Re: GDPR and CVE

["Landfield, Kent" <Kent_Landfield@McAfee.com>]

Add to the terms of use that if a submission is provided, all information is considered opt’ed in. This would allow us to maintain the info long term.  Assure lawyers approve. There are opt-in considerations.

 

Thank you, Gracias, Grazie,  谢谢, Merci!, Спасибо!, Danke!, ありがとう, धन्यवाद!

-- 

Kent Landfield

+1.817.637.8026

kent_landfield@mcafee.com

 

From: <owner-cve-editorial-board-list@lists.mitre.org> on behalf of "Coffin, Chris" <ccoffin@mitre.org>
Date: Thursday, March 8, 2018 at 3:40 PM
To: "Millar, Thomas" <thomas.millar@hq.dhs.gov>, "Seifried, Kurt" <kurt@seifried.org>, cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
Subject: RE: GDPR and CVE

 

Not sure… but I will pass it along and see what is being done.

 

Chris C

 

From: owner-cve-editorial-board-list@lists.mitre.org [mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of Millar, Thomas
Sent: Thursday, March 8, 2018 3:32 PM
To: Seifried, Kurt <kurt@seifried.org>; cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
Subject: RE: GDPR and CVE

 

GDPR does not take effect until May, so we have some time to figure it out.

 

Does MITRE have counsel already looking into GDPR implications for its projects?

 

From: owner-cve-editorial-board-list@lists.mitre.org [mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of Kurt Seifried
Sent: 8 March, 2018 16:20
To: cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
Subject: GDPR and CVE

 

So I had someone request their PII (email address) be removed from the CVE Terms of Use acceptance data I have for DWF, luckily there's no CVE associated with the address (I think it turned out to be an invalid request). 

 

But this does raise the question, under GDPR, even with positive affirmation (e.g. they filled out the form, then replied to an email) they would still be within their rights (as I understand GDPR) to then request at a later date that we remove their PII from the system. 

 

Which... let's be honest, we can't really do, because git, we can "remove" it but it still exists in previous branches/etc. And short of rolling git back in time to before that info existed, re-applying all the other changes and so on... and then having every fork go bonkers... 

 

So in short I think we need to ensure we have some legal/privacy language that makes it REALLY clear that once they submit their data and it gets into git (e.g. a CVE request) that we cannot remove it fully, and I'm not sure, but can we disclaim that we will remove it at all (I don't know enough about the internals of GDPR/how exactly it is interpreted). 

 

--

Kurt Seifried
kurt@seifried.org