#metabrainz

alastairp: LB updated.

Leo_Verto: They might get an initial welcome e-mail, but I'm not sure.

ruaok: should the MB registration page link the GDPR site?

Freso: nope, just the email verification one

Leo_Verto: The Discourse account doesn't get created until the mail is verified.

Leo_Verto: yes, it should. let me go open a bug report for that.

yeah, did that and got no email

ruaok: I also just re-discovered we use google captchas for registrations, maybe we should mention that *somewhere*?

Leo_Verto: 🙌

Leo_Verto: Thanks for testing. ❤️

no problem, everything discourse looks fine to me GDPR-wise :D

MBS-9721: Add GDPR links

and I don't think the wiki should be a problem either

should we mention discourse in the GDPR statement then?

couldn't hurt to mention that it may send you emails if you opt in

ruaok: iliekcomputers alastairp I just had a realization, isn't Spotify legally obligated to provide an export of a user's full listen history now? :O

Hm. "Right to be forgotten" is not fully compliant right now. "Restriction of processing" I think is fine. "Right to data portability / exporting your data" is fine, users can download their essential data from the interface, and zas/me can install a plugin to allow them to download extensive data about them upon request.

"Right to rectification" - they can alter their data either in Discourse itself or via MB.

"right to be forgotten" should probably use that account deletion system bitmap is working on

"Right to be informed" is the same as everywhere else.

Leo_Verto: Right now if you delete you MB account, MB will ping Discourse and change username and email to the new anonymised username and e-mail from MB, but it won't change the "name", which means the name will remain the same as the username was.

yep, there it is: https://www.spotify.com/de/account/privacy/

I think there's an option to toggle this, which will mean that e.g., CatQuest won't be able to be "CatQuest, the Endeavouring Cat" but only "CatQuest".

"Right to access" is the same as "Right to data portability / exporting your data"

But I guess I should turn that name toggle on for now, which should mean that someone deleting their MB account will also effectively get anonymised in Discourse.

yeah, right to access mostly doesn't apply because we don't track our users

Heh. "We are preparing your data file. This can take up to 30 days to complete."

:p

I guess that's the legal requirement? Because it should take like 5 minutes...

yeah, because they legally have to do it within 30 days

I wonder if they're going to artificially delay this

ruaok: I think the "IP addresses" section of "Right to data portability / exporting your data" of our GDPR page is directly applicable to the Discourse site as well.

Fresco, I pretty much came to the same agreement.

-c

as far as I understand it, IP addresses are kind of a gray zone so we're already playing it pretty safe

I updated our Discourse install this morning to include a number of PRs merged in the last 48 hours to decrease the numbers of IPs logged in the Discourse db too.

I cant wait to get my spotify data.

we should totally build an importer for that data

yep, already on my mind.

should be a matter of parsing whatever format they give us.

do you know any other services we'd want to import from?

deezer. google music. tidal.

pandora

yes

though...

do they have service in the EU?

if not, they can just ignore the GDPR

ah, they don't

shame

I wonder if google music is part of the complete google download?

got a link? i have a google music account

fit & music requested.

... from the wrong account ...

LUL

GDPR "please allow us to still be in touch" mail to support@ :p

oh wow, steam did this properly https://help.steampowered.com/en/accountdata

Freso: from whom?

A Romanian company.

Not a name I recognise.

ok, back to our own GDPR statement.... With regard to discourse, I think we're fine, and I don't really think we need to amend our statement. does anyone disagree with that?

Seems good to me.

Leo_Verto?

ruaok, bitmap (if you're awake/around :)): I'm thinking of creating an MBS ticket to send a "please delete user" request to Discourse when a user deletes themselves on MB, so the user actually gets removed instead of just "anonymised".

does discord store IP addresses for longer than 7 days?

does that mean that their posts go away?

ruaok: That's configurable (a boolean in the "delete user" call), so we can say "yes" or "no" or let the user decide.

the real question is this: do we want that? potentially very useful posts will go away from that action.

I'm also thinking of making a script to iterate over all our "deleted user #…" users in Discourse and deleting them (without removing any posts they may have).

ruaok: I'd say we say "no, don't delete posts (but do delete user)".

I'm ok with that.

do we still allow deleting all posts at once?

i.e. right to be forgotten

Leo_Verto: Right to be forgotten, as I understand it from discussions, is also okay with anonymisation as an alternative to deletion.

(Which this would be, a step further than currently.)

pretty sure we have to allow that

Leo_Verto: lol

Leo_Verto: even if there's the anonymity option?

do it :D

ok, last concern from me... google captcha. what concrete action should we take there?

law.stackexchange says google is the processor not us so we are fine https://law.stackexchange.com/questions/27908/g...

not sure if I believe that

Well, we can follow that SE question for now. If it turns out we need to take action on it, we can do it then, for now we're good?

Yeah, probably

agreed.

we'll just need to keep our eyes peeling for things changing

I'm going to prepare the GDPR blog post then.

which will basically be the intro of the statement with a link to the statement.

Google Play music doesn't seem to keep anything beyond an aggregate play count: https://gist.github.com/mayhem/88980d072a78573a...

not very useful

no IDs of any kind. useless for our purposes.

hm

shame

it'd be interesting to know if they store more detailed data there... under the "old" freedom to data my understanding is that they need to give you more data

but I don't know how possible it is to use that right now, or how much gdpr overrides it

that blog post is so un-ruaok-y

sorry. the topic is so un-ruaok-y

should I put more noodly appendage references in?

definitely

yadda yadda: https://en.wikipedia.org/wiki/Wikipedia:Externa...

wikipedia master race is on it again :)

it's funny that they want to exclude MB for it being a wiki and unreliable while wikipedia is also a wiki

:)

yeah. and with their deletionist tendencies our track record for stable data is better than theirs.

it's just one stupid guy

well, 2

looks like the "community" decides on it again (:

legoktm: thanks for trying, at least (:

:/

well, they want to get rid of it from the authority control template.

which i can kinda understand (:

MB is an unreliable wiki ? bs.

i know

Wasn't the possibility to add homepage link removed for new editors ?? Because we have plenty of new editors (few days), 0 edits, Beginner, which are spam accounts

Typical example: https://musicbrainz.org/user/staffdirect07

same username created on plenty of websites, always with the same target url