[DBTech] GDPR Compliance

[DragonByte Tech]

GDPR Compliance is a mod designed to aid you in becoming compliant with GDPR, with features such as logged consent for privacy policy / terms of service and downloading user data.


Uses
GDPR Compliance is a mod designed to aid you in becoming compliant with GDPR, by allowing admins to force agreement to the Privacy Policy / Terms of Service and recording this consent. Furthermore, admins can download user data in machine readable format via the AdminCP.

Documentation
N/A


Extended Product Information

Force Privacy Policy acceptance: Admins can force all users to accept the privacy policy, and users will see a date stamp of when it was last updated.

Force Terms of Service acceptance: Admins can force all users to accept the Terms of Service, and users will see a date stamp of when it was last updated.

Logged consent: A machine readable database table logs the time stamp of the last time a user ID consented to the privacy policy and/or terms of service.

User data download: Administrators with the "Can Administer Users" permission can download user data via a new page in the AdminCP.


Copyright Information

This mod does not display any copyright information.

[djbaxter]

Has anyone tried this yet? I have downloaded it to give it a shot but haven't yet had a chance to try it out. Wondering about any conflicts with other mods.

[In Omnibus]

Has anyone tried this yet? I have downloaded it to give it a shot but haven't yet had a chance to try it out. Wondering about any conflicts with other mods.

Haven't tested it because prima facie it fails the litmus test of allowing a "data subject" to request their data be forgotten without first agreeing to terms with which they may not agree. If they have to agree to terms or policies to even access the contact link it violates the spirit of the GDPR, if not the letter of the GDPR.

[djbaxter]

Thanks.

[Rob Graves]

Haven't tested it because prima facie it fails the litmus test of allowing a "data subject" to request their data be forgotten without first agreeing to terms with which they may not agree. If they have to agree to terms or policies to even access the contact link it violates the spirit of the GDPR, if not the letter of the GDPR.

Maybe I am confused, but how can a "data subject" ask to be forgotten when they have not registered? They have no identifiable personal information to be forgotten without registering prior.

The GDPR allows for necessary information to be collected, as long as it is not personal in nature, which, from what I know it cannot be if they are a "guest" and not registered. Article 17 of the GDP states that the right to erasure means in certain circumstances an individual can submit a request to the data controller to have personal information erased or to prevent further processing of that data.

How can they possibly not be registered and ask for personal information, of which there would be none, to be erased?

Our contact link is available to everyone, so maybe I am missing something here.

Please let me know!

[In Omnibus]

Maybe I am confused, but how can a "data subject" ask to be forgotten when they have not registered? They have no identifiable personal information to be forgotten without registering prior.

The GDPR allows for necessary information to be collected, as long as it is not personal in nature, which, from what I know it cannot be if they are a "guest" and not registered. Article 17 of the GDP states that the right to erasure means in certain circumstances an individual can submit a request to the data controller to have personal information erased or to prevent further processing of that data.

How can they possibly not be registered and ask for personal information, of which there would be none, to be erased?

Our contact link is available to everyone, so maybe I am missing something here.

Please let me know!

Guest IP addresses are logged. IP addresses are considered personal data under the GDPR. So, a guest could visit the site one time and ask for their personal data to be forgotten.

[djbaxter]

Guest IP addresses are logged. IP addresses are considered personal data under the GDPR. So, a guest could visit the site one time and ask for their personal data to be forgotten.

What personal data? An anonymous IP address?

I think you'd better recheck your sources.

[In Omnibus]

What personal data? An anonymous IP address?

I think you'd better recheck your sources.

GDPR Rule 30:

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

What is it you believe I need to re-check?

[djbaxter]

There is no way your forum database can identify anyone using the site as a guest by their IP address alone. In many cases, it cannot even identify the person's location let alone any thing else about the person - it is more likely to identify the head office of the ISP. Sometimes my IP address gets the city right but it is just as likely to show me as their head office in another city 450 kms away.

If you are really concerned about it, don't let Guests post. That's a whole lot better for spam prevention anyway.

[In Omnibus]

There is no way your forum database can identify anyone using the site as a guest by their IP address alone. In many cases, it cannot even identify the person's location let alone any thing else about the person - it is more likely to identify the head office of the ISP. Sometimes my IP address gets the city right but it is just as likely to show me as their head office in another city 450 kms away.

If you are really concerned about it, don't let Guests post. That's a whole lot better for spam prevention anyway.

I'm not arguing whether or not an IP address or a cookie can be used by a site to identify a data subject. The EU thinks it can and they ruled as such. Having said that I decided to ban EU / EEU users rather than deal with this ridiculous nonsense. I'm not going to play footsie with the EU regulator because, as primarily a U.S. business servicing primarily U.S. clients I have that luxury. I feel badly for E.U. based businesses that are forced to tiptoe around such rulings at the risk of exorbitant fines.

[djbaxter]

Fair enough. But I think if the issue of an IP address for guest visitors to a site ever gets tested in court it will get thrown out.

[In Omnibus]

Fair enough. But I think if the issue of an IP address for guest visitors to a site ever gets tested in court it will get thrown out.

As a lawyer I would say the element of proof of damages is on the individual who claims to have suffered a loss as a result of "personal data" being kept by a site. If someone can't prove that your use of their data caused them harm they have no case. Therefore, I would hope you are correct in your assessment that any such case would be summarily dismissed.

[Total666]

Hello : I installed the product , where in the admin panel are the settings to edit ?

[XotelHotel]

yeah i can't find the admin pannel for this anyone help me please

[ikorolis]

yeah i can't find the admin pannel for this anyone help me please

check 3.8 thread and found answer your question

check here http://prntscr.com/jyl1kc
http://prntscr.com/jyl20m
http://prntscr.com/jyl28o
http://prntscr.com/jyl2d4

[Stefan 1962]

by KLick on Privacy Policy :
I have read and accept the <a href="{1}" target="_blank">Privacy Policy</a>.
does nothing. It must go to the Privacy Site or not?
Nothing happens by Klick.
What can i do?

By Klick on Settings to set Therms of Service shows:

You do not currently have a Terms of Service URL configured.

Stefan

[flox80]

how does this look on the users end?

[michaelstoffer]

Be careful this plugin crashed my forum 4.2.3 I had to remove it.

[michaelstoffer]

This plugin crashed my forum 4.2.3

[NeoDio]

Should I even consider this if my website is based in the US? We do get worldwide traffic, however.

[Master Of Unive]

Should I even consider this if my website is based in the US? We do get worldwide traffic, however.

Personally I think you could ignore it unless your website is really really big. If the latter, you'd better contact a lawyer for better assistance.

[In Omnibus]

Should I even consider this if my website is based in the US? We do get worldwide traffic, however.

The correct answer is:

If you sell, market, or conduct research in the EU / EEU then you must have GDPR compliance.

Otherwise, it's not required.

[djbaxter]

I don't promote this particular add-on but my feeling is that implementing something similar to GDPR is to be recommended for all forums, whether or not you have members from the EU. If it does nothing else, it delivers a clear message to your members that you take their privacy seriously and that you have taken all available measures to secure that information. Additionally, it tells them what they need to do to remove their information and accounts if that is their wish.

It's only a matter of time before this sort of thing is legislated in non-EU countries in the west as well. Think oif GDPR as a wake-up call for forum owners. It's already woken up consumers (your members) to their rights and to the issue of how you are safeguarding their data.

And by the way that includes converting your site to HTTPS (SSL), if you haven't already done so. Asking your members to enter passwords on nonencrypted connections is basically saying, "Yeah. We don't really care if your password is intercepted or stolen".

[LutaWicasa]

How would you go about downloading the list in AdminCP? I'm not seeing the new page.

[Zelda-King]

Haven't tested it because prima facie it fails the litmus test of allowing a "data subject" to request their data be forgotten without first agreeing to terms with which they may not agree. If they have to agree to terms or policies to even access the contact link it violates the spirit of the GDPR, if not the letter of the GDPR.

The correct answer is:

If you sell, market, or conduct research in the EU / EEU then you must have GDPR compliance.

Otherwise, it's not required.
In view of these comments I deem I don't technically need this. For user peace of mind I'd still like to offer this but as the current state of the mod is insufficient for the quoted reason I'll hold off for now and keep an eye out for an update that fixes said situation.

[djbaxter]

User data download: Administrators with the "Can Administer Users" permission can download user data via a new page in the AdminCP.

Anyone know where this "new page" is?

[Stefanus]

yeah that page is nowhere to be seen

[bmwfans]

Be careful this plugin crashed my forum 4.2.3 I had to remove it.

Same here! :(
Upon activation of the plugin the forum totally crashed. With debug mode/deactivation of plugins everything is OK.

Is there any other step that we may need to do in the installation process in order to make it work?