GDPR erasure design names Article 5(1)(b) as the lawful basis for logging operator identity; the lawful bases are in Article 6 (F-W1-PROCESS-04) #886

Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix

Summary

The personal-data table in the GDPR erasure design says the identifiable operator field on every audit event rests on "the explicit Article 5(1)(b) lawful basis". Article 5(1)(b) is the purpose-limitation principle; the grounds for lawful processing are listed in Article 6(1). A deployer reading this living design gets the wrong legal basis for the one audit field that is always personal data.

Primary finding

F-W1-PROCESS-04 — The GDPR erasure design cites a principle as the lawful basis for logging operator identity

severity Medium · confidence high · checked against the GDPR text; not legal advice

What happens. docs/design/gdpr_erasure.md:300; the design presents itself as the living specification of the implemented feature (docs/design/gdpr_erasure.md:3-15). The same row cites "Article 12 record-keeping" without naming the regulation — that is the EU AI Act's logging article, not a GDPR provision. The design also repeats the blanket Article 17(3)(b) exemption for the audit log at :59, :167, :242 and :283; that claim is tracked at :48 in #101, which now lists these lines as well.

Where.

• docs/design/gdpr_erasure.md:300
• docs/design/gdpr_erasure.md:3-15 (living-spec status)

Evidence (re-verified on 2026-10-09).

• Regulation (EU) 2016/679: Article 5(1)(b) sets out purpose limitation; Article 6(1) lists the lawful bases for processing (https://eur-lex.europa.eu/eli/reg/2016/679/oj).
• The design is unchanged on development; it has no Turkish mirror.

Recommended fix. Cite Article 6(1) and say that the controller chooses and documents the basis — for example Article 6(1)(c) where a legal obligation requires the record, or Article 6(1)(f) legitimate interests — keep Article 5(1)(b) as the purpose-limitation constraint, and name the regulation for every article the table cites. Have whoever owns the legal mappings review the wording.

Related. #101 — the blanket Article 17(3)(b) audit-log claim in the same design.

Acceptance criteria

• The design names the correct GDPR article for the lawful basis and the regulation of every article it cites.
• The wording is reviewed by the owner of the legal mappings.
• The finding is resolved or explicitly closed with a reason.

_{Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.}