Preserving non-central and privacy with a "permission recording keyserver"

[Bernhard Reiter]

Am Mittwoch 10 Juli 2019 03:13:48 schrieb Ángel:
> On 2019-07-09 at 19:45 +0200, Michał Górny via Gnupg-devel wrote:
> > I don't really understand why e-mail validation is proper consent to
> > real name which is not verified at all.

Because if the real name is not enough to identify a person, it is not 
personal data. So we publish is as non-personal data and do not need
consent.

> For validation you need a clear identifier. When you have an email you
> can easily validate its owner accepts it to be published, but if there's
> anything else attached to it, such as a secret you can't really validate
> it.

And you don't need to, we do not want to "validate" it, which is impossible,
we just want to avoid abuse and allow anonymous usage.

> Suppose someone uploaded a key named:
>  clarkentissuperman <lex at lexcorp.com>

Which obviously isn't a personal data of "clarkent", because it is not
his email address.

> Now someone comes called Clark Kent (he provides a government issued
> identification showing that), stating that such key is framing him.

So the operator of the keyserver gets an email by Clark and sees by the 
description that this really is personal data of him, then this operator 
would manually record a deletion for this pubkey in question and note
the explanation down (for later requests).

Regards,
Bernhard

-- 
www.intevation.de/~bernhard   +49 541 33 508 3-3
Intevation GmbH, Osnabrück, DE; Amtsgericht Osnabrück, HRB 18998
Geschäftsführer Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20190710/a89be7e0/attachment.sig>