Write privacy-and-applicable-laws documentation (GDPR Art. 17 position)

[npstorey]

Summary

Write civic-ai-tools/docs/legal/privacy-and-applicable-laws.md covering the project's position on privacy, applicable laws (notably GDPR Article 17 right-to-erasure), lawful basis for signing, children's-data handling, and cross-jurisdictional applicability. Substantive piece for DPG Indicator 7 and useful well beyond DPG (standards-track engagement, academic adoption, partner agreements).

Background

The architecture has interesting things to say about the privacy/integrity tension and they need to be written down as a coherent doc. The publication-irreversibility property — a load-bearing consequence of attest-by-default / publish-by-choice — is in real tension with GDPR Article 17's right-to-erasure. The architecture has good mitigations (attest-by-default, withdrawal meta-attestations, host policy de-listing, content-vs-commitment separation), but they need to be articulated.

DPG Indicator 7 expects evidence that the project is "designed and developed to comply with privacy and other applicable laws."

Scope

civic-ai-tools/docs/legal/privacy-and-applicable-laws.md (~3-5 pages) covering:

1. The GDPR Article 17 tension, named honestly.
2. The architectural reasoning (cryptographic non-repudiation requires immutability).
3. The mitigations, each operationalized:
   • Attest-by-default keeps most claims out of the public corroboration network.
   • Author-signed withdrawal meta-attestations express retraction intent (originals persist; author's position visible).
   • Host policy can de-list withdrawn claims from display surfaces.
   • Content-vs-commitment separation lets heavy content be removed even when the signature artifact persists.
   • Subject-objection meta-attestations give data subjects a protocol-expressible voice.
4. Lawful-basis discussion: consent-based signing for authors; subject-of-claim handling for natural persons (links to proposed-issue 009 for the operational mechanism).
5. Children's-data position: protocol not intended for use with children's data without additional guardrails; recommended host policies for any host that serves claims with subjectCategory: minor.
6. Cross-jurisdictional applicability: jurisdiction-agnostic protocol; hosts implement local compliance.

Out of scope

• Operational implementation of subject-of-claim natural-person ontology (proposed-issue 009).
• Operational implementation of host self-attestation (proposed-issue 008).
• The harms section of the OES spec (existing issue Threat model documentation: enumerate what evidence-package signatures attest, by capture method #63 covers this, in coordination with this issue).

Acceptance criteria

• Document exists at civic-ai-tools/docs/legal/privacy-and-applicable-laws.md.
• DPG Indicator 7 has concrete evidence to point at.
• Document is linked from the DPG submission packet.
• Document is referenced from the OES spec's harms section (coordination with Threat model documentation: enumerate what evidence-package signatures attest, by capture method #63).

Dependencies

• Coordinates with Threat model documentation: enumerate what evidence-package signatures attest, by capture method #63 (threat model documentation by capture method).
• Coordinates with proposed-issue 009 (subject-of-claim natural-person ontology) — privacy doc references the operational mechanism.

Tracks

• DPG-readiness proposal: civic-ai-tools/docs/proposals/dpg-readiness.md Category P (to be promoted).