[OSM-dev] Working with OSM data with less or no metadata

[Simon Poole]

Am 16.02.2018 um 14:24 schrieb Martin Koppenhoefer:
>
>
> I don't share the interpretation that OSMF processes personal data
> (besides the e-mail addresses and maybe IP addresses used by its
> contributors, which are neither distributed nor public), because I
> don't think that our mappers can be identified with the data and
> metadata of their contributions. I.E. they are not identifiable
> natural persons because they cannot be identified, directly or
> indirectly.

Naturally we have the case of the licence change which proved the exact
opposite.

But that doesn't matter in any case as the GDPR does not require that
what qualifies as personal data be directly associated with an
individual by personal name (which seems to be what you are thinking
of), I quote "an identifiable natural person is one who can be
identified, directly or indirectly, in particular by reference to an
identifier such as a name, an identification number, location data, an
online identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of
that natural person;"
> Yes, if you know who they are you can see what they did, but you
> cannot see from what they did who they are. At best you can guess, but
> it only works if you have additional information that the person (or
> someone else) would have to provide you with. What we have according
> to these definitions is "pseudonymisation" (because OSMF has the
> sign-up e-mail address associated with the user number, and is
> therefor in a position to make personal data from the contributions).
>
> If someone tries to reverse the pseudonymisation of our contributor's
> data and metadata, it would be this person to be in breach of the law.

Pseudonymisation is one of the data protection safe guards proposed by
the GDPR, use of it does not make the data itself less "Personal Data"
see Recital 26 /"Personal data which have undergone
//pseudonymisation//, which could be attributed to a natural person by
the use of additional information should be considered to be information
on an identifiable natural person". /, it just may make some processing
possible of such data that otherwise would not be permissible.

>
> An exception might occur in very rare cases in areas where the
> contributor is the only person being there within a big distance, i.e.
> extremely remote areas, and probably not in the European Union.

Again, see above, we know first hand how many of our contributors can be
identified alone from display name, location of initial edits, other
hints and so on. Not quite sure why you are in denial about this as you
were present when that took place.

Simon

>
> For reference,
>
> General Data Protection Regulation
> https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en
>
>
> Cheers,
> Martin

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/dev/attachments/20180216/38e8c9d6/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openstreetmap.org/pipermail/dev/attachments/20180216/38e8c9d6/attachment.sig>