GDPR erasure design names Article 5(1)(b) as the lawful basis for logging operator identity; the lawful bases are in Article 6 (F-W1-PROCESS-04)
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- Half a day
- Newbie friendliness
- 42/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Active
- Domain
- documentation
Research direction
The wrong citation is in docs/design/gdpr_erasure.md at line 300, in the personal-data table; the living-spec status claim is at lines 3-15, and the Article 17(3)(b) audit-log lines (59, 167, 242, 283) are tracked separately in #101. Read the table row and the GDPR text for Articles 5(1)(b) and 6(1), then correct the basis and name the regulation for each article cited. Done means Article 6(1) is cited with the controller choosing the basis, Article 5(1)(b) stays as the purpose-limitation constraint, and the owner of the legal mappings has signed off on the wording.
Written by the indexing model from the issue text.
Description
Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix
Summary
The personal-data table in the GDPR erasure design says the identifiable operator field on every audit event rests on "the explicit Article 5(1)(b) lawful basis". Article 5(1)(b) is the purpose-limitation principle; the grounds for lawful processing are listed in Article 6(1). A deployer reading this living design gets the wrong legal basis for the one audit field that is always personal data.
Primary finding
F-W1-PROCESS-04 — The GDPR erasure design cites a principle as the lawful basis for logging operator identity
severity Medium · confidence high · checked against the GDPR text; not legal advice
What happens. docs/design/gdpr_erasure.md:300; the design presents itself as the living specification of the implemented feature (docs/design/gdpr_erasure.md:3-15). The same row cites "Article 12 record-keeping" without naming the regulation — that is the EU AI Act's logging article, not a GDPR provision. The design also repeats the blanket Article 17(3)(b) exemption for the audit log at :59, :167, :242 and :283; that claim is tracked at :48 in #101, which now lists these lines as well.
Where.
docs/design/gdpr_erasure.md:300docs/design/gdpr_erasure.md:3-15(living-spec status)
Evidence (re-verified on 2026-10-09).
- Regulation (EU) 2016/679: Article 5(1)(b) sets out purpose limitation; Article 6(1) lists the lawful bases for processing (https://eur-lex.europa.eu/eli/reg/2016/679/oj).
- The design is unchanged on
development; it has no Turkish mirror.
Recommended fix. Cite Article 6(1) and say that the controller chooses and documents the basis — for example Article 6(1)(c) where a legal obligation requires the record, or Article 6(1)(f) legitimate interests — keep Article 5(1)(b) as the purpose-limitation constraint, and name the regulation for every article the table cites. Have whoever owns the legal mappings review the wording.
Related. #101 — the blanket Article 17(3)(b) audit-log claim in the same design.
Acceptance criteria
- The design names the correct GDPR article for the lawful basis and the regulation of every article it cites.
- The wording is reviewed by the owner of the legal mappings.
- The finding is resolved or explicitly closed with a reason.
Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.
- Dominant language
- Python
- Stars
- 9
- Forks
- 1
- Avg merge
- 8h 10m
- Merged PRs (30d)
- 5
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HodeTech/ForgeLM
-
area: dev-tooling bug severity: low source: roadmap wave: 4
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Site: the theme-locked --code-comment grey (#6a6f80) on the dark code surface is 3.8:1, below WCAG AA, in both themes (F-W1-SITE-06)Possibly taken @vortsghost2025 claimed this today. Openarea: site bug good first issue severity: low source: review-2026-09 wave: 4
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
documentation good first issue severity: medium source: review-2026-09 wave: 3
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
documentation good first issue severity: low source: review-2026-09 wave: 4
Difficulty 1/5 1-3 hours Newbie friendliness 80/100
-
documentation severity: medium source: review-2026-09 wave: 3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
All issues in HodeTech/ForgeLM
Similar issues
-
Difficulty 1/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
tharje/spooler-v2#20 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Bump version of azure-servicebusPossibly taken @joostlek claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
home-assistant/core#186275 ·
Maintainers usually reply within 1 day
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 72/100