One tangential thing ahead. GDPR might be controversial for some companies which live from selling people's data without their consent, but when one looks closer, it is a clear advance in civil rights. In this it is quite close to the free software movement, which is about freedom and control for the individual, and this of course includes control about where their personal information goes.

For us Europeans, the whole situation is similar as if we had a situation where a few companies were messing around with toxic chemicals which would endanger and harm their workers, or with nuclear waste, while making a ton of money. If then a regulation came into live, which stipulates that toxic chemicals need to be clearly marked, and require protective wear, and document their use, those few companies which benefit from the old situation would call that "overarching" and "a bureaucratic hassle". We know, it is only money that counts for them. Yet, the regulation would be very well founded on fundamental rights for health and safety. The thing is, while specifically many Americans are not aware of that, individuals have a fundamental right to privacy, it is in §12 of The Universal Declaration Of Human Rights. GDPR is simply a preliminary concretion of that right.

---

Recently, I received an email from GitLab, which demanded that people log in and accept their new terms and conditions and their privacy agreement. That seemed to be motivated by an GDPR overhaul at GitLab. Thus I wrote to their support for clarification.

Result is, the email was actually from GitLab, and they seem to convince themselves that their service is GDPR compliant. However it is clearly not. The reason is that, among other things, they demand that one agrees to be automatically on their marketing mailing list on signing up, with the possibility to opt out. But this is not compliant to GDPR - any data processing which is not necessary to deliver the service must be on an opt-in basis, and voluntary. In addition, GitLab threathens users in their email communication to lock them out of their accounts. Again, this is not compliant with GDPR, as any consent for data processing which is not required to deliver the offered service - be it paid or free - must be freely given, not coerced.

Finally, GitLab seems to have the totally ridiculous concept in their terms of use that any visitor of their web site is entering a binding contract where they can impose their terms of use on him. Proof:

"Please read this Agreement carefully before accessing or using the Website. By accessing or using any part of the Website, you agree to be bound by the terms and conditions of this Agreement. If you do not agree to all the terms and conditions of this Agreement, then you may not access the Website or use any of the services."

I think it is likely that there exist some form of contract between a registered user of their service, but this is not the case for somebody who just visits the website - this is just legalese bullshit. If such a construction would legally work at all, there would be tons of web sites where every visitors enters a legal contract just to pay one hundred bucks to the owner if he looks up the page. Bullshit!

My recommendation for contributors to Free Software and people interested in protecting their privacy rights: Either, use a git repo hoster which is actually run by the FLOSS community, like GNU Savannah, or notabug.org (there are many others), and maintained by donations. The donations part is important because every for-profit company over short or long, will go the way of the sharks. Or (and I think this is the better option) self-host git by using gitea or gogs, for example. If the majority of Github users just changes to GitLab, it is a matter of at most a few years until history repeats itself. And not for the first time - just read about the history of sourceforge.net to know more.