Audacity gets a CLA [LWN.net]

Audacity gets a CLA

Posted Jun 17, 2021 2:29 UTC (Thu) by jwoithe (subscriber, #10521)
Parent article: Audacity gets a CLA

One aspect of all this which appears to have been overlooked is the personal information requested when signing the CLA. A careful comparison between the Musescore and Audacity CLAs is instructive. For Audacity, signing requests a full name, github username, email, mailing address and phone numbers. However, all except the first three appear to be optional at present. However, in the Musescore case these additional fields are not optional. Given that both Musescore and Audacity are now controlled by the same organisation, one suspects that the Audacity CLA may be made consistent with Musescore's CLA at some point in the future (although I hope that it goes the other way, with Musescore making the mailing address and phone number fields optional). This is a concern, since the disclosure of so much personal information will be an impediment to many developers who might otherwise wish to get involved - especially since there's no obvious reason why details such as mailing address and phone number are needed.

I have not yet been able to locate a Privay Policy on the Audacity website which covers items such as the new CLA. The Musescore site does have one, which indicates that the "data controller" is an entity in Russia[1]. There is nothing else to indicate where the data might be stored, so naturally it seems that it will be on servers in Russia. Assuming that the Audacity project will at some point adopt a similar privacy policy[2], this too might become a barrier for some potential contributors.

To be clear, I am not suggesting there is anything untoward going on with either Audacity or Musescore, and retain an open mind as to what the acquisition means for Audacity into the future.

----
[1] From the "About this Notice" section of the Musescore Privacy Policy:
For the purposes of this Notice, WSM Group with registered office at Moskovsky pr-t,40-1301, Kaliningrad, Russia, 236004 ("MuseScore", "us", "we", or "our") acts as the data controller for the Personal Data that is collected via the Website and the App and through the Service. As a data controller, MuseScore is responsible for ensuring that the processing of Personal Data complies with applicable data protection law, and specifically with the General Data Protection Regulation.

[2] Which seems likely as the people running Musescore are now also running Audacity.

to post comments

Audacity gets a CLA

Posted Jun 17, 2021 10:38 UTC (Thu) by Wol (subscriber, #4433) [Link]

> However, in the Musescore case these additional fields are not optional. Given that both Musescore and Audacity are now controlled by the same organisation, one suspects that the Audacity CLA may be made consistent with Musescore's CLA at some point in the future (although I hope that it goes the other way, with Musescore making the mailing address and phone number fields optional).

One would hope that someone would point out the GDPR places an obligation to collect the MINIMUM amount of data needed, and keep it for the SHORTEST possible time.

Given that, most CLA's really require only name, email, and public PGP key. Although I suspect they may want address and phone number for legal reasons (as in assorted laws say they need it), rather than they actually want it.

Most legal documents require this so you can be tracked down at a later date if necessary ...

Cheers,
Wol