Inser att jag aldrig la upp hela tråden jag haft med LWG, så här kommer den:
Hello,
We (the Swedish OSM community) are working towards using the newly (more) openly released High Value Data from Lantmäteriet, the national land survey of Sweden, in OpenStreetMap.
Annoyingly, Lantmäteriet have made the licensing situation somewhat convoluted; they have released the data under CC BY 4.0 but attached some additional terms. The reason for this is that they have determined that a lot of the data (including buildings and addresses) may be personal information under the GDPR, and they don’t want any risk that comes with the distribution. The full terms are available here (in Swedish, Google Translate does a decent job of translating it): https://www.lantmateriet.se/globalassets/geodata/geodataprodukter/anvandningsvillkor_for_vardefulla_datamangder_pu.pdf
So far, we’ve determined that we’ll need to request exceptions/clarifications on:
The DRM-issue (2a5B in CC BY 4.0)
Terms from Lantmäteriet that restrict the usage of data (such as 3.3) which isn’t actually allowed according to CC BY 4.0
(attribution is already clarified in their terms)
This leaves us with the general issue of personal information, especially in addresses (where it’s not possible to scrub it of PI without losing all value). We hope that putting them in OSM is fine (since many addresses already exist there), but just to make sure that we don’t make a mistake: Can we put data from a source which explicitly marks it as personal information under the GDPR into OpenStreetMap?
Legally, Lantmäteriet transfers the data processor role to the entity getting the data from them (so in our case the private citizen doing the import). We both want to make sure that that person doesn’t end up with any legal trouble, as well as that we don’t accidently put data into OSM that “poisons the water” by carrying legal restrictions or similar.
Jan Dalheimer
On behalf of the Swedish OSM community
Dear Jan,
Thank you for writing in. Could you clarify a few things for us?
We do not think that building outlines and addresses (without info on the name of the resident) are personal information because unless there is information on the resident, there is no information about a person involved. Has Lantmäteriet actually made a specific determination that building footprint and addresses are personal data, or are they just saying that there could be personal data in the variety of datasets they have released? What data exactly are you looking to import?
Also, the machine translation we has says the user is a data controller, not a data processor:
3.2 The user is the data controller or has other legal responsibility for the personal data that it receives from Lantmäteriet. This means that the user is responsible for ensuring that the processing of personal data complies with the rules in the GDPR.
Is this translation right? Your note mentioned the entity getting the data being a data processor, and OSM cannot be a data processor to anyone.Thank you,
Kathleen Lu
They have commissioned a legal examination (or what it’s called) on the topic. The reasoning is basically that an address (or a unique ID for a building) in itself may constitute personal information for single-person dwellings (i.e. if you have an address “Church Street 5” which is for a single building with a single occupant, then “Church Street 5” can uniquely designate that person, and is thus personal information). I don’t have enough of a legal background to really evaluate that claim, it does feel strange, but I can also follow their logic. But at the same time there is also a lot of talk about combined data sets (i.e. it becomes personal information when combined with other data).
The translation is correct, I was wrong in my original email, Lantmäteriet by way of the T&C place the data controller (sv. personuppgiftsansvarig) role on the person accessing the data from them. That’s why we’re worried that if we’d do something wrong then the volunteer would open themselves up to legal risks.
Hi Jan,
Upon discussion, we have concluded that while we can’t speak for the interpretation of Sweden’s government, it is OSMF’s position that mere street addresses or other physical descriptions (e.g., building outlines) are not personal information under GDPR unless there is other information present (such as name of the owner or occupant of the building, etc). This position is consistent with the position of other European governmental bodies. Thus, when you seek a waiver on the other items, there is no need to also bring up GDPR/personal information.
Best,
Kathleen Lu
on behalf of LWG
