I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example Apache 2.0. The gathered information when signing one of these (name, address, phone, e-mail) as a code contributor is not shared with third-parties, but is required in order to avoid copyright claims.

1 Answer 1


Short answer: No

Long Answer:

Presuming the CLA informs the Data Subject of what information is gathered (pretty self explanatory, the Data Subject is putting the information in the CLA) and what it will be used for. Then by them submitting a CLA they are giving consent to what the CLA states.

As Shown below a CLA can qualify under all 6 lawful reasons for processing personal data. One of the reasons is a stretch, another a possible stretch, the rest apply.

Keep in mind though if the CLA does not or did not specify what the information was to be used for then those documents are in violation of the GDPR. In the case where a CLA was signed prior to May 25th 2018 you have two choices. Destroy the documents or retrieve consent for the information obtained in those documents for the purpose of the license to avoid copyright claims. Consent must be informed per Recital 32 of the GDPR.

A CLA is a contract. Thus falls under the following:

Article 6:

Section 1a:

the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

Presuming the personal data is only used for what the agreement states it will be used for.

Section 1b:

processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

You entered a contract which should state what the information is needed for. Thus that information is necessary for the performance of that said contract.

Section 1c:

processing is necessary for compliance with a legal obligation to which the controller is subject;

Technically the controller is the natural person or entity responsible for the OS Project. The license attached to the OS Project is their choice.

Depending on the chosen license and the CLAs. They may be able to modify that license (re-release under a new license). And thus they aren't technically legally obligated themselves to follow the copyright license themselves.

However if the chosen license doesn't give them ownership of the contributed code nor does the CLAs; the license itself requires CLAs, then the information gathered in a CLA is a legal obligation. Though you would be hard pressed to fall into this category.

Section 1d:

processing is necessary in order to protect the vital interests of the data subject or of another natural person;

Only applies if the OS Project is led by a natural person and not an entity.

Section 1e:

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Possibly, might be stretching it there. Though I personally believe an OS Project is generally in the public interest.

Section 1f:

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

The legitimate interest here would be the copyright license of the OS Project.

  • Are you sure about the part requiring the re-signing of the CLA for older signed agreements? So far, I haven't seen any OSS projects chasing contributors to do so. I mean -- if this were so, it would open a door to a whole world of cases where developers would be granted a chance to revoke their permission, (if, for example, a project has become quite successful) and potentially want compensation for this. I believe the information collected for the sake of the agreement (name, address, e-mail, phone) is required as legally binding and fits the "special circumstances" clause.
    – carlspring
    Jun 1, 2018 at 15:21
  • These details provided by the contributor are solely for identifying them as having agreed (in signed form) with the project's license.
    – carlspring
    Jun 1, 2018 at 15:25
  • "Consent must be informed per Recital 32 of the GDPR" means what exactly? Just sending them an e-mail informing them what their contact details will be kept for, or asking them all to re-sign the agreements with this amendment? (I find it hard to believe that it's the latter, as it would also invalidate all sorts of other legally binding signed contracts). Please, advise!
    – carlspring
    Jun 1, 2018 at 16:26
  • Again it depends on the exact CLA which was signed. The GDPR isn't invalidating the CLA itself it's invalidating the ability to maintain the data subject's personal data. The best, and probably safest option, would to claim Article 6 section 1b. As the CLA itself is a contract in itself.
    – Shinrai
    Jun 7, 2018 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.