Re: Call for volunteers: Data Protection Team

Daniel Gröber <[email protected]> Fri, 2 Jan 2026 09:51:25 +0100

Newsgroups	gmane.linux.debian.devel.project
Message-ID	<g5newkwrd6igbw44ovqqroeu7kjyvjkmclj5wsecjkzspkeujr@vp3m6y4mpouu>

Hi Andreas,

Thanks for dealing with this 

On Fri, Jan 02, 2026 at 08:51:00AM +0100, Andreas Tille wrote:
> The Data Protection Team was started in 2018 in the light of new
> European data protection legislation, to provide a point of contact for
> external queries about what data Debian holds, and to advise Debian
> members about the project's data protection obligations. The team drew
> up the public privacy policy[0], and has passed on requests from
> individuals as appropriate.
> 
> All three delegated members of the Data Protection Team have now stepped
> back from this task. I would like to sincerely thank Jonathan McDowell
> (noodles), Tollef Fog Heen (tfheen), and Matthew Vernon (matthew) for
> their work on the team.  As they have stepped back from the role, their
> delegation is hereby revoked.
> 
> The fact that all team members have stepped back at the same time should
> make it clear that we urgently need new volunteers to fulfil this role.
>
> Despite a constructive discussion at Debconf this year, no-one has come
> forward to join the Data Protection Team, and the existing team have all
> resigned. This means that currently any data protection enquiries come
> to the DPL, who already has too much to do.
> 
> If you're interested in data protection / privacy, and would be
> interested in improving the existing privacy policy and working with
> teams who process personal data to improve the workflows for handling
> data protection-related requests, then please get in touch!

Looking at the current delegation text this smells like a burnout job to me
(definition: high expectation + low control).

While I don't think I have the capacity to help with the ongoing work here
I'd love to help you re-draft the delegation to try and make the work of a
future team more rewarding going forward.

What do you think about scheduling a (semi-?)public jitsi call to discuss
this?

I the meantime providing an answer to the all important workload question
could help people decide if they want to volunteer for this:

 - How many GDPR inquiries did the existing team receive in the last year?
   (or month if that's easier to check)

Thanks,
--Daniel

PS: I'm moving my reply to [email protected] instead of devel since it's
organizational matters.

signature.asc (application/pgp-signature, 833 B)