[OSM-talk] HDYC, login requirement and "privacy"

[Christoph Hormann]

On Friday 05 May 2017, Frederik Ramm wrote:
>
> I think that a viable middle ground could be to make user data
> available to signed-up project members only, and they'd have to
> promise to only use that data for project-internal purposes.

You know i have not formed an opinion on this matter yet but i wonder 
how this is supposed to work.  Do you suggest to have an addition to 
the contributor terms, kind of a 'terms for access to metadata' and 
require existing users to newly agree to that?  And after a transit 
period disable api access for those accounts who have not agreed?

In principle that would certainly be possible although there are tons of 
practical problems that would come with such an approach.  But 
ultimately this would probably lead to the vast majority of people who 
routinely get mapping metadata in bulk for whatever purpose to use 
anonymous accounts for downloading it and to also publish possibly 
problematic results of processing it in an anonymous way.  Under this 
scenario there would probably be some open source HDYC clone, you could 
run it either privately for yourself, use an access restricted 
officially sanctioned instance of it with your real or anonymous OSM 
account or use some rouge open instance running anonymiously somewhere.

For a balanced discussion - and i am not saying i would actually prefer 
this approach to what you are suggesting - the whole problem could also 
be approached from the other side by reconsidering the possibility for 
partly anonymous edits.  We don't have this primarily to fight 
vandalism but it could be considered to give mappers the option to 
activate an anonymous editing mode on their account which would mean 
their edits and any other access to their user identity through for 
example the API gets scrambled on a daily basis and resolution of the 
generated random id to the real user is only available to the DWG.  
This would certainly also generate tons of problems but i think it is 
important to keep this possibility in mind when considering the matter 
of privacy.

> Hence, 
> anyone with an OSM account could make such an animated progress map,
> and it could be shown to anyone with an OSM account. Only if you want
> to distribute it outside of OSM you'd either have to
> remove/pseudonymize the user names [...]

That part is really tricky, you'd have to be very specific on what kind 
of aggregation is necessary to make the data ok to be published.  
Obviously just replacing each user name with user<hash_value> is not 
going to cut it.  Without clear rules here anyone who publishes 
anything based on such data would be in a legal mine field.

-- 
Christoph Hormann
http://www.imagico.de/