2

The General Data Protection Regulation that is about to come into effect in the EU appears to impose requirements to (among others) anyone who runs a website of public interest. As some of these requirements are difficult to fulfil for projects developed during people's spare time without any revenue (e.g. getting legal counsel for a legally watertight privacy policy text, getting webspace and an e-mail inbox whose providers agree to sign processing agreements1, etc.), this might prevent EU-based FOSS projects from having a website aside from the default project profile pages on Github and the like2.

Have there been any statements by the people or institutions behind the GDPR on what the expected effect on open source software projects will be (e.g. the described issues are an intended/unintended side effect, the issues won't occur because ..., they consider the issues irrelevant, ...)?


1: Also see: Contract necessary for the most basic processing under GPDR? on Law SE

2: Note that I'm not referring to the few high-profile projects out there that are backed by foundations and such.

3

The GDPR applies when processing personal data. The solution for open source projects: Don't process personal data. A static website without any analytics does not perform meaningful processing of personal data.

If you as a project maintainer are still concerned about this, write a short privacy policy that personal data such as IP addresses are processed for the sole purpose of displaying the site, and sign a data processing agreement with your hoster. Currently, I can't find any indication that GitHub or GitLab offer a DPA, but many EU-based hosters do.

If you do process any data, then of course the GDPR applies even for hobby projects. The point of the law is to protect personal data, not to punish businesses. And aside from this initial panic, compliance does not take much effort when not processing personal data.

From the GDPR perspective, accepting pull requests into a git repo is much more problematic, since the blockchain-nature of git makes it impossible to delete or correct personal information (such as author name and email addresses) afterwards. However, this is not necessarily in violation if you obtain prior informed consent from contributors.

  • Very insightful, thank you. Interestingly, the first paragraph of the answers appears to contradict everything I have read about GDPR in German. The consensus among German articles on the topic seems to be that the requirement to provide a GDPR-conformant privacy policy applies to virtually all websites, and as virtually all web hosters do at least temporarily log IP addresses, there is invariably some relevant processing of personal data. Furthermore, as soon as someone sends an e-mail related to your website to the address stated there, that's more personal data whose GDPR-conformant ... – O. R. Mapper May 5 '18 at 11:45
  • ... handling you have to ensure and declare in the privacy policy. Do you have any references or analyses that back up this opposing view your answer presents (in particular by the parties involved in defining GDPR, to also match with my original question)? In any case, the takeaway from your second paragraph seems to be that EU-based open source project maintainers should use the U.S.-based open source sites only for the integrated tools such as VCS and bug trackers, and move their self-designed websites to an EU-based hoster that provides a DPA. – O. R. Mapper May 5 '18 at 11:49
  • @O.R.Mapper My answer is largely based on original research. I don't think it presents an opposing view. No, I have not looked for statements. Note that the data protection authorities will have their hands full dealing with actual violations. I don't forsee a regulatory clampdown on benign open source projects that just don't have their papers in order. Consider also that the German BDSG is generally equivalent or stricter than the GDPR, yet no such enforcement has happened against German FLOSS projects. – amon May 6 '18 at 18:53
  • The GDPR could be reduced to absurdity that every router on the internet would have to provide you a privacy policy because they temporarily process your IP address & packet contents. However, that seems unworkable given the technically reality. So yes, under a strict interpretation every website that's subject to the GDPR must have a privacy policy, even if only to inform the user that no information whatsoever is logged but only processed temporarily. This would also require a DPA with the hoster. – amon May 6 '18 at 18:54
  • I wouldn't consider my personal email address to be subject to the GDPR (purely personal use, see Art. 2(2)(c)), even if I publish it through git commits to some project. – amon May 6 '18 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.