Re: Idea: Reducing GDPR risk via automated log and data minimization
Gunnar Wolf <[email protected]> Wed, 7 Jan 2026 13:35:40 -0600
| Newsgroups | gmane.linux.debian.devel.project |
|---|---|
| Message-ID | <[email protected]> |
pedro vezzosi dijo [Wed, Jan 07, 2026 at 02:59:51PM -0300]: >Thank you for your reply and for sharing your perspective. > >I would like to clarify one point, because I may not have expressed myself >clearly. > >My concern is not about having AI “read” or analyze personal data as such. >I fully understand that this can itself create additional GDPR and ethical >risks. The point I was trying to raise comes more from an organizational >angle. > >Given that there are currently no dedicated people in a GDPR-focused role, >my worry is that privacy-related work may end up being purely reactive, >with someone having to act as a “firefighter” on top of their main >responsibilities. I was thinking about whether there could be more >proactive approaches to data minimization, so that fewer problematic >records exist in the first place. I saw several media outlets picked up Andreas' call to form again the Data Protection team. Don't take this as an issue that will take too long to be resolved: several DDs have already answered to his call, and I am confident a Data Protection Team will soon exist again. In the meantime... Well, most Debian Developers I know are extremely well aware and dilligent compared with population at large on this regard. I am confident we have a strong set of people to take care of these issues. >I also noticed that there is a debian-ai mailing list, and since I am new >to Debian mailing lists, it is possible that this was not the most >appropriate list to bring up this idea. If so, I apologize for the noise >and appreciate the guidance. The debian-ai mailing list is about packaging AI-related software in a way amenable to our distribution. This would be the right list discussing non-technical aspects of project decisions. But yes, I agree with Antoine and Bart — it is extremely unlikely our project would undertake large-scale analysis / classification / use of personal data as described in your original post, at least as we currently stand. – Gunnar.