On Thu, 2007-02-15 at 08:20 +0100, Ralf Corsepius wrote: > Firstly, please note that I said "questionable", i.e. would have to > carefully examined by a specialized lawyer. > > Secondly you should be aware that is actually is about two separate > issue: "Legality and correctness" > > On the legal side, it is "Schutz der Privatsphäre" (Protection of > private sphere") in general, a legally complicated matter with many > booby-traps hidden inside. > > > In Germany, even "collecting data without prior consent" in many cases > is considered illegal. E.g. there had been a precedence in which someone > having set up a webcam monitoring his house's front yard has been > considered illegal for breach of privacy. It's the reason why most shops > using camera supervision nowadays have signs explicitly notifying their > customers. There is prior consent. The information is not transmitted until the user consents and it defaults to NOT transmitting. > Things become further complicated when personalized data comes into play > (BDSG - Bundesdatenschutzgesetz - "Federal Law on Data Privacy"). > The crucial points here would be "when to consider data personalized" > and "which data is allowed to be collected under which circumstances". > > Rule of thumb: Any personalized data must not be collected unless it is > technically required for a transaction (Classic example: Any bill must > be removed from cashier systems after the customer has paid, within a > predefined timeframe). > > I.e. from a German point of view. Smolt's "machine id" in connection > with the IP address needs to be legally reviewed if this qualifies as > "personalized data". I for one regard it as such. > but there is no requirement that this data be transmitted. In fact, in the default case that smolt is configured for - it is not transmitted. and in order to use the system you need not transmit it. If I ask you for your name and you choose not to give it have I committed a crime by asking and giving you the option of giving me the information? Of course not. can you imagine what a law that made that illegal would look like? > IANAL, too, but, yes this matches with my knowledge. I repeatedly said, > to be legally safe in Germany, any such transaction must be opt-in (I am > aware this not to be 100% legally correct, but it's the "rule of thumb > to be safe"). and we are safe in that regard. smolt is opt-in. > The other point is "is it correctlyness" to transmit such data: > We're giving the user the choice to send this data or not. We default to NOT sending this information. How much more correct can you get? > Ask yourself: If you were an administration/government/military > organisation, an enterprise's financial/development department, a bank, > simply a shop archiving your customer data or other entity dealing with > "secret"/"private" information, would you want details about your > systems to be exposed to the public? > > Consider secret services/competitors spying the net, consider > man-in-the-middle attacks, consider intruders harvesting the > database, ... > > I would not - I would take any measure to prevent and obsure such > transmission. Thats fine. In that case you can simply instruct your users to not send such information and the users can simply just click 'next' on the menu. But there's no legal issue with the above, only a corporate or administrative policy issue. -sv -- fedora-devel-list mailing list fedora-devel-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-devel-list
