Ask HN: Is there an open source license that requires you share data collected?

https://news.ycombinator.com/item?id=12090540

by andrewtbham • 10 years ago

10 8 10 years ago

news.ycombinator.com

Ask HN: Is there an open source license that requires you share data collected?

So, let's say you open source a web chat program. Is it possible to specify it is free to use but you must share any data collected with the research community.

If not, would such a license be feasible legally?

viraptor• 10 years ago

Depends on the meaning of free you use. It would be incompatible with GPL, but compatible with many less restrictive ones like MIT/BSD. Of course you can write your own licence, but whether that's enforceable you'd have to talk to a lawyer. Details would likely matter there - how do the results have to be published, for how long, who to (it could conflict with local laws about not selling tech to country X for example), etc.

Of course there's still the question of who would care to follow the licence. Did you think about doing to in terms of incentives instead? For example a cheaper version which always (or opt-out) uploads the results and a considerably more expensive one which doesn't. If you're thinking about releasing it free with the source, how about official compiled package which publishes the result, but that you can compile yourself with that option turned off?

andrewtbham3• 10 years ago

I mean free. Free as in speech and beer. maybe use the MIT license but add something about data being free.

Another example would be... if you wrote search engine crawler. you would have to do something similar to common crawl.

the idea is... if you write open source tools for collecting big data. how can you get people to share it.

benjaminjosephw• 10 years ago

So some kind of Share-Alike license? Perhaps this: http://opendatacommons.org/licenses/odbl/summary/

andrewtbham3• 10 years ago

Yeh sorta....

I guess what I am thinking is a license similar to MIT but with the provision that you agree to share data collected using the ODC Open Database License.

Would this make any sense? Is it legal? Is it enforceable?

yulaow• 10 years ago

Privacy Laws. In some countries (eg the whole EU) privacy laws about data are VERY strict and I don't think you can force them with just a license. To make an example here you must identify in a sort-of-contract who are the people who manage (in any way) the data, for which explicit purpose and for how much time. Also you have to give a way to delete it in a permanent way. And typically you cannot share that data with third parties not explicitly know at the moment in which you write the contract and the user accept it (you can't be vague, they must be people with name/surname/etc or companies).

So consider that, in most cases, your program cannot be used if there is even a single data relatable to privacy laws that it gathers (and again, here in EU even temporary geolocation is considered covered by privacy).

andrewtbham3• 10 years ago

Ok, if that's the case people from the EU couldn't use the software. I'm not sure that it would be a problem especially if the service was anonymous.

So for instance... free tools for making a search engine, but you have to publish all the searches. If the searches were anonymous, I'm not sure it would be a privacy concern.

tobylane• 10 years ago

Facebook and many other major US tech companies comply with the EU standards for their own benefit as well as customer trust.

The searches themselves are de-anonymizing, see https://en.wikipedia.org/wiki/AOL_search_data_leak

newman8r• 10 years ago

Do you think your end users want to use a chat platform where they know are being monitored by a small startup? It makes it a bad decision for businesses that handle any sensitive info, and if you are going for noncommercial use there's a myriad of options that don't send user data into the void.

as far as your actual question - it depends on what "data collected" you're referring to. Can any of the data identify the users, etc? If you provide an API that they need to plug into, or make it all SAAS then sure, it's at least physically feasible at this point.

But it almost sounds to me like you're asking people to manually send them data from some local installation - or you want to send them a demand notice for system data if they don't - or you want to prevent them from blocking some monitoring service. To me that does not sound realistic even if it was legally feasible.