GDPR compliance

[xsuchy]

This is a discussion that originally started in #3832 (comment)

I will copy it here (cc @ZanderBrown) :

Worth noting that this directly contradicts:

This will delete the information Copr knows about you, such as timezone and API tokens. However, your username and email cannot be deleted as they are tied to the FAS account. Moreover, if you wish to delete your builds/projects, you have to do so manually (possibly using the data acquired above).

Which amusingly amusingly enough appears on the ‘User Info’ (/user/info) page, also linked in the footer as the GDPR page, that begins with:

According to the GDPR (General Data Protection Regulation 2016/679 of the European Union), users have right to see all the data, that service stores about them, and also right to delete them.

So it seems to me that COPR claims GDPR compliance by nature of not holding the information itself, except it does in fact hold the data itself, with no means of deletion or rectification either via COPR or FAS, all whilst freely acknowledging it knows it needs to be GDPR compliant.

IANAL, but that right there sure seems like a GDPR violation, not to mention somewhat of an inconvenience.

[xsuchy]

COPR shows an email different to that of the FAS account, and ‘Delete my data’ does not delete that email

This is a bug. It should store and show the same email as stored in FAS. We will fix it quickly. This is why I created #3832

I would expect ‘Delete my data’ to revert COPR to a state akin to never having logged in

This is not true. GDPR defines Right to erasure in Article 17 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 and paragraph 3 describes what and when is not to be deleted. Email as a foreign key to FAS is information that we do not delete. It was approved by legal when we implemented GDPR and SAR.

IANAL, but that right there sure seems like a GDPR violation

I am confident that this is not a GDPR violation. If you think otherwise, I encourage you to contact Fedora Legals https://docs.fedoraproject.org/en-US/legal/

[ZanderBrown]

Not sure what part of paragraph 3 you are pointing to here?

Email as a foreign key

This seems curious as login evidently works after FAS has been updated, given your prior comment it seems more like COPR is simply caching it? And in the process hit everyone's favourite issue of invalidating caches.