Skip to content

"Reporting data object downloads" and GDPR #308

@squaregoldfish

Description

@squaregoldfish

For those in GDPR jurisdictions, passing IP address and other user information regarding downloads to the Carbon Portal is in violation of the GDPR.

The EU has ruled that even something as simple as loading a Google Font into your webpage is a violation, since it involved passing the user's IP address to the font website without the user's explicit permission. On that basis, logging a download from e.g. the SOCAT website must not include the IP address or anything else, and must be fully anonymous (just the fact that a download occurred).

  1. I don't know if you want to consider putting a warning to this effect in the documentation
  2. I understand that the system will record the reporter's IP address as the downloader if nothing is supplied. I don't know if you'll prefer this over just recording unknown. Having said that, I can understand the appeal of knowing that it was a SOCAT download, even if you don't know any more than that.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions