data's owners (github folks, in this case). You also have to consider third party rights, and privacy concerns (as noted by @planetmaker's comment).

In any case, the ramblings of random dudes on the 'net should never be taken as authoritative answers until checked carefully.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.