GDPR and the protocol implications

[adnidor]

On Fri, Jun 25, 2021 at 10:59:32AM +0200, Matthias Geier wrote:
> About gdpr and certificates. If I am not mistaken, before I even request
> the TLS certificate, I'd need to get a user consent, not to mention storing
> it.

Not necessarily. There are 6 possible justifications for processing personal
data:

Wikipedia - GDPR[0]:
> (a) If the data subject has given consent to the processing of his or her personal data;
> (b) To fulfil contractual obligations with a data subject, or for tasks at the request of a data subject who is in the process of entering into a contract;
> (c) To comply with a data controller's legal obligations;
> (d) To protect the vital interests of a data subject or another individual;
> (e) To perform a task in the public interest or in official authority;
> (f) For the legitimate interests of a data controller or a third party, unless these interests are overridden by interests of the data subject or her or his rights according to the Charter of Fundamental Rights (especially in the case of children)[7]

Most processing that gemini capsules do will probably fall under the last
point, and therefore doesn't require consent. (as an aside: most processing
that websites do also falls in that category, including stuff for which cookie
banners are show).

Also, if you are an individual, it is possible that the GDPR doesn't apply,
although I don't believe that there has been a court decision on this.

Please do note that I am not a lawyer and that you should do your own research
before relying on anything.

    adnidor

[0] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation