<div dir="ltr"><span style="color:rgb(46,46,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">It looks like GitLab is dealing with this with a waiver which you are required to agree to to log into your account. Adapted for OSM it reads:</span><div><span style="color:rgb(46,46,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br>As part of my voluntary contribution to OpenStreetMap, I acknowledge and agree that my username and any geographic data I edit will become embedded and part of the OpenStreetMap data, which may be publicly available. I understand the removal of this information would be impermissibly destructive to the project and the interests of all those who contribute, utilize, and benefit from it. Therefore, in consideration of my participation in any project, I hereby waive any right to request any erasure, removal, or rectification of this information under any applicable privacy or other law and acknowledge and understand that providing this information is a requirement under the agreement to contribute to OpenStreetMap.</span><br></div><div><span style="color:rgb(46,46,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(46,46,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">I don't know how they plan to deal with users who choose not to agree, but at least it shows how other organisations are dealing with this.</span></div><div class="gmail_extra"><br><div class="gmail_quote">On 21 April 2018 at 18:14, Simon Poole <span dir="ltr"><<a href="mailto:simon@poole.ch" target="_blank">simon@poole.ch</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div text="#000000" bgcolor="#FFFFFF">
    <p>This is going off a bit on a tangent, to restate: we are -not-
      proposing to go back to every contributor and get explicit consent
      from them. <br>
    </p>
    <p>Besides the already mentioned issues in actually reaching out to
      them, it wouldn't solve anything, as lawful processing based on
      consent by the data subjects is the rabbit hole of problems that
      we are trying to avoid.</p>
    <p>What we will likely do is get everybody using the website and the
      API to re-read a revised privacy policy and agree to ToU that
      point out the obligations from the GDPR.</p><span class="HOEnZb"><font color="#888888">
    <p>Simon<br>
    </p></font></span><div><div class="h5">
    <br>
    <div class="m_5769230812155167802moz-cite-prefix">Am 21.04.2018 um 06:28 schrieb Andrew
      Harvey:<br>
    </div>
    <blockquote type="cite">
      <div dir="ltr">
        <div dir="ltr" style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">
          <div class="gmail_quote">
            <div>The OSMF mission statement includes "protecting the OSM
              database, and making it available to all". Usernames and
              timestamps of edits are an important part of the OSM
              database, ensuring OSM is truly is an open and transparent
              about the edits that have taken place and when and where
              these came from. I feel it's the OSMF's role to do
              everything possible to continue to make the OSM database
              available to all and not redact part of that database from
              the public feeds/dumps.</div>
            <div><br>
            </div>
            <div>> <span style="font-size:12.8px">Second, I don't
                have the exact stats, but I believe with the license
                change some 30% of mappers could not be reached. That is
                a *lot* of metadata that would be affected. My view is
                that it is important for OSM to maintain this metadata
                so that it can be referenced by DWG in future
                investigations, even if the metadata is treated
                confidentially. Additionally, sending out all those
                emails and tracking check-ins is logistically quite
                difficult. Given OSM's purposes, which really are in the
                public interest, I think a legitimate interests basis is
                on balance a better fit.</span></div>
            <div><span style="font-size:12.8px"><br>
              </span></div>
            <div>Even if we won't get 100% of historical edits to accept
              new terms, at least we can ensure a significant proportion
              of historical and all future edits agree to new terms.
              Again, this is only worst case scenario if we need new
              terms to publish usernames and timestamps of historical
              edits.</div>
            <div><br>
            </div>
            <div>I do wonder what other orgs are doing. OSM seems no
              different to different to Wikimedia where the time and
              username or IP of your edits are made public, or Twitter
              where if you choose to post a geotagged tweet, your
              location, username and timestamp are made public.</div>
          </div>
        </div>
        <span class="m_5769230812155167802gmail-im" style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">
          <div dir="ltr">
            <div class="gmail_quote">
              <div> </div>
            </div>
          </div>
        </span><br>
      </div>
      <div class="gmail_extra"><br>
        <div class="gmail_quote">On 21 April 2018 at 14:12, Heather
          Leson <span dir="ltr"><<a href="mailto:heatherleson@gmail.com" target="_blank">heatherleson@gmail.com</a>></span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div dir="auto">Hi folks that for this conversation.
              <div dir="auto"><br>
              </div>
              <div dir="auto">To some of Rob's questions:</div>
              <div dir="auto"><br>
              </div>
              <div dir="auto">Yes, let's create an exec summary and an
                faq wiki page to help the clarity.</div>
              <div dir="auto"><br>
              </div>
              <div dir="auto">In addition to Kathleen's input, Simon and
                I also got probono review from the Brussels Privacy Hub
                and a lawyer from Cisco.</div>
              <span class="m_5769230812155167802HOEnZb"><font color="#888888">
                  <div dir="auto"><br>
                  </div>
                  <div dir="auto">Heather </div>
                </font></span></div>
            <div class="m_5769230812155167802HOEnZb">
              <div class="m_5769230812155167802h5"><br>
                <div class="gmail_quote">
                  <div dir="ltr">On Sat, 21 Apr 2018, 02:13 Rob
                    Nickerson, <<a href="mailto:rob.j.nickerson@gmail.com" target="_blank">rob.j.nickerson@gmail.com</a>>
                    wrote:<br>
                  </div>
                  <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                    <div dir="ltr">
                      <div>
                        <div>Thanks Simon. Lots of work has obviously
                          gone in to this so a big thank you (and the
                          LWG) for your time.<br>
                          <br>
                        </div>
                        <div>Three questions/comments:<br>
                        </div>
                        <ol>
                          <li>It's quite a long document so would
                            benefit from a Exec Summary if time permits.</li>
                          <li>I'm interested in who you have engaged
                            with as we are clearly not the only company
                            affected. In addition to the "professional <span class="m_5769230812155167802m_-4872100211618601288m_-5308604041782645298gmail-highlight m_5769230812155167802m_-4872100211618601288m_-5308604041782645298gmail-selected">couns</span>el"
                            have we reached out to similar groups to the
                            OSMF - for example WikiMedia and maybe the
                            Open Data Institute?</li>
                          <li>I understand that GDPR does not stop
                            companies from using/processing data
                            (business as usual activities) internally
                            and it does not stop them sharing it with a
                            third party under standard business
                            contracting. Rather it is setting the rules
                            of the game - or more precisely creating a
                            common standard across the EU (the UK has
                            had a Data Protection Act for many years
                            now). As such OSMF can continue to
                            use/process the full dataset, but as we know
                            OSMF company is small with no full time
                            employees. Their hands off approach to date
                            has allowed for an ecosystem to grow around
                            OSM. In the new GDPR world, OSMF will be
                            forced to make more decisions as to which
                            parties can be handed the full dataset
                            ("processors"/"third parties" in GDPR speak
                            if I have understood it correctly). Do we
                            know how OSMF intend to manage this? Will
                            OSMF now be in a position where it has to
                            formally commission/contract out research
                            projects if we want to analyse user stats to
                            better understand our member diversity (as
                            an example)?<br>
                          </li>
                        </ol>
                        <p>That last question is probably one for the
                          OSMF Board and is a reflection that their
                          hand's off style may have to change in light
                          of GDPR - unless of course they decide that
                          nobody should get the complete data.<br>
                        </p>
                      </div>
                      <div class="gmail_extra">Thank you,<br>
                        <br clear="all">
                      </div>
                      <div class="gmail_extra">
                        <div>
                          <div class="m_5769230812155167802m_-4872100211618601288m_-5308604041782645298gmail_signature" data-smartmail="gmail_signature">
                            <div dir="ltr">
                              <div>
                                <div dir="ltr"><span style="color:rgb(0,0,255)"><b>Rob</b></span><br>
                                </div>
                              </div>
                            </div>
                          </div>
                        </div>
                        <br>
                        <div class="gmail_quote">On 17 April 2018 at
                          11:48, Simon Poole <span dir="ltr"><<a href="mailto:simon@poole.ch" rel="noreferrer" target="_blank">simon@poole.ch</a>></span>
                          wrote:<br>
                          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                            <div text="#000000" bgcolor="#FFFFFF">
                              <p>On the 25th of May 2018 the <b><a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation" rel="mw:ExtLink noreferrer" target="_blank">General Data
                                    Protection Regulation (GDPR)</a></b>
                                will enter in to force, this will likely
                                result in some changes in how
                                OpenStreetMap operates and distributes
                                its data.</p>
                              <p>The LWG has prepared a position paper
                                on the matter that has been reviewed by
                                data protection experts and in general
                                the approach to not rely on explicit
                                consent has been validated. It should be
                                noted that while the paper outlines our
                                approach, some of the details still need
                                to be determined. In particular the
                                future relationship with community and
                                third party data consumers that utilize
                                OSM meta-data and what will actually be
                                dropped/made less accessible of the data
                                listed in Appendix B.</p>
                              <p><a href="https://wiki.openstreetmap.org/wiki/File:GDPR_Position_Paper.pdf" rel="mw:ExtLink noreferrer" target="_blank">LWG
                                  GDPR Position Paper</a></p>
                              <p>Please feel free to discuss on the <a href="https://wiki.openstreetmap.org/wiki/Talk:GDPR" rel="noreferrer" target="_blank">talk
                                  page</a> or on this list.</p>
                              <span class="m_5769230812155167802m_-4872100211618601288m_-5308604041782645298HOEnZb"><font color="#888888">
                                  <p>Simon<br>
                                  </p>
                                </font></span></div>
                            <br>
                            ______________________________<wbr>_________________<br>
                            osmf-talk mailing list<br>
                            <a href="mailto:osmf-talk@openstreetmap.org" rel="noreferrer" target="_blank">osmf-talk@openstreetmap.org</a><br>
                            <a href="https://lists.openstreetmap.org/listinfo/osmf-talk" rel="noreferrer noreferrer" target="_blank">https://lists.openstreetmap.or<wbr>g/listinfo/osmf-talk</a><br>
                            <br>
                          </blockquote>
                        </div>
                        <br>
                      </div>
                    </div>
                    ______________________________<wbr>_________________<br>
                    osmf-talk mailing list<br>
                    <a href="mailto:osmf-talk@openstreetmap.org" rel="noreferrer" target="_blank">osmf-talk@openstreetmap.org</a><br>
                    <a href="https://lists.openstreetmap.org/listinfo/osmf-talk" rel="noreferrer noreferrer" target="_blank">https://lists.openstreetmap.or<wbr>g/listinfo/osmf-talk</a><br>
                  </blockquote>
                </div>
              </div>
            </div>
            <br>
            ______________________________<wbr>_________________<br>
            osmf-talk mailing list<br>
            <a href="mailto:osmf-talk@openstreetmap.org" target="_blank">osmf-talk@openstreetmap.org</a><br>
            <a href="https://lists.openstreetmap.org/listinfo/osmf-talk" rel="noreferrer" target="_blank">https://lists.openstreetmap.or<wbr>g/listinfo/osmf-talk</a><br>
            <br>
          </blockquote>
        </div>
        <br>
      </div>
      <br>
      <fieldset class="m_5769230812155167802mimeAttachmentHeader"></fieldset>
      <br>
      <pre>______________________________<wbr>_________________
osmf-talk mailing list
<a class="m_5769230812155167802moz-txt-link-abbreviated" href="mailto:osmf-talk@openstreetmap.org" target="_blank">osmf-talk@openstreetmap.org</a>
<a class="m_5769230812155167802moz-txt-link-freetext" href="https://lists.openstreetmap.org/listinfo/osmf-talk" target="_blank">https://lists.openstreetmap.<wbr>org/listinfo/osmf-talk</a>
</pre>
    </blockquote>
    <br>
  </div></div></div>

<br>______________________________<wbr>_________________<br>
osmf-talk mailing list<br>
<a href="mailto:osmf-talk@openstreetmap.org">osmf-talk@openstreetmap.org</a><br>
<a href="https://lists.openstreetmap.org/listinfo/osmf-talk" rel="noreferrer" target="_blank">https://lists.openstreetmap.<wbr>org/listinfo/osmf-talk</a><br>
<br></blockquote></div><br></div></div>