This page is a translation. The page of record is the Portuguese one, and every claim on it walks back to the bytes named there. Portuguese original · 98% translated
This notice is what a publication owes the people it names, written by whoever publishes. It is not legal advice and no lawyer has reviewed it. The article it rests on — Article 24 of Law no. 58/2019 — came back truncated to the research that found it, and must be read in full before being cited on a public page. If you are using this as a model, seek your own advice.
This notice was written and published in the SAME version as the first pages that name people, and before any of them was online. The /portugal/ section of newsroom.sgit.ai, where this method comes from, published its notice AFTER the pages that named 64 people, and records on the page itself that this was the wrong order. The commissioning brief expressly requires that this mistake not be repeated. It is the only reason this file exists before a single page of people does.
There is no entity behind this publication. Naming a person rather than a project is the honest version and it is also the cheap one: it means the objection route below reaches somebody who can act on it, and not a form.
Contacto: dinis.cruz@owasp.org
People named in the speaker list published by the event itself, in their professional capacity: the name, the role they are listed under, the organisation they are listed under, the links the event published for them, the topics the event lists on each of their pages, and the words on that page that match a published lexicon.
To report on a public professional event and on the ecosystem around it, and to demonstrate a method in which every published claim can be walked back to a hashed copy of the source it came from.
The refusal runs at the point of READING, not of presentation: build/extract.py discards the field before it reaches a data file. The gates in build/gates.py are the second line — gate 5 fails the build if an email address, a telephone number or a natural person's postal address appears in any data file; gate 6 fails it if any field is long enough to be a reproduced biography; gate 8 runs every lexicon pattern over the frozen bytes again, so that a tag can never be written by hand. A contact detail that reaches the data and is merely hidden by a template is one distracted cycle away from being published.
The journalistic derogation is NOT invoked. Article 24(3) of Law no. 58/2019 conditions processing for journalistic purposes on the national legislation governing access to and exercise of the profession. This publication is not accredited under it and does not satisfy that condition, so it does not rely on it. The supervisory authority's 2019 decision not to apply certain provisions does not touch Article 24, which therefore stands in full.
To report what a public event published about itself, and to demonstrate a method of verification on top of that. Both are matters of public interest and neither is commercial — this site has no price, no advertising and no tracking.
The account cannot be given without the names, because the subject IS who is speaking. The data held is the minimum: the published professional fields and nothing else. No biography is kept, no contact detail is kept, and no inference about anybody is made or published.
Every datum was published by the event itself for the express purpose of announcing these people as speakers, in their professional capacity, and holds no private-life content. Against that: being listed on a third party's site is not something anybody consented to, and that is why the objection route below is unconditional rather than assessed. We also record, because otherwise it would go unsaid and the wrong belief would be the one left standing, that the fact data has been made public does NOT by itself mean it may be processed on this basis — it is a factor in the balance, not an answer to it.
The three members follow the European Data Protection Board's guidelines on legitimate interests, adopted on 8 October 2024.
Where personal data is not obtained from the person it concerns, Article 14 of the GDPR requires that they be informed. Article 14(5)(b) releases the controller where individual notification would take disproportionate effort — but that release is conditional, and one of the measures it expressly requires is making the information publicly available.
This page is that measure. It exists so that the release is earned and not presumed. It was written before a single page of this site named a person, and not after. It is the correction the commissioning brief requires to be carried over from the section that came before this one.
Como: Email the controller named above. Say who you are and that you want your entry removed.
No reason is required and none will be asked for. Removal is not assessed, discussed or deferred pending a balancing exercise.
The entry is removed from the derived data, the site is rebuilt, and the name stops appearing on any page. Because removal changes what a difference between captures would show, the changes page records that an entry was removed at the data subject's request, without a name — which is the only way to keep the difference honest without republishing the name somebody asked to have removed.
When a name left the list published by the event itself between two of our captures, this publication records the change and declares no reason. Withdrawal, a diary clash, a duplicate registration and an editing error are indistinguishable from outside, and attributing a motive to a named person on this evidence would be the most harmful thing this publication could do.
The frozen captures of the sources are permanent, because they are the evidence that makes every claim verifiable and deleting them would break the method. The derived data is rebuilt from them on every run. If a person objects, their entry is removed from the derived data and from every page presented; the frozen capture is not altered, because it is a copy of what somebody else published on a date, and not our record about them.
Editor of record: Dinis Cruz. Research, writing and verification: agents, each one named in the run record that did the work.
All fetched, frozen byte for byte and hash-verified on every build. The register lists them; the method explica-o.
Controller: Dinis Cruz. Basis: legitimate interests. Unconditional removal on request; the reason is never published. The notice.
newsroom.sgit.ai — one instance of the argument. This site is natively Portuguese; it is not a translation.
dados/ by build/build.py; nothing on it is written by hand. The machine-readable index is at llms.txt and the manifest with the hash of every data file at ficheiros/. Version v0.23.13 · source: github.com/SGit-AI/SGit-AI__Website__Newsroom__PT · file: aviso/index.html.