2026-08-28 - Legal - Global Privacy Laws

Legal Data Considerations Platform Terms

Overview

A primary feature of the Izara Project is self governance requiring the highest levels of transparency but to stay in line with global privacy laws there is personal information that the platform is not allowed to make public, and right to erasure laws require the platform to create processes that upon request delete personal identifiable information and anonymize users activity.

Personal Data

• Izara wants as much information to be as public as possible, so it is important to determine legally the limits of what data can be presented to the community
• Different jurisdictions have different limits, if resources required to stay legal in all jurisdictions are not possible for the project err on the side of caution in order to not break laws

What Data is Private

• email is considered Personal Data, must be private
• phone numbers are considered Personal Data, must be private
• name ?

Address

• the level of a users address that is considered private is vague, must study more to create standards for the platform
• allowable levels of an address (eg to city) do show publicly
• perhaps fix customtext as private, or allow user to set which parts are private
• separate project that handles private details, same as email/phone

Personal Data in Unprotected Objects

• planning on not erasing submitted data in general use objects such as comments, products, attributes, but anonymizing the link to the user after erasure
• If user puts personal data into those objects they will not be erased, and maybe in backups
• Maybe always warn user of this when submitting data
• Perhaps not liable to proactively find this data during erasure request, if have clear warning when user submits data
• But user might still request it's removal on an instance by instance basis, which will be difficult if not build process for doing so

Juristic Persons

• For almost all jurisdictions juristic persons are not covered by privacy laws and all information can be public
• Making user explicitly confirm they are registering as a juristic person and their data will be public helps protect platform
• South African is an exception, personal data for juristic persons should be private

Right to Erasure

• Platform must remove personal data and anonymize activity within set time frame after request from user
• No storage or records of data is allowed except for critical tasks such as fraud protection, and under those cases the data (or eg hashes) cannot be public and must have strong data protections
• User has the right to choose what data is deleted, so perhaps allow them to choose which objectTypes or all
• Data backups etc must take into account handling of erasure requests

• must study what data users can demand be deleted, and what can legally be maintained

Anonymization

• no method of connecting activity to users history is allowed

Fraud Protection

• hashes can be used to detect whether a user is creating a new account to bypass platform terms
• when a match is detected this situation cannot be recorded anywhere because it links the new user to old data
• strict limitations are required when matching to old deleted data, eg message saying account cannot be opened with option to escalate to a secure team that handles the situation with limited protected access to data recorded for fraud protection reasons (allowable limits must be investigated if this is implemented)
• vector database is a possible method of closely matching new user data to previously deleted user data without recording personal information
• can use cryptographic hashes to check matches but might have to salt them (randomize a little) however are strict rules about protecting keys for salting

Financial Reasons

• Data such as name and address can be recorded for financial requirements such as outstanding bills
• Process must be clearly specified in terms of service
• Protocol must be implemented so after financial reasons are clear (eg accounts clear) data is removed