What plans are on Elkarte for supporting the functionality required by GDPR after May 2018?
I think, that this is not simple to implement and I think it's a good option we make a consens of this, right?
Fel
https://github.com/elkarte/Elkarte/issues/3018
https://www.elkarte.net/community/index.php?topic=910.msg34153#msg34153
:P
Just tell users about it in the agreement and via notification (email and others) that certain basic data are going to be shown publicly via their profile while using the forum unless they disable them (except from admin staff). They may also opt to publicly show more available details too.
That's... really not nearly enough.
Heheheh... I don't think anything can satisfy you
@Arantor especially a simple approach or view like mine, above or others. ;)
Being a laws' abiding citizen is a good thing, but being paranoid of the laws is something else, at least that is what we are trying to educate our people in our own country.
Regarding data protection, I know the laws in my country and read some of EU's and the steps to be taken and to me there is nothing much to be worried about, but of course you can still consult your government or lawyers about it.
I am looking forward to see the "great" outcome of this GDPR in ElkArte and whatever softwares that are being developed and used in EU as this will definitely be fun. :)
Weeeeell quite a bit late, but I started reading the regulation.
I decided to go with tracking all the issues I think have to be addressed (or I'm not sure are to be addressed), so I created a label and started filing them:
https://github.com/elkarte/Elkarte/labels/GDPR
At this very moment I'm at Article 17. I'm pretty sure it will not be necessary to read all the 99 (actually I feel 17 is the last relevant and the most important), but let's see. :'(
The one I pointed out was at Article 18, I think. But if you want to add it as a feature / addon, it's ok to me.
hmm... Article 18 is "Right to restriction of processing":
TBH I have no idea how these could be enforced in any reasonable way...
It would mean give each user the option to enable/disable the use of personal data "on-the-fly", this would be rather difficult, you would need to be able to have the forum work with or without any personal information at any point in time.
My current idea of implementation is "either you give permission or not", but if you have an idea feel free to propose it.
Sorry. I was referring to paragraph 18 in the preambles, not article 18.
I already mentioned this in: https://github.com/elkarte/Elkarte/issues/3018#comment-346983538
Ahhh okay, good point, worth investigating!
I could be wrong though especially when I think this does not relate to me or my country. So do carry on and have fun breaking legs... I mean codes... :D
LOL
I was thinking of going so far as to disable IP address logging, and disable the anti-spam measures, as they currently send out the personally identifying user name and email address along with the IP address, and under this law, we should only be correlating by IP address.
And we should not be logging any more information than is necessary to grant bare minimum access to the services, so keeping any unnecessary records should be straight out. That probably also includes server access logs, but that's outside the bounds of this forum script.
Well, IMO that's a bit of an extreme position.
The point is not outright stop any tracking or limiting the tracking to the bare minimum.
The point is inform the user there is a tracking activity. There is a certain reason for this tracking. And, in case of requests "deal with them" (I'm not even sure (yet) that the removal is the only option, if we need an IP address to identify potentially offensive or unwanted behaviours, then it's "our" right as admins to use this information).
I think, that all is not TO complexe ..
For new User you can add a "GDPR" Part in the Register Aproval text.
So If a user acceccpt this, he accept the user-data saving (ip and other)
More complexe for exist user .. these MUST accept the GDPR on first login after this functionallity is enabled.
So we need a additional column in the membes table (gdpr_accepted) I think.
AND ..
This is only need for EU user, not for user outside the EU .. So this also must check (in EU, outside EU .. can by done with the IP address and the GEOIP Service)
This is, what we think to implement until end of Mai ...
Feline
This is technically wrong.
Technically, it's for EU and anyone targeting EU citizens.
I don't believe much in geoip localization, and for the amount of work involved (for both the admin and the end user), I think it's easier to just have it enabled
if the admin decides to enable it.
Well ..I'm not sure if your meaning the right..
I think it's the same as the EU Cookie Law .. this regular is only valid for EU User.
The GDPR is only Interested for Companys outside the EU if he store data from Users INSIDE the EU .. and these must have also the ECL functionally.
So if I check the users Location I can say "He must accept the GDPR" or not.
Same what I do with the ECL ... If the user inside the EU he must accept ECL, if he outside the EU he must not accept the ECL.
And this functionally the Admin can enable/disable ..
But .. this is only myself meanings ..
What does it happen is a EU citizen is abroad when accessing the site?
He is still a citizen of the EU, but is visiting the USA (let's say). The forum doesn't show the agreement, but still the user should be presented with the information.
If this the FIRST login, then .. you are right.
My Plans ..
If a EU-User do a login and have NOT accepted the GDPR (as I say .. a column in the members table) he must accept the GDPR before he can continue the Login.
If he not Accept the GDPR, he get a Screen where he can request a "accout delete" and the Login is abort.
But .. that all is (at the moment theoretic) because the Hosting Company where you have the site hosted have also a Problem with the GDPR .. because he can run in Problems if he allow that I save GDPR Relevant user data on his server (Like IP Adress).
So ... I have today contacted my Hosting .. but at the moment he have no informations what comes ...
This ugly GDPR is a havy thing .. and nobody is sure what is need and what not ...
The savin of the IP is a thing what is (normaly) not need ... because Bans on the IP don't work correctly.
So also I think on the removing of IP storage for posts and any other ...
Feline
This doesn't apply to me at all, & I am way green/inexperienced. BUT JUST A IDEA ....
couldn't delete all users passwords
force them do a lost password action
AND drop the EU cookie notice, into user agreement for future users, and on the password form, for existing users, append the EU cookie notice.
FOR SAY, A WEEK ... give everyone time to get their new pw, and see the notice.
Then can remove it - clean user base.
Or even just a required checkbox on the reg form
so won't have to FOREVER carry a extra DB class.
Perhaps in advance, send out a mass mail to all users, explaining, with a date planned to impliment it.
The deleima about the part relating to site storing info, like logs, per post, msg, etc. is real interesting issue.
IF going to add something to the DB, then how about applying a double login, like admin, to the DB sections that hold personal identifiers?
Least gain extra security, for the extra DB load & resource usage.
And the funny thing is: the user is the one that the system has to protect, not the owner. xD
Yes .. You must first accept the GDPR before you can login :D
This might help you all;
https://ico.org.uk/media/for-organisations/documents/1600/social-networking-and-online-forums-dpa-guidance.pdf
So pretty far behind on this...is this something that will be handled by the ElkArte software (an update?) or does each forum have to do this on their own modifications to comply with this?
I want to do "something", to make the life easier to the admins.
I'm pretty sure it will be impossible to have a "fully-compliant" ElkArte any time soon (even only because the requirements are not exactly clear as you may see from this very topic, where different people have different understanding of the law and so different opinions on what is necessary and what is not).
I hope to provide some tools in the next update, I'm not sure which.
Here some are tracked:
https://github.com/elkarte/Elkarte/issues?q=is%3Aissue+is%3Aopen+label%3AGDPR
If it were for me, I would see two as the most "pressing":
1) the revision of the agreement,
2) an easy way to "anonymize" a user that requires his data to be deleted.
In general, I think 2 is easier to implement than 1, but probably 1 is more useful than 2 right now.
The more useful one should be started first, I think.
Interesting reading:
https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases
Another interesting aspect:
https://law.stackexchange.com/questions/24623/gdpr-git-history
comment to the first answer.
I feel this could be applied to forum content as well.
Since the content is not produced by the admin, he has the obligation to be able to tell who wrote something in case of any potential legal case would arise (copyright violations, defamation, etc.).
To think about it.
I did an addon for another forum software which did the following. I could see if I can port it if needed.
Allows member to export their data. Their profile and post information
On member deletion clears IP address and email from posts and assigns a new username to all old posts.
Includes a privacy policy page, adds link in the footer and adds a section for consent on registration
Stores the date/time that the privacy policy was changed and option to force to reagree
Stores the date/time that the registration agreement was changed and option to force to reagree
That's a great offer. It would be fantastic if you did that! :D
Export information meaning all your posts? I can't really think of what other info there is that's not readily available in your profile. :)
@vbgamer45 cool!
BTW I've almost finished implementing logging of acceptance of both the agreement and a "privacy policy" (with a way to force accepting them any time they are changed).
For 1.1.4 I plan to only add on top of what I have already added a page to show the privacy policy (if enabled, since it will not be mandatory). If not too messy I'll try also to have an "accept privacy policy" for the contact form as well, but I still have to look at what is required.
For 1.1.5 (or later) I'd like also to work on showing the history of agreements/policies accepted to each member (that would just be a page with a list and an overlay showing the text I think).
Regarding the anonymization, though, I'm not sure I want to go down the "hammer-path" of deleting everything when the account is deleted. There are consequences like not being able to identify any more the author of the post that should be weighted as well. I think the correct path is a mixed solution: the data should be kept for (flexible) a period of time and there should be a way to remove them
if explicitly requested.
Oh well, something I've not yet given too much thoughts.
Sounds good enough for me,
@emanuele.
Will this be an addon soon? O:-)
Can you offer a description of the cookie(s) used by ElkArte, what it contains exactly and what it is needed for?
It will not be an addon, I'm adding it to the core starting from 1.1.4 (provided my computer start working again :'( ).
Will 1.1.4 be released before May 25?
https://www.elkarte.net/community/index.php?topic=5203.msg36950#msg36950
I think I just addressed that issue, please check again when you get a chance.
I would like to know that too.
I do not even think the "hammer path" would be appropriate at all. Imagine a contribution with criminal content. Advertizing for abuse of children or "simply" stalking.
The You even need to have the IP address (es) available in order to be able to give them to the police!
In addition blocking trolls requires permanent availability of their data to the admins.
Indeed.
And BTW, article 7.4:
i.e. okay to delete, but when the policy is accepted, you accept your data will be kept for the time specified by the policy.
So, I repeat, technical solution are nice, but the most important thing is actually a correctly written policy.
At the moment I'm a bit in troubles, I'll try to draft something...
If anyone is interested in putting something together (at least the general terms) I can jump with the details where needed. ;)
Sorry i am a lame person, does this EU and GDPR apply to all countries and to anyone running forums? I am from India and this should be added in my community too?
It does if you do business with EU customers, but otherwise I wouldn't expect it to be terribly relevant to people from India.
Nope ... must be:
If you bussines (website) is IN the EU then you
MUST have implement the GDPR :o
I don't expect Indians to have servers in EU to target people in India... that would be... slightly dumb.
My hosting is from Singapore and the site is about a City in India. Not a business forum, but a general discussion forum.
In that case I don't think there should be any direct relevance to your situation.
For the record: after the "computer disaster", I started working again on this.
For the moment I set up a way to force the acceptance of the agreement, on "no accept" the user is directly sent to the "delete my account" (TBH I think an option to "accept the agreement" is missing at that point, something to work on), now I'm working on a parallel privacy policy that will work mostly the same (actually is almost exactly the same code, just with "privacy policy" instead of "agreement".
I still need to integrate the privacy policy in the registration process. I plan to re-use the settings of the agreement in terms of presentation, so if the agreement is presented as standalone page at registration, below it the privacy policy will be shown (for the moment I don't think I can go down the route of having two distinct checkboxes to accept both, it will be the normal button), or alternatively there will be the checkboxes (and both will be mandatory).
Future improvement: give the possibility to split the privacy policy into multiple chunks each one of them to be accepted, and maybe have also the possibility to have pieces that can be not accepted (but TBH this will need some thoughts because in fact it's not possible to tie the text to the underlining intent, so it's not possible to make sure that the relevant code is not run when a certain text is associated to a certain checkbox).
Any time the admin requires the members to accept an agreement/privacy policy, all the agreements/privacy policies (because of the possible multiple languages) are backed up with a unique id and the members are requested to accept the latest one.
It is responsibility of the admin ensure the various versions are kept aligned, there are very little tricks we can apply to ensure that.
Potential improvement: allow the admin to force the use of policy only on certain languages in order to ensure it is always the correct one.
Future improvement: show the members a list of the agreements accepted.
I'm not yet sure if it is worth providing a default text for the privacy policy.
I'm thinking of adding a link to the privacy policy somewhere in the UI.
That said, I'm a bit behind my original schedule, anyway I want to have it out with 1.1.4, so I'll probably post a testing patch in the next few days.
I have created a settings Page .. Looks like the attach.
And I save the date (plus one day) in the members table .. so if I update the agreement, I can enter a new date so the updated version is shown again for all registered user on the next login, and must accepted.
And this: "Future improvement: show the members a list of the agreements accepted." is not the best idea .. (I think)
With this you give other members proteted data (what a user have do) ..
I don't think
@emanuele wants to show user XYZ what an agreement user ABC has ever accepted. ;) I think he wants to show user XYC what himself has ever accepted. IMO the latest version should be enough, no need for a list with outdated agreements.
Nothing so complicated: if you change the agreement a checkbox and done.
And then you lose the history of what agreement the user accepted, that is against the GDPR.
Your implementation is broken.
I'm not sure what you are talking about.
I want to know when I agreed to a certain version of the agreement.
I don't care, of course, when
you agreed to something.
But I need to know what I agreed on and when.
Actually, from my understanding, it's better if each user knows exactly what he agreed to and when, because technically, if you write in one agreement that you collect data for
something and then you change the agreement, you can still
have to use the old agreement for the data collected before.
Right,
@emanuele, but you don't need to know what other users accepted in the past.
But I didn't say that. :P ;)
Another thought: we have an agreement that hast to be signed during registration. This agreemet holds information that is to some degree redundat to the contents of the DSGVO declaration. Formally this part pof the information needs to be mapped 1:1. It is mandatory that details of the DSGVO relevant info is identical. So why not merge those to files and maybe also add the imprint (AFAIK it is legal to merge Imprint and GDPR declarion in one file). This would allow to maintain this info in one spot.
(I am going to do doing thisat least temporary because i want to go online with the upgraded forum this night.)
Why not make it part of the registration agreement, then if the Admin ever changes it, every user must choose to resign or inactivate their account? That's pretty much what the "big" sites do isn't it? Far simpler, every active user is always current, and no need storing a separate agreement for every user. ;)
That's my suggestion.
But unfortunately the GDPR declaration must also be accessible from every page, like the imprint.
I am not sure, if we ever can do the the upgrade to ElkArte 1.1 and I have another forum, which is still SMF. ::)
Every registered member will get nearly "excluded" now. ( a special membergroup, which has only access to one board to write in there) They can agree or disagree in two or three topics in this board to our new rules and to our new DSGVO declaration.
If they disagree, their accounts will get deleted
or they will stay in this "special membergroup" until they have joined the forum and agreed.
If they agree, they will get the membergrop again, they had before.
In future we will use the "agree-button" on the registration page for the agreement to our DSGVO declaration and our community-rules.
If there anytime will be a member (I don't think so), which want to say that she disagrees now, she can send me a PM or write in forum about this. Which means, that I will delete her account.
Yes...we have a link in the footer for this.
And I think, an additional link to our GDPR declaration during the registration and the button for agreement on the registration page will do it.
A link to a page displaying said agreement should be super simple. Or a popup, or whatever is needed. That technicality exists regardless of method.
Still no new version of Elkarte, that complies with the GDPR ?
Tommorow is the deadline....
Please hurry up...
Many thanks.
Regards, Stefan.
it was announced for early in June.
For the time until the release it should be possible to add a link to the Impressum and Datenschutzerklärung in the footer.
And - if possible - to switch to SSL if possible. At least during the login procedure.
Unfortunately my browser moans heavily about "mixed mode", apparently somewhere in the QJuery stuff which results in layout not being displayed if SSL is on :-(
BTW: i went online last night with just a visible Datenschutzerklärung/Impressum and a copy of the Datenschutzerklärung in the terms of use document which new users need to agree to anyway.
That should be sufficient to protect You from cease and desist letters (Abmahnungen) by specialized lawyers. These people will have problems to act upon the DSGVO anyway, at least on a private forum which is not in any economic competition. So in my view you should be pretty safe by providing these features.
That is exactly what I achieve with my solution.
If I change something in the agreement (for example, add an extra feature, such as using a new video page), I'll have to make arrangements in the GDRP.
But I have to tell the users, because .. they must then confirm again.
In other words ... ANY change in the software that touches the GDPR, I have to tell the users and they have to accept that again.
And .. by the way .. We are ready for Mai 26. to start with the GDPR :D
A bit OT: but that should also happen with any chance to the terms of use, and AFAIK it is demanded in the EU as well (and it would be reasonable anyway...)
https://github.com/elkarte/Elkarte/pull/3191