This raises an interesting question. If a GPDR request to delete personal data causes a removal of attribution required by a license, does that nuke the material too, despite it not being personal data itself
It's an appealing line of thought in the stackoverflow case, but not so much if I consider a GPDR request against say, Debian to remove all my contributions. I should not be able to retroactively destroy Debian.
@joeyh this is an interesting question, but I believe the answer in this case is trivial: the content itself cannot be removed. OTOH, any data built from CC-BY-SA data will require to be licensed under the same terms, so THAT's going to be more interesting
@joeyh@osma What I would wonder is whether copyright attribution counts as personal data in the sense that the GDPR cares about.
And, if it did, I would expect that withdrawing consent is irrelevant. Consent is not the only basis for holding/processing personal data under the GDPR. If there is a legal obligation to hold the data, for example, then the organisation can do so on that basis, and does not need to ask permission.
@benjamineskola
GDPR considers anything that identifies a person either alone or in combination with other data personal data that the subject herself can control (request a copy, demand deletion, etc). Attribution obviously requires a name. Name is personal data.
Consent doesn't even enter the picture. There are extremely few lawful basis for processing data after a data subject has demanded deletion - and "we want to keep this text so that we can resell it" certainly isn't one. @joeyh
@osma@joeyh Yes, “we want to resell it” is not a lawful basis — but the text is not the personal data. And if they are keeping the text, then “we need to keep the name so that we can properly attribute it as required by the licence” might be a lawful basis (legal obligation).
@benjamineskola
That's not how it works. GDPR trumps their wishes to retain my name, and if they can't retain my name, they can't attribute, and would be in violation of the license for the text. @joeyh
@osma I’m not sure why you think “GDPR trumps their wishes”. GDPR requires them to have a lawful basis. If they have a lawful basis they can continue to process the data.
GDPR doesn’t just mean a blanket right to withdraw consent under any circumstances, if there are valid reasons other than user consent to process the data.
If they had no lawful basis other than consent, then yes, withdrawal of consent would trump their wishes to continue using the data, but I don’t think it’s that simple.
@osma But they're not inventing a lawful basis. The privacy policy says that they will use personal data in order to 'comply with legal requirements’, which is one of the lawful bases for data processing under the GDPR. Correctly attributing copyrighted material and complying with licence requirements is a legal requirement, and so they're entitled to store and use personal data in order to do so.
@osma The real problem here, I think, is that they require users to grant a permanent and irrevocable copyright licence, and users have willingly done so, and are now discovering they have given away their right to decide whether StackOverflow may use their work. But I don't think you can use privacy law to solve it; it's a copyright problem.
@benjamineskola Apparently CC-BY has a provision that if I demand they remove my name, they can simply remove the attribution, but keep the content. This was opposite to what I was hoping for - but to your point; they have no defensible basis for keeping my name if I demand they remove it. https://en.osm.town/@pnorman/112418674306150379
@osma Yes, I think that’s correct. (In copyright terms I think you’d effectively be granting them an additional permission to publish the work without attribution.) You’re right that this isn’t an ideal solution though: it doesn’t force them to stop using the work as a whole. But if people simply want their name removed (perhaps so as not to be seen as endorsing it) then that’s an option.
@benjamineskola
Personally, I would rather have had the content retracted and my name left visible. Well, glad I never was a frequent contributor in the first place.
Add comment