Privacy in lobid products

[ChristophEwertowski]

Since the Datenschutzgrundverordnung (DSGVO) applies in May we should think about privacy sensitive areas on lobid sites (otherwise it could get very expensive). And if person related data is worked with we have to include a note about it. I'm starting the list of possible privacy issues.

• [x] general: anonymise IPs in logs (see hbz/lobid-resources#799)
• [x] NWBib: Merkliste. Fabian said that we only have to refer to cookies from external resources which we don't have at this place.
• [ ] data about persons from the GND/other cataloging in lobid-resources, lobid-gnd, NWBib
  • [ ] lobid-gnd contains the information that it accesses the GND and doesn't collect the data itself. But we should add a link to the GND so that users can refer to the DNB for wishes of correction, deletion etc.
  • [ ] NWBib, lobid-resources: We should add a sentence which indicates that the applications contain person related data which is necessary to identify works. Because of common sense we can skip this. Also a link to the GND whould be good. It seems that we have no persons which have a dateOfBirth (or dateOfDeath) and no GND-Id (query). But we do have persons (or organisations) with a role and no GND-Id. But I hardly doubt that this information is privacy relevant because it is stated in the work itself or publicy known.
• [x] anonymize tile server calls by using a proxy (hbz/lobid-resources#798)
• [ ] Create a "Verfahrensverzeichnis" for lobid-pages / nwbib.de (https://github.com/hbz/lobid/issues/368).
• [x] Set links to "Datenschutzerklärung" and adapt it (https://github.com/hbz/lobid/issues/370)
• add provenance information
  • [ ] lobid-gnd (https://github.com/hbz/lobid-gnd/issues/89)
  • [ ] lobid-organisations (https://github.com/hbz/lobid-organisations/issues/408)
  • [x] lobid-resources (https://github.com/hbz/lobid-resources/issues/809)

[ChristophEwertowski]

About GND data: After I asked our leader of our Verbundgruppe she told me that at the meeting at the DNB the topic was mentioned but no official statement was given. @acka47 asked DNB people at Twitter but no sufficient answer was given.

[acka47]

See the twitter thread(s) here: https://twitter.com/acka47/status/973506914524024832

[ChristophEwertowski]

Deadline is 25th of May.

[dr0i]

I added a check-list and some links at the top of this issue.

[ChristophEwertowski]

I read the data privacy statement of the DNB. They don't have a section about the GND, only a sentence about tasks of public interest in which they refer to the law about the German National Library (and Article 6, section 1e GDPR). There in the section § 2 Tasks, rights it is stated:

Die Bibliothek hat die Aufgabe, 1. a) die ab 1913 in Deutschland veröffentlichten Medienwerke und b) die ab 1913 im Ausland veröffentlichten deutschsprachigen Medienwerke, Übersetzungen deutschsprachiger Medienwerke in andere Sprachen und fremdsprachigen Medienwerke über Deutschland im Original zu sammeln, zu inventarisieren, zu erschließen und bibliografisch zu verzeichnen, auf Dauer zu sichern und für die Allgemeinheit nutzbar zu machen sowie zentrale bibliothekarische und nationalbibliografische Dienste zu leisten,

Nothing specific about the GND.

[acka47]

Fixed. Closing