<div dir="ltr"><span style="color:rgb(46,46,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">It looks like GitLab is dealing with this with a waiver which you are required to agree to to log into your account. Adapted for OSM it reads:</span><div><span style="color:rgb(46,46,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br>As part of my voluntary contribution to OpenStreetMap, I acknowledge and agree that my username and any geographic data I edit will become embedded and part of the OpenStreetMap data, which may be publicly available. I understand the removal of this information would be impermissibly destructive to the project and the interests of all those who contribute, utilize, and benefit from it. Therefore, in consideration of my participation in any project, I hereby waive any right to request any erasure, removal, or rectification of this information under any applicable privacy or other law and acknowledge and understand that providing this information is a requirement under the agreement to contribute to OpenStreetMap.</span><br></div><div><span style="color:rgb(46,46,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(46,46,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">I don't know how they plan to deal with users who choose not to agree, but at least it shows how other organisations are dealing with this.</span></div><div class="gmail_extra"><br><div class="gmail_quote">On 21 April 2018 at 18:14, Simon Poole <span dir="ltr"><<a href="mailto:simon@poole.ch" target="_blank">simon@poole.ch</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>This is going off a bit on a tangent, to restate: we are -not-
proposing to go back to every contributor and get explicit consent
from them. <br>
</p>
<p>Besides the already mentioned issues in actually reaching out to
them, it wouldn't solve anything, as lawful processing based on
consent by the data subjects is the rabbit hole of problems that
we are trying to avoid.</p>
<p>What we will likely do is get everybody using the website and the
API to re-read a revised privacy policy and agree to ToU that
point out the obligations from the GDPR.</p><span class="HOEnZb"><font color="#888888">
<p>Simon<br>
</p></font></span><div><div class="h5">
<br>
<div class="m_5769230812155167802moz-cite-prefix">Am 21.04.2018 um 06:28 schrieb Andrew
Harvey:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr" style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">
<div class="gmail_quote">
<div>The OSMF mission statement includes "protecting the OSM
database, and making it available to all". Usernames and
timestamps of edits are an important part of the OSM
database, ensuring OSM is truly is an open and transparent
about the edits that have taken place and when and where
these came from. I feel it's the OSMF's role to do
everything possible to continue to make the OSM database
available to all and not redact part of that database from
the public feeds/dumps.</div>
<div><br>
</div>
<div>> <span style="font-size:12.8px">Second, I don't
have the exact stats, but I believe with the license
change some 30% of mappers could not be reached. That is
a *lot* of metadata that would be affected. My view is
that it is important for OSM to maintain this metadata
so that it can be referenced by DWG in future
investigations, even if the metadata is treated
confidentially. Additionally, sending out all those
emails and tracking check-ins is logistically quite
difficult. Given OSM's purposes, which really are in the
public interest, I think a legitimate interests basis is
on balance a better fit.</span></div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div>Even if we won't get 100% of historical edits to accept
new terms, at least we can ensure a significant proportion
of historical and all future edits agree to new terms.
Again, this is only worst case scenario if we need new
terms to publish usernames and timestamps of historical
edits.</div>
<div><br>
</div>
<div>I do wonder what other orgs are doing. OSM seems no
different to different to Wikimedia where the time and
username or IP of your edits are made public, or Twitter
where if you choose to post a geotagged tweet, your
location, username and timestamp are made public.</div>
</div>
</div>
<span class="m_5769230812155167802gmail-im" style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">
<div dir="ltr">
<div class="gmail_quote">
<div> </div>
</div>
</div>
</span><br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 21 April 2018 at 14:12, Heather
Leson <span dir="ltr"><<a href="mailto:heatherleson@gmail.com" target="_blank">heatherleson@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto">Hi folks that for this conversation.
<div dir="auto"><br>
</div>
<div dir="auto">To some of Rob's questions:</div>
<div dir="auto"><br>
</div>
<div dir="auto">Yes, let's create an exec summary and an
faq wiki page to help the clarity.</div>
<div dir="auto"><br>
</div>
<div dir="auto">In addition to Kathleen's input, Simon and
I also got probono review from the Brussels Privacy Hub
and a lawyer from Cisco.</div>
<span class="m_5769230812155167802HOEnZb"><font color="#888888">
<div dir="auto"><br>
</div>
<div dir="auto">Heather </div>
</font></span></div>
<div class="m_5769230812155167802HOEnZb">
<div class="m_5769230812155167802h5"><br>
<div class="gmail_quote">
<div dir="ltr">On Sat, 21 Apr 2018, 02:13 Rob
Nickerson, <<a href="mailto:rob.j.nickerson@gmail.com" target="_blank">rob.j.nickerson@gmail.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div>
<div>Thanks Simon. Lots of work has obviously
gone in to this so a big thank you (and the
LWG) for your time.<br>
<br>
</div>
<div>Three questions/comments:<br>
</div>
<ol>
<li>It's quite a long document so would
benefit from a Exec Summary if time permits.</li>
<li>I'm interested in who you have engaged
with as we are clearly not the only company
affected. In addition to the "professional <span class="m_5769230812155167802m_-4872100211618601288m_-5308604041782645298gmail-highlight m_5769230812155167802m_-4872100211618601288m_-5308604041782645298gmail-selected">couns</span>el"
have we reached out to similar groups to the
OSMF - for example WikiMedia and maybe the
Open Data Institute?</li>
<li>I understand that GDPR does not stop
companies from using/processing data
(business as usual activities) internally
and it does not stop them sharing it with a
third party under standard business
contracting. Rather it is setting the rules
of the game - or more precisely creating a
common standard across the EU (the UK has
had a Data Protection Act for many years
now). As such OSMF can continue to
use/process the full dataset, but as we know
OSMF company is small with no full time
employees. Their hands off approach to date
has allowed for an ecosystem to grow around
OSM. In the new GDPR world, OSMF will be
forced to make more decisions as to which
parties can be handed the full dataset
("processors"/"third parties" in GDPR speak
if I have understood it correctly). Do we
know how OSMF intend to manage this? Will
OSMF now be in a position where it has to
formally commission/contract out research
projects if we want to analyse user stats to
better understand our member diversity (as
an example)?<br>
</li>
</ol>
<p>That last question is probably one for the
OSMF Board and is a reflection that their
hand's off style may have to change in light
of GDPR - unless of course they decide that
nobody should get the complete data.<br>
</p>
</div>
<div class="gmail_extra">Thank you,<br>
<br clear="all">
</div>
<div class="gmail_extra">
<div>
<div class="m_5769230812155167802m_-4872100211618601288m_-5308604041782645298gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr"><span style="color:rgb(0,0,255)"><b>Rob</b></span><br>
</div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On 17 April 2018 at
11:48, Simon Poole <span dir="ltr"><<a href="mailto:simon@poole.ch" rel="noreferrer" target="_blank">simon@poole.ch</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>On the 25th of May 2018 the <b><a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation" rel="mw:ExtLink noreferrer" target="_blank">General Data
Protection Regulation (GDPR)</a></b>
will enter in to force, this will likely
result in some changes in how
OpenStreetMap operates and distributes
its data.</p>
<p>The LWG has prepared a position paper
on the matter that has been reviewed by
data protection experts and in general
the approach to not rely on explicit
consent has been validated. It should be
noted that while the paper outlines our
approach, some of the details still need
to be determined. In particular the
future relationship with community and
third party data consumers that utilize
OSM meta-data and what will actually be
dropped/made less accessible of the data
listed in Appendix B.</p>
<p><a href="https://wiki.openstreetmap.org/wiki/File:GDPR_Position_Paper.pdf" rel="mw:ExtLink noreferrer" target="_blank">LWG
GDPR Position Paper</a></p>
<p>Please feel free to discuss on the <a href="https://wiki.openstreetmap.org/wiki/Talk:GDPR" rel="noreferrer" target="_blank">talk
page</a> or on this list.</p>
<span class="m_5769230812155167802m_-4872100211618601288m_-5308604041782645298HOEnZb"><font color="#888888">
<p>Simon<br>
</p>
</font></span></div>
<br>
______________________________<wbr>_________________<br>
osmf-talk mailing list<br>
<a href="mailto:osmf-talk@openstreetmap.org" rel="noreferrer" target="_blank">osmf-talk@openstreetmap.org</a><br>
<a href="https://lists.openstreetmap.org/listinfo/osmf-talk" rel="noreferrer noreferrer" target="_blank">https://lists.openstreetmap.or<wbr>g/listinfo/osmf-talk</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
______________________________<wbr>_________________<br>
osmf-talk mailing list<br>
<a href="mailto:osmf-talk@openstreetmap.org" rel="noreferrer" target="_blank">osmf-talk@openstreetmap.org</a><br>
<a href="https://lists.openstreetmap.org/listinfo/osmf-talk" rel="noreferrer noreferrer" target="_blank">https://lists.openstreetmap.or<wbr>g/listinfo/osmf-talk</a><br>
</blockquote>
</div>
</div>
</div>
<br>
______________________________<wbr>_________________<br>
osmf-talk mailing list<br>
<a href="mailto:osmf-talk@openstreetmap.org" target="_blank">osmf-talk@openstreetmap.org</a><br>
<a href="https://lists.openstreetmap.org/listinfo/osmf-talk" rel="noreferrer" target="_blank">https://lists.openstreetmap.or<wbr>g/listinfo/osmf-talk</a><br>
<br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="m_5769230812155167802mimeAttachmentHeader"></fieldset>
<br>
<pre>______________________________<wbr>_________________
osmf-talk mailing list
<a class="m_5769230812155167802moz-txt-link-abbreviated" href="mailto:osmf-talk@openstreetmap.org" target="_blank">osmf-talk@openstreetmap.org</a>
<a class="m_5769230812155167802moz-txt-link-freetext" href="https://lists.openstreetmap.org/listinfo/osmf-talk" target="_blank">https://lists.openstreetmap.<wbr>org/listinfo/osmf-talk</a>
</pre>
</blockquote>
<br>
</div></div></div>
<br>______________________________<wbr>_________________<br>
osmf-talk mailing list<br>
<a href="mailto:osmf-talk@openstreetmap.org">osmf-talk@openstreetmap.org</a><br>
<a href="https://lists.openstreetmap.org/listinfo/osmf-talk" rel="noreferrer" target="_blank">https://lists.openstreetmap.<wbr>org/listinfo/osmf-talk</a><br>
<br></blockquote></div><br></div></div>