EU GDPR issues: are we subject to this?

[mariotti]

Hoi all,

I am normally working on the web part of the world, and there I get involved with the GDPR for EU.

Is it possible that we could have privacy issues with meshtastic?

Anybody ever checked this side?

There is a particular side of meshtastic that might be an issue,
i.e. sharing basically the MAC or the ID (which is the last part of the MAC)
over the mesh and not only for point to point communication.

I am not sure,
Anybody involved in these issues?

Thanks
A+
F

[linker3000]

IANAL, but I have worked on general IT-oriented GDPR material for a business in conjunction with their legal department. This is my opinion and is not legal advice:

• For an individual operating a node - not in scope. Recital 18: “This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Would someone argue that operating a node is a professional activity? Maybe?
• For an organization operating a node - yes, needs DPIA and full compliance documentation and ways of working.
• For an organization allowing an employee or other individual to use their premises to host a standalone node - it would be wise to seek legal advice and it would be good to have in place a document / agreement about who owns the node and who is and is not acting as a data controller/processor.
• For an organization allowing an employee or other individual to use their premises to host a node which is connected to the organization's network - definitely worth having a document / agreement, as per the previous point, which also includes data path (landscape) diagrams. I'd be inclined to limit data connectivity to a 'Guest' network for the avoidance of any doubt.

If you have concerns, seek proper legal advice.