Portable identites (MSC 2787) and the GDPR right to rectification, a pressing need for server operators (matrix-conf-2025)

Chaos Computer Club - recent events feed

Most of the discussions around privacy laws have been focused on the protection of data and condition of processing. But some others rights are starting to be litigated more widley and will soon play a bigger role for IT systems managers. This talk will focus on the GDPR article 16 (right to rectification), and how the current Matrix spec is inadequate for servers operators aiming to let people change their username, since MXID can't be changed (as of this proposal writing in June 2025). Based on the ongoing work done by the [Fedora community](https://fedoraproject.org/) on the [Fedora Username Change project](https://communityblog.fedoraproject.org/call-for-volunteers-regarding-the-fedora-username-change-project/), on recent legal cases in Europe, we will see why the adoption of [MSC 2787 (Portable identites)](https://github.com/matrix-org/matrix-spec-proposals/pull/2787) should be more than a nice to have, and how it intersect with questions of privacy and anti-discrimination. The talk will also touch on the topic of SSO configuration and downstream consumers best practice to deal with such changes. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://cfp.2025.matrix.org/matrix-conf-2025/talk/PTAPZE/