Talk:SPG:Drafts:Data Privacy EGI CheckIn
Comments and discussion
Comments from Hannah Short (8 Nov 2016)
Minor points since this looks very thorough:
- It is potentially confusing to have two nested policies. There are references to "The Policy", "This policy", "this Policy" and it's not obvious to which one they are referring. It might be clearer to insert the word Privacy or Data Processing before each use of the word Policy
- "Stored where?" I worry this is opening a can of worms since we do not specify the actual location and readers will want to see a physical country listed. As far as I can see, this isn't a requirement of the Policy on the Processing of Personal Data
Answer from DaveK: Agreed. Potentially a BIG can of worms! In the past with the old User-level Job Accounting Policy we did require the data to be held within the EU (or country with similar data protection). In general this does not work for e-Infrastructures like WLCG where we do need to store and process outside of the EU, so our plan was that the fact that all members of the e-Infrastructure are bound by the single set of policy documents should be sufficient.
Comments from Ian Neilson (18 Nov 2016)
- Sec 2 first line - "..grant you access to the Infrastructure and to the services and resources provided by the Infrastructure". What else is there apart from the services and resources? Suggest just "..grant you access to the services ...".
- Sec final bullet - "..rights" might be somewhat loaded or confusing. How about "roles" instead which implies some rights?
- Sec 3 last line - "We will store your personal data in log files and audit archives. These logs and other records will ...." --> "Your personal data will be stored and used solely ...."
- Sec 3 - line 2 lists 3 possible uses, line 3 adds monitoring. Suggest delete as monitoring could be both security and operational? Also, it's at first thought it's hard to see how "dispute resolution" could be done without sharing?
- Sec 7 - "..same purposes.." --> ".. purposes given above .." ? I felt Sec 3 is a little distant from Sec 7 to use "same"?
- ditto - "..but only where the recipient..". Why not "..and only.."?
- In fact, going back to Sec 3, it talks about sharing and we have Sec 7 about that. We seem to be drawing a distinction between processing and storage. Probably best to separate this? I suggest "grant and" didn't add much and is it clear that it's not only the User Comm's that are bound to the policies? Could reword to saying in Sec 3 -
We process your personal data solely to manage your access to the EGI CheckIn service and other Infrastructure services, including those provided by User Communities, all bound to the same Infrastructure policies. Your personal data will be used solely for .... Your usage of the Infrastructure will be monitored and records of this use, containing your Personal Data, will be stored and used only for the same purposes.
or something like that?
Answer from DaveK: Many thanks Ian. All very good points and so I have made all of the suggested changes except one. I have left "monitoring" in the list of allowed purposes. I am sure there are some cases of monitoring which may not be seen as either operational or security related, e.g. resource usage monitoring done by the User Community. I prefer to leave it in to be sure we cover everything.