Re: [netmod] GDPR and private data

[Juergen Schoenwaelder <[e-mail]>]

GDPR uses the term 'personal data' and I assume for many leafs in a
data model the answer whether a leaf is 'personal data' is not simple
to answer given that also data items belong to 'personal data' if they
combined with other information can identify a natural person.
For example, is an IPv6 prefix 'personal data'? Well, it depends...

  ‘personal data’ means any information relating to an identified or
  identifiable natural person (‘data subject’); an identifiable
  natural person is one who can be identified, directly or indirectly,
  in particular by reference to an identifier such as a name, an
  identification number, location data, an online identifier or to one
  or more factors specific to the physical, physiological, genetic,
  mental, economic, cultural or social identity of that natural
  person;

Another possible question is whether the act of tagging (or not
tagging) leafs in a data model has a legal liability component at the
if the processing of data depends on such tags. Well, that surely
depends on what the presence of such a tag implies, does such a tag
control access to data on a NC/RC server (nacm:default-deny-all), does
it control storage of data outside a NC/RC server, does it control
processing of data outside a NC/RC server?

What you need I think are context (deployment) specific tags, static
data model tags likely only work for the (obvious) trivial cases and
may mislead people to be GDPR compliant while they are not.

/js

On Wed, May 26, 2021 at 09:49:32AM +0000, Balázs Lengyel wrote:
> Hello,
> 
> Netconf/Restconf can transfer a lot of data. Some of this data can be
> personal/private like end-user names, personal phone records, street
> addresses. Is there a way to marks such data as private? I am thinking about
> something like putting a YANG extension in the data models:
> 
>  
> 
> extension private-data {
> 
>     description
> 
>       "Indicates that a leaf or leaf-list contains private data.
> 
>     argument privacy-type;
> 
>   }
> 
>  
> 
> Is there any standard solution for this or any proposal ? In the world of
> GDPR we should be thinking about this.
> 
>  
> 
> Regards Balazs
> 
>  
> 
> -- 
> 
> Balazs Lengyel                    Senior Specialist
> Ericsson Hungary Ltd. 
> 
> Mobile: [phone]              email: [e-mail]
> 
>  
> 



> _______________________________________________
> netmod mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netmod


-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <https://www.jacobs-university.de/>