Do I have the right to ask Github to hide my "Contribution activity" on my public profile page?
Do I have the right to ask Github to hide my Contribution activity according to General Data Protection Regulation (GDPR)
3You absolutely have the right to ask, you could ask them to contribute $1 million to your Star Wars figurine collection, whether or not they have to comply with it is a different question (and what I think you are actually asking)...– Ron BeyerAug 2, 2018 at 1:31
3@RonBeyer There is no need to be sarcastic (regarding the $1 million contribution for a figurine collection) when somebody seeks orientation about legal matters. That type of sarcasms occurs over and over again in law online forums, which is neither funny nor useful. We all know that an OP always means to inquire whether his position is sufficiently supported on a legal (or equitable) basis.– Iñaki ViggersAug 2, 2018 at 10:40
@IñakiViggers If you feel I'm breaking site rules you may flag my comment for moderator intervention (use the flag below the "up" vote). I did not mean to offend the OP or you, at least a few people found it humorous/useful. The use of exaggeration/obsurdity is an effective technique at conveying an idea. This is not the place to have this discussion, if you want to continue it further, please start a discussion on Law.Meta.– Ron BeyerAug 2, 2018 at 12:29
1@RonBeyer I wouldn't bother moderators for this. I just think we need not be sarcastic about the OP's phrasing of his inquiry, especially where it is clear what he's trying to ascertain. Not sure whether you are the one posting similar sarcasms here and here under userid FlyingRon (maybe it's just a coincidence apropos of the pilot license stated in your profile), but one can make a point effectively without doing that to OPs.– Iñaki ViggersAug 2, 2018 at 14:31
@IñakiViggers That is not me, I'm from Wisconsin, not North Carolina. I'm not a member of any other "law" community online.– Ron BeyerAug 2, 2018 at 14:34
The "Contribution activity" is extracted from repositories hosted on Github. Looking at the privacy statement, Github considers itself as a hosting service for those repositories. See EU Directive 2000/31/EC Article 14 for the exact definition and conditions:
Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:
(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or
(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.
Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider.
This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information.
Article 2(4) GDPR defines that the GDPR does not apply (to Github) in this case
- This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.
Extracting data from the repositories to create a nicely formatted contribution activity list, would still be considered hosting as defined at Directive 2000/31/EC, because Github does not (manually) redact or modify commits.
So if you want to hide your contribution activity, you must delete the contributions. And you should not ask Github to do that, but ask the owners of the repositories. And they might have good reasons to deny your request.
If an owner of a repository denies your request without a good reason, you can ask Github to do so. But Github would then probably deny that request, because they explain in their privacy statement that modifying the history is not possible:
The email address you have supplied via your Git commit settings will always be associated with your commits in the Git system. If you chose to make your email address private, you should also update your Git commit settings. We are unable to change or delete data in the Git commit history — the Git software is designed to maintain a record — but we do enable you to control what information you put in that record.
To further clarify why Article 14 of Directive 2000/31/EC applies, see case C-236/08 (Google v. Louis Vuitton) where the European Court of Justice clarifies the meaning of that article (ECLI:EU:C:2010:159):
In that regard, it follows from recital 42 in the preamble to Directive 2000/31 that the exemptions from liability established in that directive cover only cases in which the activity of the information society service provider is ‘of a mere technical, automatic and passive nature’, which implies that that service provider ‘has neither knowledge of nor control over the information which is transmitted or stored’.
Accordingly, in order to establish whether the liability of a referencing service provider may be limited under Article 14 of Directive 2000/31, it is necessary to examine whether the role played by that service provider is neutral, in the sense that its conduct is merely technical, automatic and passive, pointing to a lack of knowledge or control of the data which it stores.
The way Github creates/shows the contribution activity is in my opinion technical, automatic and passive. That means it is not liable, and that implies that the GDPR does not directly apply, unless data is unlawful, and someone notifies Github of that:
- The restriction on liability set out in Article 14(1) of Directive 2000/31 applies to cases ‘[w]here an information society service is provided that consists of the storage of information provided by a recipient of the service’ and means that the provider of such a service cannot be held liable for the data which it has stored at the request of a recipient of that service unless that service provider, after having become aware, because of information supplied by an injured party or otherwise, of the unlawful nature of those data or of activities of that recipient, fails to act expeditiously to remove or to disable access to those data.
Surely the GDPR might be the reason data is unlawful. But you need a reason, in particular based on Article 17 ("right to be forgotten"). For example if personal data of a 12 year old child is processed without permission of it's parent. Without such a reason the legitimate interest of the repository owner will probably prevail (who wants to keep the git history complete).
1Interesting take and, I think, a pragmatic answer - but how do you get that "Extracting data from the repositories to create a nicely formatted contribution activity list, would still be considered hosting as defined at Directive 2000/31/EC, because Github does not (manually) redact or modify commits." is considered hosting - as Article 14(1) talks only of storing of information provided by a recipient - the processing of Git commits would appear to be manipulation of data - and thus being used for statistical purposes.– davidgoAug 2, 2018 at 23:58
@davidgo I think Article 21(6) does not directly apply to Github, because the processing is automatic. See my update above. But github must delete unlawful data. But if data is processed based on Article 89(1), (like statical purposes) then Article 17(3)(d) denies the right to erasure if it seriously impairs the achievement of the objectives of that processing. Removing data from the git history requires a rebase, invalidates all hashes, and causes lots of problems. So I don't think that will work.– wimhAug 3, 2018 at 22:31
Assuming that the GDPR applies (which would seem to be the case - regardless of where you are in the world based on the Github Privacy statement), then its arguable that you should be granted this if you have a valid reason in accordance with Article 21(6) of the GDPR which reads
"Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest."
(By my reading section 89 allows them to process this data after anonymising it)
Its also relevant to quote Githubs page on how to control your data which includes the data they collect about you -
"If you're already a GitHub user, you may access, update, alter, or delete your basic user profile information by editing your user profile or contacting GitHub Support. You can control the information we collect about you by limiting what information is in your profile, by updating out of date information, or by contacting GitHub Support."