New EU data privacy law to take effect in May, what impact on HOT's tools?

[bgirardot]

I have started reading about how significant the new EU data law is that takes effect in May.

I think we need to review and understand how it impacts our tools and general practices. I think it is relevant to all sorts of things, like the slack log discussion for example #86

We currently do not consider the cookie law requirements in our tools, we should figure out how (if?) these new regulations affect us.

[smit1678]

👍 thanks @bgirardot. Do you have a link or list of some of the key points that we need to discuss and consider?

[pantierra]

This short list of the official website gives a good overview in my opinion: https://www.eugdpr.org/the-regulation.html

Especially the "Data subject rights" are probably more relevant for HOT first. The part on the "increased territorial scope" I would say, is not so relevant as long as we are not an European legal person, and then it will be quite difficult to predict, as the regulation is still not clear how it will turn out when using US based external services. Especially not when we are an organism based in both jurisdictions. Anyway, currently a new "safe harbour agreement" is negotiated, which aims to make US services to be kind of approved under this new legislation. And I expect it to give some - but not definitive - legal clarity.

[bgirardot]

While there is a lot to be figured out for everyone yet, from my reading, I think a good first step for us is a comprehensive privacy policy. Something that covers all of our tools and makes clear all of the 3rd party services we use.

I think the regulations mean that we have to be very explicit what information we collect, including stuff like piwik and google analytics if we make use of those, etc.