Assess GDPR compliance for storing emails as part of incident reporting and OONI Run

[hellais]

Since we would like to know who created an incident for making it easier to verify and asses if it should be published or not (and not have random people from the internet create and publish them), we will store the email privately as part of the incident reporting platform.

We should have some lawyer give us feedback on what we should do in order to be compliant with GDPR.

[jbonisteel]

I have reached out to the Cyberlaw clinic at Harvard to see if they could help with this.

[jbonisteel]

Not a blocker for CIRP, but could be for OONI Run V2 - (mid-2024 timeline)

[hellais]

We have hired a lawyer for this

[jbonisteel]

This will be tested as part of the security audit for OTF. Realistically, we will probably get more value out of that audit.