dovecot - Jan 2022 - GDPR/sender-ip (was: make received-header on submission optional or at least drop the ip in it)

On 05/01/2022 17:44, Marc wrote:
>> Where people are sending email to public
>> mailing lists, there is no presumption of privacy.
>>
> I think the legislation is like this: the privacy is legislation is always
applicable, there are no conditions under which there is 'no presumption of
privacy'
Marc

my understanding of the GDPR legislation is that it defines what is 
considered lawful processing. One of those items that makes the 
processing lawful is consent. If I send an email to a public mailing 
list I think it's fair to say that I am providing consent. I was not 
suggesting that the legislation does not apply.

John

Am 05.01.22 um 18:00 schrieb John Fawcett:
> my understanding of the GDPR legislation is that it defines what is
> considered lawful processing. One of those items that makes the
> processing lawful is consent. If I send an email to a public mailing
> list I think it's fair to say that I am providing consent. I was not
sorry, you're wrong.

have a look at the given link to the EUGH-judgement.

it's irrelevant if someone acts in private or public area.

peoples privacy rights always exists and may only violated, if there's
really no other possibility to fulfil higher rights

and:

think about whistleblowers or dissidents in autotcratic regimes: maybe
they send mails from the same place, where they do their important work
for society. Even if they change their IP between, their location may be
traced in detail.

and don't forget: no one here will force you, to change your handling
with your users privacy-data. but some of us want to have the
possibility to change it. So why you're aguing here, what's your aim?

if there are technical issues with the patch - ok
if it brings more complexity in the further development (which I don't
think due its simplicity) - ok

but I think that interpretation of the GDPR is neither on-topic here,
nor may lead to any kind of consensus, since even in Europe there're
still enough people, who think, that's not useful.

d.

On Wed, Jan 05, 2022 at 06:00:31PM +0100, John Fawcett
wrote:
> my understanding of the GDPR legislation is that it defines what is
> considered lawful processing. One of those items that makes the
> processing lawful is consent.
Not necessarily.

An action that would not be lawful without consent is not automatically
made lawful with consent, including under GDPR.


> If I send an email to a public mailing list I think it's fair to say
> that I am providing consent.
Again, not necessarily.

First of all, consent cannot necessarily be assumed.

Secondly, a person sending an email to a mailing list might very well
consent for the mailing list's recipients to receive the content,
subject, and reply address of that email - but *not* the IP address from
which it was sent.


Sam


-- 
A: When it messes up the order in which people normally read text.
Q: When is top-posting a bad thing?

()  ASCII ribbon campaign. Please avoid HTML emails & proprietary
/\  file formats. (Why? See e.g. https://v.gd/jrmGbS ). Thank you.