Re:GitLab 11 released
by icebraining on Saturday June 23, 2018 @07:27AM
(#17380726)
Remember that the GDPR only applies to personal data. That is defined rather broadly, but it still might not apply to all the information you've mentioned.
In the EU IP alone could be considered PII, it would seem logical that hostnames are too, but I never saw it spelled out. The counters are sent in combination with these identifiers. The summary above is compiled from GitLabs own sources. Most probably don't care but some might.
> In the EU IP alone could be considered PII
that statement is wrong. first of all IP Addresses are only PII if you store them to identify users, means that if you are user table has an ip_address field, it is, however... if you store all ip's accessing your service in a database to find malicious logins it isn't. so basically the statement is, it depends. the connection of user to ip makes it PII.
I think we agree context is important. However GitLab is collecting IPs in combination with hostnames, not to mention the rest of the traffic that could easily be used to fingerprint users.
GitLab obtains affirmative consent to its use of personal data under privacy policy, plus users also have the ability to opt out if they wish revoke their acceptance.
GitLab collects information about usage from each self-hosted GitLab instance (Community Edition and Enterprise Edition) through a usage ping. The usage ping sends a payload containing data such as total number of projects and pipelines, as well as license information and hostname to GitLab.
...
The information from the usage ping is not anonymous, it is linked to the hostname of the instance [3]
...
The documentation is a merge request [4]
This MR loads the EE usage ping asynchronously on the admin application settings page and now includes the counts of the following items:
Comments Groups Users Projects Issues Labels CI builds Snippets Milestones Todos Pushes Merge requests Environments Triggers Deploy keys Pages Project Services Issue Boards CI Runners Deployments Geo Nodes LDAP Groups LDAP Keys LDAP Users LFS objects Protected branches Releases Remote mirrors Web hooks
[1]https://about.gitlab.com/privacy/ [2]https://about.gitlab.com/terms/ [3]https://docs.gitlab.com/ee/user/admin_area/settings/usage_st... [4]https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/735