[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

GDPR and CVE

So I had someone request their PII (email address) be removed from the CVE Terms of Use acceptance data I have for DWF, luckily there's no CVE associated with the address (I think it turned out to be an invalid request). 

But this does raise the question, under GDPR, even with positive affirmation (e.g. they filled out the form, then replied to an email) they would still be within their rights (as I understand GDPR) to then request at a later date that we remove their PII from the system. 

Which... let's be honest, we can't really do, because git, we can "remove" it but it still exists in previous branches/etc. And short of rolling git back in time to before that info existed, re-applying all the other changes and so on... and then having every fork go bonkers... 

So in short I think we need to ensure we have some legal/privacy language that makes it REALLY clear that once they submit their data and it gets into git (e.g. a CVE request) that we cannot remove it fully, and I'm not sure, but can we disclaim that we will remove it at all (I don't know enough about the internals of GDPR/how exactly it is interpreted). 


--
Kurt Seifried
kurt@seifried.org
Page Last Updated or Reviewed: March 09, 2018