OSS in the quest for GDPR compliance
The evolution of legal norms has centered privacy as a core value, becoming more and more relevant to keep up with the features and dynamic of technology. The recent changes brought by the EU’s GDPR have made this even more relevant, as it imposes a uniform set of rulings to be applied in a variety of ecosystems. Also, besides its versatile mechanism of enforcement, it seems that it is becoming the new unofficial standard of the future. The OSS field is well known for its concept of community formed around an OSS project, which contributes to its development as it evolves. This is maybe one of the reasons why a lot of projects have set privacy by default and by design as main ambitions, as it expresses a need of the people to have their data protected. The GDPR is undoubtedly an effective tool to raise awareness about the right to privacy, enforcing data protection principles. However, each field of activity is currently setting up best practices, which eventually will become complementary to the legal norms. This talk is about pointing out how the provisions of the GDPR apply in the OSS field and how we could analyse the model of data controller / processor in the context of OSS participants and infrastructure providers. Moreover, it will point out how privacy is and could be even more enforced by the OSS model. The examples which will stand as basis for the analysis are those of XWiki and Cryptpad. XWiki is an OSS project started 15 years ago, currently having a mature company to provide services on top of it. It involves actors from all over the world, including members of the OSS community, customers, collaborators and team members. Cryptpad, on the other hand, is a project developed with the aim of placing privacy by design as a core principle, with the use of end to end encryption for data protection. Ultimately, we all need to become more privacy aware, and whatever role we may find ourselves in, as controllers or processors of personal data, as authorities or even as data subjects, we are all participating in shaping the future of privacy.
Speaker(s)
Cristina DeLisle (XWiki / Cryptpad)
Bio
Interested in software ever since beginning to work at XWiki, an open source project which made me more tech aware, coming from a juridical background. As a DPO, I’m following the GDPR’s evolution, striving to ensure on a daily basis compliance with the applicable data protection rules.
Aaron Macsween (XWiki / Cryptpad)
As a privacy engineer and the CryptPad project lead, Aaron designs and builds systems to respect the wishes of the humans that use them. He tries to go beyond compliance when it comes to applying/respecting privacy law, and he’s passionate about making cryptography widely accessible.