GDPR compliance of GD and all addons

This topic contains 16 replies, has 2 voices, and was last updated by  Stiofan O’Connor 5 years, 11 months ago.

We have moved to a support ticketing system and our forums are now closed.

Open Support Ticket
  • Author
    Posts
  • May 18, 2018 at 7:24 pm #431186

    Dirk
    Full Member
    Post count: 390

    I like to finish my records of processing activities, which is needed for me to be GDPR compliant (see Art. 30 GDPR). For this list I need to know
    a) What personal data you are processing/storing?
    b) For what purpose?
    c) In what cases you are disclosing the personal data?
    d) What security measures are you using to protect personal data?
    for GD Core and the addons separated.
    As time is already running and I did not see anything about this, please give me the needed information latest May 25th.
    Thanks and best,
    Dirk

    P.S.: Will you integrate GD and all addons into the Privacy Component of WP? When will this be available?

    May 19, 2018 at 5:37 pm #431307

    Stiofan O’Connor
    Site Admin
    Post count: 22956

    Hi Dirk,

    Its all we have been working on since the WP 4.9.6 release.
    We will be doing releases next week before the deadline for everything that is affected, we will also do a blog post about it.

    So far yes we are adding to the privacy component of WP, both the text and the export/erase tools.

    Also consent tickboxes will be added where needed but i am a little disappointed a consent component was not added to wp 4.9.6, its going to get messy tracking things if everyone does it a different way…

    Thanks,

    Stiofan

    May 19, 2018 at 6:44 pm #431317

    Dirk
    Full Member
    Post count: 390

    Hi Stiofan,

    text for the privacy policy, integration into the export/erase tools and to have some consent management is one part and might not get you GDPR compliance. I will wait until you are finshed and will check with my lawyer what we have. At the moment I get the feeling when I’m listening to my lawyer that this will not be enough to be compliant at all.

    At the end I need this records of processing activities anyhow (this is law) and we are now finishing collecting all information. We have not yet decided on what level we like to finsh this regarding the website. One open point is the granularity of the use cases (processing activities). Is “calming a list” one activity or is the whole directory one activity. We are soon be ready to do this decision.
    If “claming a list” is an activity, then we need the above mentioned information from your side about the processing of personal data in each step.

    This is also a reason, that I don’t like this function in GDv2 where you store the IP when visiting the add place, because we are then in the whole topic of GDPR.

    For me GDPR is to rethink of what information we are collecting and to limit this to the lowest level. If it is not really needed, don’t collect the information (like IPs etc.).

    Best,
    Dirk

    May 21, 2018 at 10:39 am #431421

    Stiofan O’Connor
    Site Admin
    Post count: 22956

    Hi Dirk,

    All we can do at this point is what we know we have to do…
    There is so much confusion and differing opinions even between the core WP devs and a lack of “standards” to follow at the moment. For now we will copy the WP approach (which is ever evolving).

    If someone comes along and says “hey you need to also do XYZ to be compiant” then we will apply it, the GDPR rules have this system of warnings of compliance built in before any sort of fine is considered.

    Thanks,

    Stiofan

    May 21, 2018 at 10:11 pm #431563

    Dirk
    Full Member
    Post count: 390

    Hi Stiofan,

    I’m working in a big midsize company and we have our own data protection commissioner and also a company lawyer. This is what counts for me. No WP team and also no team from GD (and I guess you are not a lawyer).

    Your statement for potential fines is incorrect. If you have a leakage and have not done it correctly you will be punished (financially) hard. There is no excuse that a WP team had a different view on the things.

    As I mentioned above I will wait what we will have. And each one needs to have a records of processing activities. This is a must and not an option in GDPR (Art. 30). If you don’t have it and you have an audit from the official authorities, this can have huge impacts on your company or you as a person.
    Based on the list of processing activities everything is derived. Depending on the personal data you are processing different state of the art technologies has to be implemented.

    My view on this topic is always to think if you are introducing a GDPR related processing activity if this is really helpful for the user. If not or is nice to have, don’t do it or have a switch to disable it (here again about the auto-draft function). I would never store at this moment an IP on this auto-draft. There is no reason to do so. I will implement for WP that in such a case always 127.0.0.1 will be returned. Please be aware if you are implementing something based on auto-draft function the IP might be anonymous by someone. Then it might be a weird behaviour that everyone is getting a message about an existing auto-draft.

    BTW: This is my personal (and together with some experts) view on this topic. Other in different environments might also be suitable. It is in each responsibility to realize the GDPR. Most of the things are nothing new and should be already available.

    Best,
    Dirk

    June 4, 2018 at 3:54 pm #433618

    Dirk
    Full Member
    Post count: 390
    This reply has been marked as private.
    June 4, 2018 at 4:16 pm #433620

    Stiofan O’Connor
    Site Admin
    Post count: 22956

    Hi Dirk,

    I will flag this for kiran to check about the “submit IP” not being included.

    For the whole listing output its true that probably not 100% needs to be provided but in most cases it will, the right to portability states:

    data that can be clearly linked back to an individual (eg where that individual provides the respective identifier) is within scope of the right.

    In most cases this will be true.

    The rating and claim info should be there, i had tested this but i’ll also ask kiran to confirm, make sure all your addons are upto date.

    Thanks,

    Stiofan

    June 4, 2018 at 4:24 pm #433622

    Dirk
    Full Member
    Post count: 390
    This reply has been marked as private.
    June 4, 2018 at 4:29 pm #433624

    Dirk
    Full Member
    Post count: 390
    This reply has been marked as private.
    June 4, 2018 at 4:32 pm #433626

    Dirk
    Full Member
    Post count: 390
    This reply has been marked as private.
    June 4, 2018 at 4:38 pm #433630

    Dirk
    Full Member
    Post count: 390

    claim listing addon: there was no update for this addon.

    June 4, 2018 at 5:00 pm #433632

    Dirk
    Full Member
    Post count: 390

    About the right for portability:

    There is/was a WP (working party/group) about this topic related to Art. 20 GDPR:
    https://ec.europa.eu/information_society/newsroom/image/document/2016-51/wp242_en_40852.pdf

    First, data portability is a right to receive personal data processed by a data controller, and to store it for further personal use on a private device, without transmitting it to another data controller.

    Only personal data is in scope of a data portability request. Therefore, any data, which is anonymous or does not concern the data subject, will not be in scope. However, pseudonymous data that can be clearly linked to a data subject (e.g. by him or her providing the respective identifier, cf. Article 11 (2)) is well within the scope.

    I recommand to read the corresponding annotation of the working group to get a better understanding of what is meant with all this 🙂

    June 4, 2018 at 5:28 pm #433635

    Dirk
    Full Member
    Post count: 390
    This reply has been marked as private.
    June 5, 2018 at 9:50 am #433731

    Dirk
    Full Member
    Post count: 390

    claim listing update came today? Could you please explain what is exactly missing in the GD framework and what is the roadmap as we are all a little bit late?

    June 5, 2018 at 9:53 am #433732

    Dirk
    Full Member
    Post count: 390
    This reply has been marked as private.
  • Author
    Posts
Viewing 15 posts - 1 through 15 (of 17 total)

We have moved to a support ticketing system and our forums are now closed.

Open Support Ticket