Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

GDPR erasure design names Article 5(1)(b) as the lawful basis for logging operator identity; the lawful bases are in Article 6 (F-W1-PROCESS-04)

未关闭
  • 哪里不对？
#886 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
半天
新手友好度
42/100
Issue 类型
文档
描述清晰度
基本清楚
活跃度
活跃
领域
documentation

调研方向

The wrong citation is in docs/design/gdpr_erasure.md at line 300, in the personal-data table; the living-spec status claim is at lines 3-15, and the Article 17(3)(b) audit-log lines (59, 167, 242, 283) are tracked separately in #101. Read the table row and the GDPR text for Articles 5(1)(b) and 6(1), then correct the basis and name the regulation for each article cited. Done means Article 6(1) is cited with the controller choosing the basis, Article 5(1)(b) stays as the purpose-limitation constraint, and the owner of the legal mappings has signed off on the wording.

由索引模型根据 Issue 内容生成。

描述

documentation severity: medium source: review-2026-09 wave: 3

Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix

Summary

The personal-data table in the GDPR erasure design says the identifiable operator field on every audit event rests on "the explicit Article 5(1)(b) lawful basis". Article 5(1)(b) is the purpose-limitation principle; the grounds for lawful processing are listed in Article 6(1). A deployer reading this living design gets the wrong legal basis for the one audit field that is always personal data.

Primary finding

F-W1-PROCESS-04 — The GDPR erasure design cites a principle as the lawful basis for logging operator identity

severity Medium · confidence high · checked against the GDPR text; not legal advice

What happens. docs/design/gdpr_erasure.md:300; the design presents itself as the living specification of the implemented feature (docs/design/gdpr_erasure.md:3-15). The same row cites "Article 12 record-keeping" without naming the regulation — that is the EU AI Act's logging article, not a GDPR provision. The design also repeats the blanket Article 17(3)(b) exemption for the audit log at :59, :167, :242 and :283; that claim is tracked at :48 in #101, which now lists these lines as well.

Where.

Evidence (re-verified on 2026-10-09).

  • Regulation (EU) 2016/679: Article 5(1)(b) sets out purpose limitation; Article 6(1) lists the lawful bases for processing (https://eur-lex.europa.eu/eli/reg/2016/679/oj).
  • The design is unchanged on development; it has no Turkish mirror.

Recommended fix. Cite Article 6(1) and say that the controller chooses and documents the basis — for example Article 6(1)(c) where a legal obligation requires the record, or Article 6(1)(f) legitimate interests — keep Article 5(1)(b) as the purpose-limitation constraint, and name the regulation for every article the table cites. Have whoever owns the legal mappings review the wording.

Related. #101 — the blanket Article 17(3)(b) audit-log claim in the same design.

Acceptance criteria

  • The design names the correct GDPR article for the lawful basis and the regulation of every article it cites.
  • The wording is reviewed by the owner of the legal mappings.
  • The finding is resolved or explicitly closed with a reason.

Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.

主要语言
Python
星标
9
派生
1
平均合并
10 小时 40 分钟
30 天内合并 PR
12

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

HodeTech/ForgeLM 的其他 Issue

查看 HodeTech/ForgeLM 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。