Hello Ludovic and Guix devel community! Disclaimer: I've still not read all the relevant threads [3] [4], so please forgive me if I repeat some information already provided. What rights are we talking about? As a *free software* user do I have the right to redistribute /old/ copies of the source code and documentation I got in the past from the copyright holder, in any form (e.g. print)?... or to use old sources or documentation to develop derived work, with _attribution_, without asking for consent from the original authors and/or contact the original authors to ask them what is their current name? If yes, I would like to exercise all my rights without being harassed. Also, SHW and other organizations (re)distributing free software have their rights and should excercise them without being harassed. Ludovic Courtès writes: [...] >> I was also distressed to see how poorly they treated a developer who >> wished to update their name: [1] https://cohost.org/arborelia/post/4968198-the-software-heritag [2] https://cohost.org/arborelia/post/5052044-the-software-heritag > That’s another concern, with append-only storage in general, starting > with Git. We should look for solutions that work for both contributors > who change names and for users. This has happened several times in Guix > and what people did was search/replace their name and adjust > ‘.mailmap’. This is a good solution but unfortunately this is not what the author of the blog posts above [1] [2] and some people in this and other threads [3] [4] are asking SWH - and Guix and potentially all other people distributing copies of copyrighted works (e.g. documentation) - to do. They are asking to "rewrite history" [1] (of git... why not of other archives?): --8<---------------cut here---------------start------------->8--- I already fixed my name in my code. I updated the README and the copyright notice, and I ran git-filter-repo to rewrite the git history so it had always said my correct name, including in commits. This is a thing you can do. --8<---------------cut here---------------end--------------->8--- The author explicitely invokes the "right to rectification" (of the GDPR) [2]: --8<---------------cut here---------------start------------->8--- I give zero shits about the integrity of their data structures. I had already sent them a second email invoking the Right to Rectification, which it seemed like they ignored again, so it was time to get more formal. [...] En application de l’article 21.1 du Règlement général sur la protection des données (RGPD), je m’oppose au traitement de mes données à caractère personnel par votre organisme, l’archive Software Héritage. [...] Dès lors, vous voudrez bien : * supprimer mes données de vos fichiers et notifier ma demande aux organismes auxquels vous les auriez communiquées (articles 17.1.c. et 19 du RGPD) ; * si vous en avez l’obligation légale, m’indiquer la durée de conservation de mes données dans vos bases archives ; * m'informer de ces éléments dans les meilleurs délais et au plus tard dans un délai d’un mois à compter de la réception de ce courrier (article 12.3 du RGPD). --8<---------------cut here---------------end--------------->8--- People asking to rectify informaiton /they/ _published_ on their own are obviously misinterpreting the relevant section of the GDPR (more on this later)... and in fact, the SHW DPO reply is [2]: --8<---------------cut here---------------start------------->8--- Unfortunately, the deletion or modification of the software repositories you requested cannot be performed, for several reasons: * On the one hand, these developments involve several authors and are made available under open source licenses, which explicitly allow copying and redistribution * On the other hand, the mission of Software Heritage archive is to guarantee the availability of all versions of all publicly available source codes, and to ensure the integrity of these codes We understand the concern about the display of outdated identities, and for this reason a mechanism has been put in place to display a preferred identity across all the Software Heritage archive. --8<---------------cut here---------------end--------------->8--- But the authos is still not satisfied with the solution proposed by SHW (and used by Guix for it's contributors): --8<---------------cut here---------------start------------->8--- * I was not asking them to develop such a mechanism. I don't just want them to cosmetically change what they display, I want them to change the data. I can't trust the organization that contains the transphobe who had written their previous content policy to hold on to a substitution rule involving my deadname forever. --8<---------------cut here---------------end--------------->8--- «I want them to change the data», that is: rewrite history (of /all/ the copies of the repository archived by SWH, **fork** included?) The CNIL (the french data regulator) has been involved, but the author do not trust CNIL: --8<---------------cut here---------------start------------->8--- The explanation I can come up with is that CNIL and Inria are friends, and CNIL will never take action against Inria. --8<---------------cut here---------------end--------------->8--- Last but NOT least: what is this "right to rectification"? ...simple: --8<---------------cut here---------------start------------->8--- Art. 16 GDPR Right to rectification 1The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. 2Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. --8<---------------cut here---------------end--------------->8--- (https://gdpr-info.eu/art-16-gdpr/) Simple... really?!? First question is: is the "deadname" of the author "inaccurate personal data concerning him or her" or it is "just" the /accurate/ name the person had before he or she changed it? ...but the most interesting part is the "suitable recital" n. 65: --8<---------------cut here---------------start------------->8--- 1 A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. [...] 5 However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims. --8<---------------cut here---------------end--------------->8--- (https://gdpr-info.eu/recitals/no-65/) Is SHW (and Guix, and... *me*) exercising it's rights of /archiving/ and /scientific or (and!) historical research/? I say yes. Last question: do SHW (and Guix, and *me*) have the right to archive and redistribute free software for historical purposes. But also: is the retention of the "deadname" even necessary to exercise or defense legal claims about _copyright_ issues? And also: is my right to retain the integrity of data structures I obtained by copyright holders or I have to throw it away if one of the copyright holder asks me to retroactively rewrite all occurrences of his or her name for his or her asserted "right to rectification". All in all: what rights are we talking about, please?!? Loving, Giovanni [3] https://yhetil.org/guix/iytrYuvr9BcPdWG17PDP5SXyjrZzwBGx1sbh0BVcDZ8PAifSIMdPXPbuhhDu-2woPlaWmEWnSt09h4OravmRRBrMB5uDlXYtKtI0egEQX_k=@lendvai.name/#r [4] https://yhetil.org/guix/86d01304cc8957a2508e1d1732421b5e0f9ceeb5.camel@planete-kraus.eu/ P.S.: I am DPO and copyright advisor at my tiny company, but IANAL :-D -- Giovanni Biscuolo Xelera IT Infrastructures