Rather more eloquently asked than by the other person I saw querying this[0]! I suspect it's covered under Github's TOS - specifically[1], only public repositories were included and these are all effectively just backups. Especially in the case of the vault in Svalbard. But you can opt out of the 'warm storage'[0].
I recognize they wouldn't have done it unless they felt confident of having the legal right, but it's just bad manners not to ask first.
If that's the case, this not-a-PR stunt degraded my impression of them.
I'm quite certain this isn't what their customers contemplated when reading "backup" in their ToS.
EDIT: Interestingly it says "This license does not grant GitHub the right to sell Your Content or otherwise distribute or use it outside of our provision of the Service.
It also says "You still have control over your content".
Is a subarctic vauly really within the ordinary course of providing the service? Did content owners have an opportunity to exert any control?
Most probably think it's neat, but GitHub would be naive to imagine everyone would consent.
Also what happens if it turns out one of those repos had personal information in it and the subject makes a GDPR right-to-forget demand? Are they going to drag it out and purge that bit of tape?
>Also what happens if it turns out one of those repos had personal information in it and the subject makes a GDPR right-to-forget demand? Are they going to drag it out and purge that bit of tape?
I believe GDPR has exemptions for archives ([0] section 28) so that's less of a concern for them I imagine. I recognise what you're saying, but I think anyone _very_ opposed would have a difficult time in court arguing GitHub should remove their work/name/etc. My (very loose) understanding of the law is that they would have to demonstrate some kind of loss.
That being said, GitHub could just have sent a notification email with very little effort. Maybe 'no harm, no foul' applies here?
