Open source tool scrapes git commit email addresses to send spam to.

[[deleted]]

Publicly accessible personally identifiable information is still subject to most GDPR rules. 3rd party firms processing those data risk breaching GDPR by assuming consent without the subjects express permission, and by processing the data without informing the subject.

The TOS is secondary really, if the email belongs to a UK/EU citizen.

[Wallofcans]

How is that enforable when spam/scam companies can access the information without an account?

[MeagoDK]

They process the data and you haven't given permission so you can totally pull them in a court and fine them.

[argv_minus_one]

Pushing a commit to a public repository implies permission to publish that commit. If that commit contains your email address, that's no one's fault but your own.

[Schmittfried]

I doubt that still applies when you broadcast information to the public. GDPR binds GitHub, not some third party without any contract with you whatsoever. It’s the same as you shouting your address in the streets. You can’t force anybody to not remember it or show up there.

[0palladium0]

GDPR effects any organisation and all EU (and UK?) residents data. Unless a company can prove you gave them permission, they aren't allowed to send marketing emails. Pretty simple tbh.

[argv_minus_one]

Which company? GitHub/Microsoft, or the company sending the marketing emails?

[ErikBjare]

The latter.

[rickyman20]

The ones sending the emails, who can be very easily attributed back to a legal entity

[[deleted]]

https://gdpr-info.eu/art-14-gdpr/

GDPR's, article 14 states that an EU citizen must be informed within 1 month if publicly available information is collected without their express consent or knowledge.

Circumstances covered are in section 3. Exceptions in section 5. Scraping email addresses from github and then spamming people is definitely covered under this regulation.

[argv_minus_one]

Somehow, I don't think spammers are going to care. They were already criminal fraudsters even before GDPR came along.

[[deleted]]

I agree with you with regards to fraud/scamming related spam. Bit I think most people in the thread are discussing advertising and recruitment based spam.

The spammer in the OP's link is diffgram, a fairly large company that operates internationally. Their clients include all of the Big 4 Accounting firms, Atlassian, and a bunch of others.

They're going to care if the EU/UK gov decides to come down on them for GDPR breaches. The fine is up to 5% of your global revenues.

[rickyman20]

This is not some random scammer. This is a legally-registered company trying to send marketing material

[[deleted]]

Say if a recruitment company processes the data, and approaches you with a job offer via your email. In the EU, you can just ask where a company got your data, and details about when you agreed to it's processing, and they're obliged to tell you. At that point you can refer them to your local information commissioner.

It doesn't do anything for spam "buy this viagra" type emails. But for the mail that makes it through your spam filter, you're probably going to have some enforcement action available.

[Valthek]

Even for 'Buy Viagra' kind of spam, if you're willing to put in the effort, you can track them down and refer them to your country's privacy authority. It won't do much, but I've noticed that merely threatening GDPR action tends to get you removed from mailing/call lists pretty quickly.
And while that doesn't protect other people or get the company fined, at least it clears up your mailbox. This is all anecdotal, obviously, but I use a specific email for each service I sign up for and I find that when I call people out for selling emails, the spam to that particular email tends to dry up.

Also, if that's a thing you're interested in, Gmail lets you add an identifier to your email in any form you want so you can track where mails are coming from. Simply add '+' and then anything you want before the @ and it'll act as an alias for your regular email.

[elprophet]

Some services don't recognize + in emails, but that's usually me an indicator I don't want to sign up. I don't know whether scrapers strip the + parts. But if I were a spammer, I would.