GDPR compliance

[JPenuchot]

---

Is your feature request related to a problem? Please describe.

I'm worried that data collection being turned on by default in vcpkg isn't legal under EU law, as the General Data Protection Regulation mentions in the article 25:

The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

Proposed solution

Replacing -disableMetrics with -enableMetrics

Describe alternatives you've considered

Removing telemetry altogether since the project already already has substantial voluntary feedback thanks to the 1'000+ issues and 200+ pull requests as of writing this

[heydojo]

I'm worried that data collection being turned on by default in vcpkg isn't legal under EU law

I'm no lawyer. My understanding of GDPR is that it applies to personally identifiable information.

3eb3b62#diff-04c6e90faac2675aa89e2176d2eec7d8

The data collected by Microsoft is anonymous.

The project's readme even provides instructions to disable anonymous telemetry if you so wish.

I'd like to offer out that despite not personally believing that any collection of telemetry is necessary, I can understand the value of statistics to managers at Microsoft when they need to sign off on development time and resources (which all need to be paid for.)
Seeing popular features being used also helps developers understand where to prioritise their efforts and allows managers to offer direction and monitor the direction of the project if necessary.

I don't know what the culture is like at Microsoft but vcpkg is a pretty cool, very active product and if Microsoft just want to know what people are doing with it, I think that's a pretty fair trade in exchange to be able to use it.

[JPenuchot]

I found more details about what constitutes "personal data" on the EU's website, and even cookie IDs are considered as personal data.

Now here's what the docs say about data collection:

We generate a completely random UUID on first use and attach it to each event.

Which is basically the same as a cookie ID.

Regarding consent: it's clearly mentioned that data can't be collected without user intervention to give their consent. There's no doubt about it.

I think that's a pretty fair trade in exchange to be able to use it.

Microsoft has interests in maintaining a widely used package manager that supports their ecosystem, even without telemetry.

Again, a replacing the -disableMetrics flag with an -enableMetrics flag would be enough to ensure vcpkg follows the GDPR.

[Neumann-A]

Regarding consent: it's clearly mentioned that data can't be collected without user intervention to give their consent. There's no doubt about it.

Since typing vcpkg install requires the user to type it out and the telemetry is mentioned after the build it could be added that running vcpkg install with telemetry enabled is giving consent to the collection of the telemetry data.

-disableMetrics flag with an -enableMetrics

this probably does not affect anything from a law perspective since running vcpkg is the data collector not building it.....

[ghost]

@JPenuchot you can always append the --printmetrics to each vcpkg command to see what vcpkg telemetry will/would actually send if it is active.
https://github.com/microsoft/vcpkg/blob/master/docs/about/privacy.md

• I understand the concern from both points of view, the telemetry data helps management and MS justify and decide where to focus its priorities and such as mentioned by @heydojo.
• As far as the legalities involved, that would be something someone practicing EU law would need to way in on...
• My opinion as I have seen in many other software packages I have installed, the bootstrap-vcpkg.bat or bootstrap-vcpkg.sh query the installer whether the machine is subject to the GDPR privacy laws?
  • yes then -disableMetrics can be appended to the bootstrap-vcpkg process,
  • no leave the Metrics telemetry active
  • of course someone subject to GDPR still could allow metrics telemetry to collected and sent by answering no...
    Just a thought....

[strega-nil]

As I understand it, our legal team has okayed our way of doing this; I don't know anything about the technical aspects, however. @dan-shaw, do you have anything to add?