3

I'm using Bitbucket for a few projects, but as of April 28, 2014 they will replace their End User Agreement with a new Customer Agreement. The new agreement mentions in 7.7.2: "You will not submit to the Hosted Services ... any personally identifiable information" One of my projects clearly contains such information, and I'm now trying to figure out what to do. These are the three possible options I could come up with:

  1. I may keep all existing projects and continue to work with them, as long as no new patch involves sensitive data. This is under the assumption that what I have done so far has been in accordance with the current agreement, and that the new agreement only concerns information submitted after April 28.

  2. I have to remove that particular project, but may keep the others. This seems likely if 7.4 in the new agreement means that any data that have been submitted to the "Hosted Services" will be treated equally, regardless of under which agreement it was submitted: "Your Data" means any data, content, code, video, images or other materials of any type that you upload, submit or otherwise transmit to or through Hosted Services.

  3. I have to terminate the agreement, and thus remove my account and all of my projects. This is a possible interpretation if the continuation of 7.4, about the company's right to "collect, use, copy, store, transmit, modify and create derivative works of Your Data", means that they can still do whatever they want, even with data that were submitted under the terms of an older agreement and have since then been removed.

Anders Sjöqvist
  • 155
  • 1
  • 1
  • 4
  • In the US, personally identifiable information means things like your Social Security number, Driver's License number, Passport ID number, date of birth, or anything else that can uniquely identify you as an individual. – Adam Zuckerman Mar 29 '14 at 03:45
  • @AdamZuckerman, thank you for clarifying that. Yes, some of the things you mention are stored in plain text in that repository. However, my question was not about classification, but about what the agreement now requires me to do. – Anders Sjöqvist Mar 29 '14 at 03:52
  • What to do is a legal question. Consult an attorney. – Adam Zuckerman Mar 29 '14 at 03:54
  • Why don't you contact them to clarify? I would say that 2.) is the most sensible interpretation, but you won't know for sure unless they tell you exactly – DPM Mar 29 '14 at 04:42
  • @Jubbat, that's good advice, thank you! Yes, I've considered contacting them and will probably do so, but wanted to check if there was already consensus in the community first. Also, I wanted to be sure to have some kind of answer before April 28. – Anders Sjöqvist Mar 29 '14 at 04:56

2 Answers2

2

The answer is that you should comply with your understanding of the agreement, which means you have to choose one of those options. You seem to have a good understanding, and if you go ahead and comply you most likely don't need a lawyer to tell you so.

If you plan to keep using the service, and if you get paid for doing it and/or you may cause harm to anyone, then you must get competent legal advice. That won't protect you, but it will tell you how bad the risks are.

To add one option: you could encrypt the data. If it uses strong encryption and you absolutely do not part with the keys (you keep them personally and in a safe place) then you should be safe. You might still want to get legal advice.

Bear in mind that this change in the agreement is probably a coded signal that the company is being required to hand over its data to a government body (the NSA for example). If you keep using the service, and particularly if you encrypt the data, you may yourself get a visit from someone in a suit and tie. If that happens, it will probably be too late to ask for advice.

david.pfx
  • 8,105
  • 2
  • 21
  • 44
  • I agree with your last paragraph being a possibility. This other bit makes me uneasy: "you hereby grant to Atlassian a non-exclusive, worldwide, royalty-free right to (a) collect, use, copy, store, transmit, modify and create derivative works of Your Data". Nothing similar to this can be found in the old user agreement. Right afterwards they say "in each case solely to the extent necessary to provide the applicable Hosted Service to you". However the ample rights they grant themselves seem disproportionate for simply providing those services. – DPM Mar 29 '14 at 05:03
  • @jubbat: As I said, I think it's a signal and I think they're in CYA mode. – david.pfx Mar 29 '14 at 06:23
  • @Jubbat Packaging up a repository into a zip archive by a hosting provider may need the permissions to copy, store, transmit, modify and create a derivative work of the original material. That said, if in doubt, get a lawyer. –  Mar 29 '14 at 15:11
  • @Jubbat: Final thought: Atlassian is Australian, which means they play by US rules. Bear that in mind if you look for an alternate provider. Client-side encryption is the best, where available. – david.pfx Mar 29 '14 at 23:47
0

I think it means that you need to remove the project and or the personally identifiable information from the project.

On option 1 what is the point of having source code hosted somewhere if you can't update it? I don't think number 3 (terminating your account) is necessary, though as there is a reason this a change to the terms of use. The new terms of use were not in effect and you had not agreed to them when you checked in personally identifiable information.

I have to ask though, who do you dislike so much as to store their personal information unencrypted on a third party server that you have no control over?

On a side note chances are that atlassian's lawyers looked at their legal risk if their servers were compromised and realized that being responsible for personal information in source code repositories was a relatively large risk and not part of their core business model. So it makes sense for them to not want to be in the business of storing that type of information.

Frankly I can't think of a good reason to store personal info in source control outside of perhaps an error report email or similar.

stoj
  • 249
  • 3
  • 5
  • I basically agree with you, although you might have misunderstood option 1 slightly. What I'm suggesting is freedom to update the project, as long as the sensitive data are kept intact and never touched by the patches. – Anders Sjöqvist Mar 29 '14 at 05:18
  • To answer your question, the one I "dislike" that much is myself. There's a TeX file in this (private) repo with data that are publicly available anyway because of Swedish freedom of information laws, but that are still considered sensitive according to the agreement. One reason to keep such info together with source code might be to version control contracts, invoices with billing information or your résumé along with any deliverables sent to the same company. It's a way to keep things tidy, but I'm not saying that it's the only way. – Anders Sjöqvist Mar 29 '14 at 05:20