GDPR discussion thread

[Kirby]

But then it falls down to responsibility. Whose responsibility is it to anonymise that information? Ideally it would be down to Google to provide that functionality, and I think they do so we may be able to provide an option for that.

Anonymizing the IP address for Google Analytics is easy:

analytics.js

ga('set', 'anonymizeIp', true);

ga.js

_gaq.push(['_gat._anonymizeIp']);

gtag.js

gtag('config', '<GA_TRACKING_ID>', { 'anonymize_ip': true });

So if anonymizig IP is enough than all is fine, but the a/m coment stated that Google considers it to be a requirement to delete data from Analytics if a user account gets deleted on the forum - right now this does not seem possible as the admin does not have the necessary IDs to do so.
So the question remains as to how we would be able to comply with this requirement (apart from simply not using Analytics of course).

 

[Chris D]

I know, that's why I said it

 

[Chris D]

Does it? There was an EU ruling last year that IP adresses are PII if there is a way for the person storting them to have legitimate access to a system that can link it to an individual (i.e. they work at an ISP).

Has GDPR superseded that?

Yep, pretty sure it has. Which is just... well, stupid.

 

[Slavik]

Does it? There was an EU ruling last year that IP adresses are PII if there is a way for the person storting them to have legitimate access to a system that can link it to an individual (i.e. they work at an ISP).

Has GDPR superseded that?

Yep, pretty sure it has. Which is just... well, stupid.

Inside the scope of XenForo, yes as we also have other information we can link to a user, its personal.

However, once passed to analytics and anonymised, no, not our problem.

 

[Chris D]

Going to add an option to anonymise IP addresses passed to GA anyway, but that should be the end of it, as far as I know.

 

[Kirby]

Yep, pretty sure it has. Which is just... well, stupid.

Ack. Things would be a bit easier if this wasn't the case.

 

[JMPRockFm]

Going to add an option to anonymise IP addresses passed to GA anyway, but that should be the end of it, as far as I know.

Good idea, like an option in the admincp to enable this

 

[kaieivindm]

The ironic thing is that the sheer majority probably won’t care in the slightest and more likely view things like being forced to accept policies as being an unnecessary hindrance.

This is mostly true, however after Cambridge and Facebook episode, people with little to no interrest in privacy has had an eye opener. And I sincerly think we have not seen the last of it.

People should care about privacy, and with the items in 2.0.6 makes our management lifes easier. Thanks!

 

[Chris D]

An additional change in both XF1 and XF2:

 

[Kirby]

That's great

Though, as already pointed out before it's also a requirement to provide (at least) an opt-out functionality - XenForo itself currenly does not provide that.

According to a statement made by the "Konferenz der unabhängigen Datenschutzbehörden des Bundes und der Länder (DSK)" on March 26, 2018 explicit constent, eg. Opt-in is required for tracking like Google Analytics:
https://www.datenschutzbeauftragter...oogle-analytics-datenschutzkonform-einsetzen/

 

[trapped_soul]

An additional change in both XF1 and XF2:

View attachment 174723

Brilliant news!

 

[Slavik]

That's great

Though, as already pointed out before it's also a requirement to provide (at least) an opt-out functionality - XenForo itself currenly does not provide that.

According to a statement made by the "Konferenz der unabhängigen Datenschutzbehörden des Bundes und der Länder (DSK)" on March 26, 2018 explicit constent, eg. Opt-in is required for tracking like Google Analytics:
https://www.datenschutzbeauftragter...oogle-analytics-datenschutzkonform-einsetzen/

As we have pointed out, our guidance comes from the ICO and analytics falls under exemptions according to them.

 

[Kirby]

That might very well be. Right now nobody really knows for sure 100% how to intepret the new laws and german lawyers/courts always tend to be a little bit more strict with privacy than those of other countries.
Only time will tell which interpretations hold true.

 

[Lukas W.]

Yep, pretty sure it has. Which is just... well, stupid.

As are many internet laws. Maybe sometime in the future we'll finally have people that actually know how the Internet works before they pass laws to regulate it. Until then, that's probably not the last stupid law we'll see.

 

[Andy.N]

So if someone contacts you and wants to erase their account, do you need to ask to confirm whether he is EU citizen?

 

[M@rc]

So if someone contacts you and wants to erase their account, do you need to ask to confirm whether he is EU citizen?

I figure you'd just check the account's IP address.

 

[Mr Lucky]

There is nothing for the XF developers to do:

They obviously think there is now as they are going to do some changes in the next version upgrade:

https://xenforo.com/community/threa...ompliance-in-xf1-and-xf2.146888/#post-1248640

 

[Ozzy47]

They obviously think there is now as they are going to do some changes in the next version upgrade:

https://xenforo.com/community/threa...ompliance-in-xf1-and-xf2.146888/#post-1248640

Yes, obviously that has changed since this:

XF is already compliant by default and there currently isn’t any further action planned.

 

[Mr Lucky]

Can someone please tell me if there is any GDPR issue with admin discussion of a member, presuming they are discussing that member's forum behaviour and mentioning btheor username. My thoughts are that this is a normal and important part of running a forum, dealing with members that troll or are generally a nuisance. Should such discussions need to be deleted, or is it OK to keep for reference. Do they need to be divulged to the member if requested?

 

[Claverhouse]

Wouldn't those count as private conversations, where I would be free discuss with you any opinions on any public politician without forwarding such confidences on to him ?

There would be no point in anonymizing behaviour reports anyway, because no-one would know what is being talked about. At the very most these are history files as kept by H&R minions on employees in normal firms, which I would imagine are forbidden to be edited, tampered with or destroyed under Employment Legislation.

[ Difficult for an employee to claim discrimination if all relevant files are hurriedly destroyed. ]