privacy compliance?

[acrymble]

I note that since we have started publishing laws have changed on privacy and the internet. In particular in the EU the GDPR regulations require greater care by organizations to keep personal information secure and to delete it upon request. In particular, I'm raising the possibility that our ph_authors.yml file may not be GDPR compliant.

Does anyone have GDPR training that can advise?

[drjwbaker]

I'm on the Research Ethics Group at Sussex so based on http://www.sussex.ac.uk/ogs/policies/information/dpa/processingdata we are processing (which includes holding) personal data lawfully:

1. We need the data in ph_authors.yml as part of our function (to inform readers who authors are).
2. The author has given us the data in ph_authors.yml with their consent (either by giving it to us or adding it themselves).
3. The data in ph_authors.yml does not contain 'special category data'.
4. We have no intention of using the data at ph_authors.yml for a purpose other than the purpose it was given to us. E.g. we aren't going to turn that data into a mailing list without authorization of the authors. This impacts Communication: Blogpost/Newsletter for June  #1288 (we can't just scrape that data into a mailing list, especially if any of the contact info is out of date or no longer online, see 5.).
5. The only ways I can see that we could be in non-compliance would be: i) we hold out of date information that an individual no longer wishes us to process (e.g. former employer, former name); ii) we hold information that has been taken offline for some reasons (e.g. an email address used to harass an individual was online and has now been removed from personal/institutional pages).

[acrymble]

Thanks for the interpretation @drjwbaker.

@mdlincoln is there any technical reason why we shouldn't try to remove unnecessary data, like email addresses or social media handles for non-team members?

[mdlincoln]

The only time we collect those data are for team members, so we could certainly remove it for former team members.

For former members, the only thing we display is institution, start date, and end date of their membership, so we don't need that extra email/contact info any more. (I'd suggest we probably don't need to display institution on that list since for many it'll almost certainly be out of date.)

[drjwbaker]

I think we are compliant then. This discussion and the archiving of it as an Issue should serve the purposes of showing that we have done our due diligence.