Re: [gentoo-project] Date-of-birth in developer applications

[Rich Freeman]

On Wed, Jun 20, 2018 at 7:12 AM Kristian Fiskerstrand <k_f@g.o> wrote:
>
> On 06/20/2018 12:52 PM, Rich Freeman wrote:
> > On Wed, Jun 20, 2018 at 4:32 AM Michał Górny <mgorny@g.o> wrote:
> >>
> >> Please tell me, how many times did we have to disambiguate two
> >> developers using the same name?  Even if we ever have to do that, do you
> >> really think we'd use one's birthday all over the place?
> >
> > Even if we've had two people from the same location with the same
> > name, WHY would we ever have to use their date of birth to identify
> > them?  We already have their nicks which is what we use internally,
> > and those are always unique.
>
> One morbid example would be someone getting a stone in the back of their
> head, at which point the nick will likely not help much... But the
> underlying need is likely to arise more due to other circumstances for
> needing to contact, say a retired dev needs to provide evidence in a
> copyright case and we need to track them down to get said statement.

The "underlying need" is what I'm getting at.  Do we REALLY need to
track developers post-retirement?  If we do, is DOB really the best
way to do this?

And what are we going to do when some retired developer asks us to
forget about them?  I don't think legally we need to go retract
published info, but that DOB seems very much the sort of thing that
would be risky to hold on to if somebody explicitly told us they don't
want us to retain it.  We'd probably need justification to do so.

> >
> > As far as I'm aware, under most privacy laws and policies I've seen,
> > name+DOB is just as sensitive as a government ID number.  If
> > collecting the latter makes you recoil in horror, then you should be
> > just as concerned about DOB collection.
>
> I'm not, but views of truestees might differ on that; we have reasons to
> collect it, it is part of recruiting process known to developer, so the
> legal matter wouldn't be on the collecting part but the storage part,
> and here they differ quite a lot in practice (although it shouldn't as
> even SSN is just a Primary Key in theory).

WP has what appears to be a decent article, and it lists DOB as
explictly personally-identifying:
https://en.wikipedia.org/wiki/Personally_identifiable_information

The US law explicitly lists DOB (cited there):
Information which can be used to distinguish or trace an individual's
identity, such as their name, social security number, biometric
records, etc. alone, or when combined with other personal or
identifying information which is linked or linkable to a specific
individual, such as date and place of birth, mother’s maiden name,
etc.

It goes on to cite the EU:
Article 2a: 'personal data' shall mean any information relating to an
identified or identifiable natural person ('data subject'); an
identifiable person is one who can be identified, directly or
indirectly, in particular by reference to an identification number or
to one or more factors specific to his physical, physiological,
mental, economic, cultural or social identity;

You brought up the scenario of tracking somebody down in the real
world.  It seems to me that if we actually collect enough info to be
able to do this, then by definition we fall directly in the crosshairs
of both.

I'd start with the underlying issue: do we need to identify specific
individuals and retain this identity?  What exactly do we need
(starting from zero), and what is the least amount of info we need to
collect to get there?

My understanding is that these are the basic principles of most modern
privacy law, and if we stick to those we'll probably be fairly safe as
these laws change (assuming we sufficiently protect the info we do
need to collect).

The principles cited in that article actually raise other thorny
issues as well, such as name+location if the name is unique enough.  I
couldn't begin to tell you whether half of Oslo are named
Fiskerstrand, or if you're the only one in the phone book.

-- 
Rich