search

Miroka96 / stromberg-telegram-bot

0 stars 0 forks source link

Don't log sensitive data #1

Open flowirtz opened 5 years ago

flowirtz commented 5 years ago

As per Article 4.1 GDPR the username should be considered as personal data. Logging it openly can be considered a bad practice and thus should be avoided.

https://github.com/Miroka96/stromberg-telegram-bot/blob/1e7ce81a866ff8b04a4e8a25aba0beb3fb167626/bot.go#L76

flowirtz commented 4 years ago

Bump @Miroka96?

CC @simsieg does that affect your Model View View Model Model View Model Controller implementation?

CC @fyndalf Do we run into any issues here from a legal perspective?

fyndalf commented 4 years ago

@FWirtz I agree with you here, to my (non-lawyer) mind this log statement should be removed.

Generally, following the GDPR regulation, logging personal information (such as user names, IP addresses) is to be avoided unless the user explicitly gives their consent, or valid reasons (such as fraud detection, accountability, ...) exist for retaining personal information.

Thus, removing this log statement seems reasonable, as there doesn't seem to be good reason to retain this kind of information in this context.