Re: A note from GitHub about your repository

[Mark J Cox <mjc@redhat.com>]

> The artifact in question is their agreement with the CVE terms of use:
>
> https://github.com/distributedweaknessfiling/DWF-Legal-Acceptance/blob/master/Terms-Of-Use/lpu%40protonmail.ch

My intepretation of their request differs to yours -- if they are invoking 
GDPR to have that entry removed then remove that entry[*], there doesn't 
seem to be any reason why their acceptance of terms email needs to be 
public as long as DWF have a copy.  Them asking for removal of their 
personal data from the public doesn't mean they've revoked their 
acceptance of those terms or you should alter any CVE they've filed. 
This wouldn't in my mind trigger any of the clauses for why you'd be able 
to reject the "right to forget".

> What happens if I withdraw my consent for
> cve-assign@distributedweaknessfiling.org?

Well, that wouldn't be defined as personal information under GDPR (and 
you're not an EU citizen).

> This is a major problem that we need to actually solve in some way. 
> Part of
> it will be finding providers that are "Safe".

Dealing with GDPR requests will be the same no matter where you store DWF. 
Some providers might just not have figured out their process for handling 
them yet.

Mark

[* "remove" has some interesting side effects in Git, depending on if 
Github want you to rewrite history so it never happened (bleh!) or just 
commit a removal (so it's actually still in the history)]