 Wel, ddelfwng, Fawr, dwi'n ddelfwng, Jonathan a Tullef yn cael eu bod yn cael ei ddelfwng o'r ffordd yng nghymru, oherwydd y gwybod yng nghymru, oherwydd mae'n ddelfwng yng nghymru. Fe fyddwn ni'n gwneud hynny'n gweld. Wel, yng Nghymru, yn cael ei ddelfwng. Yn cael ei ddelfwng, dyna'n gwybod fel byddwch. Wel, rwy'n gweithio'r gwaith cyflwyno'n ddechrau'n cael ei ddelfwng. yw'n ddim yn y cwm yn ein bod eich ddweud o dystwyf yn holl gynnyddio'r ddweud? Yn y ffwrdd y cwm yn gwneud o'r ffawr, ac nid o ddweud y cwm yn ymgyrch? Mae'n ddweud o'r ddweud o ddweud o ddweud o'r ddweud o'r ddweud. Mae'n ddweud o ddweud o'r ddweud o ddweud o'r ddweud o ddweud. Rydw i'n rwy'n trafnodd eich ddweud o ddweud o ddweud o'r ddweud o ddweud o'r ddweud. Yn ymweld? Yn ymddangos. Mae ymddangos, Johnathan McDowell, i'r Tulliff. Mae hynny'n gael eu helpu gyda Matthew Vernon, maen nhw'n gweld o'r ddallig o'r ddillogau phall ar y tîm, a ar y tîm Aelais yn ymddangos. Why do we care about this now? So, I'm sure you can't have failed to hear that the EU General Data Protection Regulation came into effect on 25th May this year, Ie ddweud y gallwn yn gofynu'r iawn yn y gyfnod yn debyn, ond rydyn ni'n rydyn ni'n gymryd ar gyfer y cyfnod o ran mynd i'r cyfnod ac ein o'r ddau'r ddebyn yn diolch yn y gwirionedd Llyfrgell iawn. Yn y moment i fynd i'r unig o'r achosid ffordd yn yr unig o'r llwyddiad o'r ddebyn, o'r ddebyn o'r llwyddiad o'r ddebyn, o'r ddau'r llwyddiad o'r llwyddiad o'r llwyddiad o'r llwyddiad, ac yn i gyrwch y ddweud o wahanon ni'n mynd i'r cyfrifio'r cyfrifio. Nid yw'r cyfrifio newydd, yn ymgyrch i ddweud ar hyn yn ymgyrch, yn ymgyrch am yr aelodau newid, yn ymgyrch i gynhyrchu enwyd, yn gweithio'r rhai gyrwch i'r cyfrifio. Ond yw'r ideaeth i gyd yn ei gael amllangos a phobl yma, ac yn dda i'n meddwl i gael i'r cyfrifio, ond ymgyrch i'r cyfrifio i'r cyfrifio, a chynghwp y gallwch i ddim yn ei ddweud? Yn y gwbl GPR, mae'n gweithio'r newid yng Nghymru, ac mae'n gweithio'r gael yng Nghymru yn ychydig ar gyfer y ddechrau o ddweud y ddweud o'r organiadau yn ei ddweud. Mae'n gweithio'r gweithio'n ddweud, ac mae'n dweud yn cael ei ddweud i ddweud o'r ddechrau, ynddyn nhw'n teillen ar gyfer ystodau ar gyfer yma, yw'r cyffreddau duodol yn cael ei amhylchau. Mae'n lle'r cynnwysau y trofodol yn gyd. Mae yna gweld yn mynd i weithio'r llwyg. Mae'r bydden nhw'n rhan o'r gestelltr yn bwyd, ond mae Edrych Tegolol yn osgymryd, mae'n ganddiwch i dechrau. Mae'n ad gag y rai ei ddweud o'r cyfaint oherwydd in the EU or the European Economic Area, in fact. To be allowed to do anything with data or anything with personal data, sorry, you need some legal basis to do that. You can't just collect random bits of information about people and store them, for instance. So you need some sort of legal basis. There are some extra bits, but the two most common ones are consent. Basically, you go, I'm happy for you to have this piece of data because you could actually offer me some useful service based on that. Or there's the, remind me. Legitimate interest, thank you. Where the downside for you in me having that piece of data is small enough that it's legitimate. Processing is a slightly, has a lot broader base than what we would usually consider processing. Processing is not only doing things to data, it's also transferring and storing. Personal data is also similarly wide. It's anything which relates to somebody you can identify. You don't have to actually have identified them, but it's very, very broad. So it's not only your name or your social security number or phone number. It can also be anything else, which based on how you structure your data, it can be things like your shoe size. I mean, we don't care about that, but you know. Next. The requirements here, because this is a very new piece of legislation. Documentation is really key. We might be wrong in our approach, but as long as we've documented why we think that what we're doing is correct, it will be given leniency and will be go, and data protection agencies will go, we think you're wrong, we think you should change it in this way, but they won't actually, we'll have time to do that, and that's the important part. Another important part here is that we have fairly poor control over what data we actually hold about people. There are some obvious ones. We know about mailing list archives, we know about the WNL app and so on, but there are lots of more places where we actually store. Data about people, things like UDD, of course, changelogs, git reposteries, that kind of stuff. There are two requirements or two. As somebody we hold data about, you have a couple of rights. You have the right to actually know what data we hold about you, so you can go to Devin and say, I would like to have all my data, please. In certain cases, you also have the right to ask for a deletion. That's not an unlimited right. If you're a former DPL, you can't go and ask us to delete all the information about you that you were the DPL from our webpages because we actually have an interest in having that information. But if you have a single mailing list post where it's not actually that important to Devin, you're allowed to ask for that to be deleted. There's also a requirement that when we collect data, we collect as little data as we can. We shouldn't collect data because it might be nice to have. We should collect data where we can actually use it for something useful. Whenever possible, we should try to make the data not be personally identifiable, so it should be anonymous or pseudonymous, where instead of having somebody's name, you replace that with some random identifier, which you then actually can't tie back to their name. I think just to build on that, there's two major changes that come in as part of the GDPR. None of the principles in it are particularly new. A lot of what it says are things that organisations, particularly commercial organisations, needed to be doing under previous data protection regulation in the EU. The onus of proof has changed such that instead of the Information Commissioner officers coming to an organisation and saying, we think you're out of compliance, here's our proof. It's not a case where the ICO can turn up and say, we think you're out of compliance, prove you're not. So that burden of proof is just more to the organisation making it much easier for the ICO to do their job and thus creating this documentation requirement. The other thing is it's sort of a mindset change about instead of collecting all the things and then working with what to do afterwards, it's about only collecting the information you actually need and then you'll be in a much better position. So the Sudabian's been reasonably good about this. We have a little bit of a tendency to collect the information and do analysis afterwards. Not hugely, but that's something we do lean towards just in the general, collect all the stats thing. But we're quite good about it because we are a free software project. Everything's out in the open. It's quite easy to sort of point and go, well that's the information you store about me and that's easily for me to find and we don't have the sort of conversations going on about employees or whatever in the background that other organisations might have a problem with. So from our point of view, the team purpose is fairly simple. We provide a central point of contact to those outside the project. If someone random has posted the one-mailing list, doesn't really understand Debian, there needs to be somewhere that they can come to and say, I have no idea about your organisation and it seems that you might have some of my personal information. And rather than expecting those people to understand that really the right person to talk to is Listmaster, we have a single alias data.protection at Debian.org. They can come to and go, hey, what data do you hold? Now our role at that point is to pass them on to the individual service owners rather than directly answer that query themselves. We are not your secretaries, but we will point people in the right direction and make sure that they get the information they need rather than having to navigate through 20 different services in Debian to talk to the people who have admin access to each of those services. On the flip side, we will act as an advice service for those service owners. If you run a service and you are not sure whether the information you have is something you need to care about or whether it is appropriate, then come talk to us and we will have a conversation and we will try and work out the easiest way that you can continue running your service while meeting the needs of our users in terms of their privacy. From everyone we have talked to so far, there has not been any major changes. I do not think that anyone has come to us and said or anything we have looked at. We have done some work about documenting what data the project stores and where it is. There are a few instances we have realised that we could do some minimisation, but there has not been anything where we have looked at and gone, oh my God, the hardware is in so much trouble. We will document this, we will make sure that we do not worry about what is being stored and we are probably good at this point. There are some bits where we want to reduce the amount of information we collect like in LDAP we store a gender field and Debian does not actually care about the gender or we do not care about it on a per person basis in the cancer service. LDAP has actually been the worst one and you can store a whole bunch of information about yourself including your GPS coordinates and all of it is voluntarily stored. It is only available to the project and you can easily delete it. While there is not really a lot of point in us storing that information, the worst example we could come up with and it did not seem that bad. Things like mailing list posts, they are all in public so you can see them anyway. We were getting deletion requests anyway. Listmasters have had to deal with those in the past so it is not something that has not come up before so it has not been too bad. In that sense, in terms of the central point for where you can find out information, what we have actually realised is that we were most of the way there with Enrico's work on contributors.debian.org and that sort of accepts data feeds from various services that indicate when someone has been active within Debian and previously the project had been using that to acknowledge contributions that people have made to the project so that they could be visible and they could go right. I am acknowledged as someone who is involved in Debian and they do not have a formal Debian maintainers or a Debian developer status but it turns out that is quite useful to be able to then say here is what we store on you, here is how we recognise what you have done and the good services that are integrating with that already both provide the information about who they know about but then also provide a link back to the service that provides the data take out functionality. If it comes to the point down the line that we feel that we need a proper take out functionality and a once click button that says give me all the data that Debian holds that will be the site we use it for at the moment we are quite keen that any service that is not already talking to contributors.debian.org goes and does that and it is a simple matter of a post request to the interface sort of once a day and you say here is my data and it is JSON and it is relatively easy to do and there is about half a dollar a dozen different services already integrated in there. The other thing is we now have a privacy policy on the website it actually lists all of the internal services that are provided under Debian.org that we could come up with it lists what data we think is collected it lists retention policies if appropriate we know there is information missing on that if you run a service in Debian go check if it is on there go check if the information is right let us know if it needs updated the idea is at the moment that is a documentation effort that is where the project might store my information I can go and see which services I interact with that might cause my data to be stored. Any questions? So not so much a question but a comment so I was talking with noodles last night in the bar as you do and I promised that we would add a link to the privacy policy in the wiki that has happened literally five minutes ago I would recommend everybody else who can who needs to clearly also add a link to the Debian privacy policy pages on the website if you are running a service that holds data I am happy to help and advise on anybody who needs that. Yeah the policy privacy policy went live this week so thanks to Laura who is not here who did a lot of work on getting that active in the website and proposing various cleanups to it so it is now linked from the footer on every page and www.debian.org on the front page. I think if I had one take away that I would like everyone to go away with it is that the sky isn't falling this isn't a terrible thing but you do need to be aware of it and make sure that you are on the right side of compliance the project ethos is very much in compliance with the GDPR we just need to make sure we are actually adhering to that and have documented it. Also we like the GDPR it actually protects users it gives power to users instead of corporations and instead of organizations so I think with all my projects has on that it is a great thing sure it costs work for us but not that much and it really aligns with the project's goals. Yeah it is definitely a great thing it is only encouraging people to do what they should have been doing properly already it actually gives better guidelines and I think the key thing is it gives teeth to the people who are trying to regulate things so people who are not doing the right things are looking petrified as they should be. That was easier than I thought it might be. I guess that's everything. Thanks very much guys.