Using an existing structured format about gdpr-txt HOT 5 CLOSED

It could look like that:

---
# The list of purpose blocks
purposes:
- purpose: Connect users to their accounts
  lawfulness: legitimate interest
- purpose: Collect phone numbers
  lawfulness: legal

# The list of (collected) data blocks
collected:
- data: username
  required: true
  visibility: private
  description: The username is used to identify users during the login process.
  mitigation: Username does not have to be a real or known identity.
- data: password
  required: true
  visibility: private
  description: The password is used to check identity of users during the login process.

# Mutli line is possible like that
  mitigation: |
    Only hashes of the passwords are stored in database (but they transit
    over the network).

    It uses bcrypt to create the hashes.

from gdpr-txt.

Thanks for your suggestion, but the GDPR.txt file is mostly intended to humans, not machines. The only usecase for a machine I can imagine would be to validate a file. But for now, the format is so simple that there is almost nothing to validate: I'm not even sure it's pertinent.

In fact, maybe it should be even more permissive to avoid confusing people about the purpose of the file. It's only to help hosting providers to create their own records of processing activities. It should not be used directly to inform users about their data because it would necessarily be incomplete (e.g. logs from the web server). It means that a potential example.com/GDPR.txt file would be a different kind of file, created by hosting providers, not by the developers.

from gdpr-txt.

I precise: a more structured format would be pertinent for a example.com/GDPR.txt file (e.g. an extension could read that file to expose clearly the GDPR information to users). But it would also be more complex to write, maintain and it should be more robust about the law. I have less ambition at the moment :)

from gdpr-txt.

(btw, I just moved the repository to Framagit https://framagit.org/marienfressinaud/gdpr-txt)

from gdpr-txt.

Makes sense, thanks :)

from gdpr-txt.