Does GDPR affect individual contributor license agreements for opensource projects?
<p>I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example <a href="https://www.apache.org/licenses/LICENSE-2.0" rel="noreferrer">Apache 2.0</a>. The gathered information when signing one of these (name, address, phone, e-mail) as a code contributor is not shared with third-parties, but is required in order to avoid copyright claims.</p>

<p>Short answer: No</p>

<hr>

<p>Long Answer:</p>

<p>Presuming the CLA informs the Data Subject of what information is gathered (pretty self explanatory, the Data Subject is putting the information in the CLA) and what it will be used for. Then by them submitting a CLA they are giving consent to what the CLA states.</p>

<p>As Shown below a CLA can qualify under all 6 lawful reasons for processing personal data. One of the reasons is a stretch, another a possible stretch, the rest apply.</p>

<p>Keep in mind though if the CLA does not or did not specify what the information was to be used for then those documents are in violation of the GDPR. In the case where a CLA was signed prior to May 25th 2018 you have two choices. Destroy the documents or retrieve consent for the information obtained in those documents for the purpose of the license to avoid copyright claims. Consent must be informed per <a href="https://gdpr-info.eu/recitals/no-32/" rel="nofollow noreferrer">Recital 32</a> of the GDPR.</p>

<hr>

<p>A CLA is a contract. Thus falls under the following:</p>

<p><a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer"><strong>Article 6:</strong></a></p>

<p><strong><em>Section 1a:</em></strong></p>

<blockquote>
  <p>the data subject has given consent to the processing of his or her personal data for one or more specific purposes;</p>
</blockquote>

<p>Presuming the personal data is only used for what the agreement states it will be used for.</p>

<p><strong><em>Section 1b:</em></strong></p>

<blockquote>
  <p>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p>
</blockquote>

<p>You entered a contract which should state what the information is needed for. Thus that information is necessary for the performance of that said contract.</p>

<p><strong><em>Section 1c:</em></strong></p>

<blockquote>
  <p>processing is necessary for compliance with a legal obligation to which the controller is subject;</p>
</blockquote>

<p>Technically the controller is the natural person or entity responsible for the OS Project. The license attached to the OS Project is their choice. </p>

<p>Depending on the chosen license and the CLAs. They may be able to modify that license (re-release under a new license). And thus they aren't technically legally obligated themselves to follow the copyright license themselves.</p>

<p>However if the chosen license doesn't give them ownership of the contributed code nor does the CLAs; the license itself requires CLAs, then the information gathered in a CLA is a legal obligation. Though you would be hard pressed to fall into this category.</p>

<p><strong><em>Section 1d:</em></strong></p>

<blockquote>
  <p>processing is necessary in order to protect the vital interests of the data subject or of another natural person;</p>
</blockquote>

<p>Only applies if the OS Project is led by a natural person and not an entity. </p>

<p><strong><em>Section 1e:</em></strong></p>

<blockquote>
  <p>processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;</p>
</blockquote>

<p>Possibly, might be stretching it there. Though I personally believe an OS Project is generally in the public interest.</p>

<p><strong><em>Section 1f:</em></strong></p>

<blockquote>
  <p>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>
</blockquote>

<p>The legitimate interest here would be the copyright license of the OS Project.</p>

gdpr