[DBTech] GDPR Compliance
 

GDPR Compliance is a mod designed to aid you in becoming compliant with GDPR, with features such as logged consent for privacy policy / terms of service and downloading user data.


Uses
GDPR Compliance is a mod designed to aid you in becoming compliant with GDPR, by allowing admins to force agreement to the Privacy Policy / Terms of Service and recording this consent. Furthermore, admins can download user data in machine readable format via the AdminCP.

Documentation
N/A


Extended Product Information

Force Privacy Policy acceptance: Admins can force all users to accept the privacy policy, and users will see a date stamp of when it was last updated.

Force Terms of Service acceptance: Admins can force all users to accept the Terms of Service, and users will see a date stamp of when it was last updated.

Logged consent: A machine readable database table logs the time stamp of the last time a user ID consented to the privacy policy and/or terms of service.

User data download: Administrators with the "Can Administer Users" permission can download user data via a new page in the AdminCP.


Copyright Information

This mod does not display any copyright information.

Has anyone tried this yet? I have downloaded it to give it a shot but haven't yet had a chance to try it out. Wondering about any conflicts with other mods.

Haven't tested it because prima facie it fails the litmus test of allowing a "data subject" to request their data be forgotten without first agreeing to terms with which they may not agree. If they have to agree to terms or policies to even access the contact link it violates the spirit of the GDPR, if not the letter of the GDPR.

Thanks.

Maybe I am confused, but how can a "data subject" ask to be forgotten when they have not registered? They have no identifiable personal information to be forgotten without registering prior.

The GDPR allows for necessary information to be collected, as long as it is not personal in nature, which, from what I know it cannot be if they are a "guest" and not registered. Article 17 of the GDP states that the right to erasure means in certain circumstances an individual can submit a request to the data controller to have personal information erased or to prevent further processing of that data.

How can they possibly not be registered and ask for personal information, of which there would be none, to be erased?

Our contact link is available to everyone, so maybe I am missing something here.

Please let me know!

Guest IP addresses are logged. IP addresses are considered personal data under the GDPR. So, a guest could visit the site one time and ask for their personal data to be forgotten.

What personal data? An anonymous IP address?

I think you'd better recheck your sources.

GDPR Rule 30:

What is it you believe I need to re-check?

There is no way your forum database can identify anyone using the site as a guest by their IP address alone. In many cases, it cannot even identify the person's location let alone any thing else about the person - it is more likely to identify the head office of the ISP. Sometimes my IP address gets the city right but it is just as likely to show me as their head office in another city 450 kms away.

If you are really concerned about it, don't let Guests post. That's a whole lot better for spam prevention anyway.

I'm not arguing whether or not an IP address or a cookie can be used by a site to identify a data subject. The EU thinks it can and they ruled as such. Having said that I decided to ban EU / EEU users rather than deal with this ridiculous nonsense. I'm not going to play footsie with the EU regulator because, as primarily a U.S. business servicing primarily U.S. clients I have that luxury. I feel badly for E.U. based businesses that are forced to tiptoe around such rulings at the risk of exorbitant fines.