Re: Idea: Reducing GDPR risk via automated log and data minimization

Gunnar Wolf <[email protected]> Wed, 7 Jan 2026 13:35:40 -0600
Newsgroups gmane.linux.debian.devel.project
Message-ID <[email protected]>
pedro vezzosi dijo [Wed, Jan 07, 2026 at 02:59:51PM -0300]:
>Thank you for your reply and for sharing your perspective.
>
>I would like to clarify one point, because I may not have expressed myself
>clearly.
>
>My concern is not about having AI “read” or analyze personal data as such.
>I fully understand that this can itself create additional GDPR and ethical
>risks. The point I was trying to raise comes more from an organizational
>angle.
>
>Given that there are currently no dedicated people in a GDPR-focused role,
>my worry is that privacy-related work may end up being purely reactive,
>with someone having to act as a “firefighter” on top of their main
>responsibilities. I was thinking about whether there could be more
>proactive approaches to data minimization, so that fewer problematic
>records exist in the first place.

I saw several media outlets picked up Andreas' call to form again the Data
Protection team. Don't take this as an issue that will take too long to be
resolved: several DDs have already answered to his call, and I am confident
a Data Protection Team will soon exist again.

In the meantime... Well, most Debian Developers I know are extremely well
aware and dilligent compared with population at large on this regard. I am
confident we have a strong set of people to take care of these issues.

>I also noticed that there is a debian-ai mailing list, and since I am new
>to Debian mailing lists, it is possible that this was not the most
>appropriate list to bring up this idea. If so, I apologize for the noise
>and appreciate the guidance.

The debian-ai mailing list is about packaging AI-related software in a way
amenable to our distribution. This would be the right list discussing
non-technical aspects of project decisions.

But yes, I agree with Antoine and Bart — it is extremely unlikely our
project would undertake large-scale analysis / classification / use of
personal data as described in your original post, at least as we currently
stand.


   – Gunnar.