Notes on GDPR Compliance of Matrix.org (With Data Leak Disclosure), Part 2 (opens in new tab)

Thank you for bringing our "failing out", which has an impact on the Personal Data leak itself, so I really hope people will look into it.

As for "with the general matrix community", I believe the amount of projects and people we talk to, and still are in rooms with (which are public) will be the proof of that.

I hope you'll enjoy the read, since we believe this is not the first data leak of this kind and that your personal data might very well have been leaked if you're a Matrix user.

Because our document could be collected and processed illegally under GDPR. That the operator makes the conscious choice to have their name listed on their own organisation's website they are from is their own choice. Their organisation is processing their data, not us. They have the right to object to that, and the right to erasure of their personal data if having their name is listed.

They were not given the choice to be part of our publication and therefore, we have no lawful basis to use their name since 1) they did not give us consent and 2) they would not have understood (we didn't say) nor expect (it was a private chat) that we will use their personal data - making Legitimate Interest not possible.

The only way we could be GDPR compliant for being Accountable and not break a lawful basis was to not use their name but the name of their role under their obligations towards us, and linking to the blog post instead (Accountability of what we claim).