Re: [netmod] GDPR and private data

[Carsten Bormann <[e-mail]>]

On 2021-05-26, at 11:49, Balázs Lengyel <balazs.lengyel=[e-mail]> wrote:
> 
> Hello,
> Netconf/Restconf can transfer a lot of data. Some of this data can be personal/private like end-user names, personal phone records, street addresses. Is there a way to marks such data as private? I am thinking about something like putting a YANG extension in the data models:
>  
> extension private-data {
>     description
>       "Indicates that a leaf or leaf-list contains private data.
>     argument privacy-type;
>   }
>  
> Is there any standard solution for this or any proposal ? In the world of GDPR we should be thinking about this.

If the objective is to prevent processing these data at all, then maybe they should not be sent in the first place.

If the objective is to specify what processing of these data is permitted, then there probably needs to be more information that can be fed into a processor so it can derive its authorizations.
(Obviously there is more to privacy than personal user data, but you mentioned GDPR…)

Indeed, this is probably not the group to invent the shape of the authorization data...

Grüße, Carsten