GDPR discussion thread

[adamsmasher]

A Privacy Bill of Rights has been introduced in the US senate:
https://theadminzone.com/threads/as...tors-introduce-privacy-bill-of-rights.147245/

It looks like the US is following the EU GDPR.

Not surprising. Fortunately, if you're already covering all the bases for GDPR you should be in fine position for this.

 

[Davyc]

Can't we just write up or link to a guide and show people how to remove them in their browser? I guess most of our privacy policies cover this.

IPs and emails are only visible to staff. Emails can be removed by users themselves (unless they are banned but do banned members have this right to be forgotten and then re-register when they are indeed forgotten to bypass our own rules?) so I don't think that's much of an issue.

First part - no! A simple link saying we use cookies with a link to show users how to block/delete them is no longer enough; I believe this is the part that is causing the most concern. Apparently you are supposed to ask for explicit permission for cookies to be dropped - before they say yes or no - no cookies are supposed to be dropped; how the hell can we know the complete workings of the software we're using as to whether this is the case or not - unless the developers tell us. You are also supposed to name all of the cookies being dropped by using your site in a privacy policy.

For banned users there is a legitimate reason for retaining their data, to stop them from re-registering or gaining access to your site (the re- registering part is easily circumvented though if they are bright enough lol).

As far as scanning every single post for PII that's not going to be easy, or even possible, so I'm not sure where the onus would lie there; both parties could be equally responsible, but then if people are stupid enough to post PII on an open forum then, for me, the onus should be on them to find them and point them out; the law may have a different viewpoint, so that would need to be checked out.

 

[Lukas W.]

how the hell can we know the complete workings of the software we're using as to whether this is the case or not - unless the developers tell us.

Simple check: Install a cookie editor add-on (or use the developer tools of your browser if you're familiar with them) and delete all cookies of your page. Open your page and check your cookies again. If cookies are set, then they have been without you consenting to them. For XenForo, this would be the session and the csrf cookies, that are automatically generated the first time you visit the page.

In my honest opinion this task should have been delegated to browser developers instead though. It's way easier to implement this in a general manner for a browser than individually for each piece of software and it would also give the user a general "just allow them all ffs" type of option.

 

[RobinHood]

Here’s what WordPress is doing. Sounds like they’ll end up doing quite a lot and also adding tools to help admins manage and be transparent about what add ons are also doing with user data.

https://wordpress.org/news/2018/04/gdpr-compliance-tools-in-wordpress/

An interesting read here on their roadmap about their plan to implement some of this

https://make.wordpress.org/core/2018/03/28/roadmap-tools-for-gdpr-compliance/

Seems like a good roadmap system, it has links off to each ticket issue where admins and devs can comment and leave feedback

 

[RobinHood]

Here's the statement from OneSignal about their upcoming changes. I know a lot of admins are using it on their XF1 sites and a few people are working on XF2 versions.

Dear OneSignal Client,

OneSignal is committed to helping our clients be GDPR compliant when using our Web Push, Mobile Push, and E-mail products. Our business and legal team are working hand-in-hand with many of our existing clients to ensure compliance with EU law. Whether you are in the EU or not, we’d like to help make it easier for all of our partners to comply with GDPR.

While these specific suggestions and changes we’re making will help you comply with GDPR, we also recommend that your consult with your legal counsel for compliance recommendations specific to your company.

Some of the major changes we’re making include updating our legal terms and our push and email products to limit our access to and what data is stored from EU users. We’ve been working closely with our legal team to update our EULA and make these product updates before the May 25th deadline.

These product changes include:

1. Providing the option to not store end-user IP addresses, and by default, not storing the IP addresses of end-users from countries within the EU.

2. For all clients, beginning on May 21st, 2018, we will discontinue building data models with data nor will we monetize any EU user data with our business and analytics partners. For our Enterprise clients, we have introduced a Data Processor Agreement (DPA) which formally designates us as a Processor for all data.

3. Releasing updated versions of our SDKs to make it easier for our clients to prevent user data from being sent to OneSignal until a user explicitly consents.

4. Adding support to our API for the deletion of user data. Additionally, we are reducing our data retention period of deleted data to 72 hours.

5. Updating our user data exporting capabilities to make it easier to search for and export user data from OneSignal. This will help our clients meet individual user requests for restriction, erasure, and data portability.

6. Preparing a guide on how to use OneSignal for push notifications without sending us personal user data.

In addition to the product changes, we’ve taken steps internally to ensure that all data sent to OneSignal is stored securely. These steps include auditing the software we use for security vulnerabilities, ensuring we’re using up-to-date versions, improving network security in out datacenter, and ensuring we maintain and follow security best practices internally to ensure that we prevent unauthorized access to our servers.

For clients who use OneSignal in their apps or websites and who have EU users or are based in the EU, you are responsible for ensuring that you have a valid legal basis (e.g., consent, legitimate interest) for the personal data that is being sent to OneSignal. We recommend working with your legal counsel for guidance on your specific responsibilities. We are happy to work alongside you and your legal team to ensure compliance while using our services.

If you have any questions or concerns about this topic, our team is happy to answer any questions you have. Please send your inquiries to support+gdpr@onesignal.com.

 

[BassMan]

Sure, such things should be implemented in core.

 

[Paul]

Agreed - or at least the option to be able to switch these things on and off...

So - Has there been any "official" line from the XF team on GDPR and implementation with XF???

 

[BassMan]

This looks promising: https://xenforo.com/community/resources/kl-admin-tools.6352/

From XF? Nothing very official as I recall. But believe they will make some statements, maybe even some new core features for this thing. You never know.

 

[RobinHood]

I wonder if this legislation will kick older forum sites into gear and force them to upgrade and accelerate any planned upgrades to a 2018 release of their forum software of choice.

This could end up being a massive boost for online communities if gets admins to upgrade to the latest GDPR compliant software, and at the same time they could upgrade their entire server stack so they're on PHP 7 etc., accelerating the development of modern features.

If users start making demands about having control over their data and the tools aren't there on older platforms, admins are going to have to find an upgrade path to software that will satisfy these demands. Good GDPR compliance tools could be a big selling point.

I've had 3 emails today from various companies about GDPR. I think a lot more lay users than we may realise will be getting informed about this over the next few months as the companies they work for start to educate them about it for their own internal company use.

 

[Mr Lucky]

I wonder if this legislation will kick older forum sites into gear and force them to upgrade and accelerate any planned upgrades to a 2018 release of their forum software of choice.

So what about all those thousand of forums on vbulletin 3 & 4 I wonder?

 

[RobinHood]

That’s my point. Maybe this will be the push to force them to upgrade to something more modern, software that has a future and something that will ultimately be better for their users in terms of features, extensibility, ux, data control and security.

 

[Lukas W.]

Maybe this will be the push to force them to upgrade to something more modern, software

I'd welcome that. Even though I come to believe that the administrators who procrastinated updating their software for the last few years for security reasons will see any motivation to do so now until GDPR actually stomps in their front door.

 

[StarArmy]

Or do a search for their address or part of their address

Unfortunately default Xenforo's biggest holes is a lack of search for conversations so this only works for posts. I have over 15,000 conversations to go through, IIRC.

 

[adamsmasher]

Unfortunately default Xenforo's biggest holes is a lack of search for conversations so this only works for posts. I have over 15,000 conversations to go through, IIRC.

Fortunately you can delete all the conversations for a user in admin. Although like my previous comment I'm not sure how you would export that and provide it to a user if they wanted it.

 

[Mr Lucky]

Fortunately you can delete all the conversations for a user in admin. Although like my previous comment I'm not sure how you would export that and provide it to a user if they wanted it.

Does that delete the entire conversations? ie the user and all recipients leave those conversations, or are they still in the recipients' inbox and so so some personal infpo may still be around.

 

[Lukas W.]

Fortunately you can delete all the conversations for a user in admin.

Does that delete the entire conversations? ie the user and all recipients leave those conversations, or are they still in the recipients' inbox and so so some personal infpo may still be around.

As far as I am aware this option physically deletes all conversations that have been started by that particular user, but not all that he has participated in.

 

[Mr Lucky]

As far as I am aware this option physically deletes all conversations that have been started by that particular user, but not all that he has participated in.

OK, so technically not quite fit for purpose re:GDPR? Mind you, I'm of the opinion that you don't need to delete user content provided you anonymised them, ie removed profile and changed username and password.

 

[Lukas W.]

OK, so technically not quite fit for purpose re:GDPR?

Agreed.

I'm of the opinion that you don't need to delete user content provided you anonymised them, ie removed profile and changed username and password.

As we tend to name conversations "Private Messages", we're implying that users are free to share their private details there though, so we should consider that they have shared private information through these in the past. Additionally, it's not totally obvious for all users that "leaving" a conversation does not fully delete the conversation and they also have no indications which of their old conversations still exist.

 

[Mr Lucky]

As we tend to name conversations "Private Messages", we're implying that users are free to share their private details there though, so we should consider that they have shared private information through these in the past.

I address that in my Privacy Policy:

Personal Conversations (PCs)

Please note that while personal conversations are not visible publically or to other members of the forum (except to those people in the conversation) it is possible for forum and/or server administrators to access conversations which they would only do under exceptional circumstances (see below).


For this reason we do not actually call them “Private” – although they are just as private as on any other forum software or social network.


Please note that this isn’t just us, the ability for admin to view personal messages is common to any similar forum software. Our policy is not to read personal conversations or allow any third party access unless exceptional circumstances require it, however you are advised to be aware that nothing you say in personal conversations on this, or other forums, is truly private. If you want to discuss completely private matters with other members, then you are advised to do so via email, telephone or other forms of communication.

Exceptional Circumstances

Include but are not limited to:

• Requests from law enforcement agencies with the appropriate warrants.
• Any action needed to be taken by admin to ensure the legality and security of the forum, for example if there are good grounds to suspect fraudulent activity.

 

[Robust]

There's an irony here. Although it applies to account upgrades rather than donations, the EU VAT laws require you to keep two pieces of information in regard to someone's location, which can be demanded as evidence for up to ten years.

https://www.vatlive.com/eu-vat-rules/eu-vat-digital-services-moss/location-of-customer-moss-2015/

https://www.gov.uk/government/publi...pplying-digital-services-to-private-consumers

In these cases any demand to delete an account and infoprmation of location could result in a breach of those VAT requirements.

The GDPR does not override any legal obligations, obviously.

If you are required to retain information for legal reasons, such at VAT MOSS compliance or other accounting legislation, it overrides certain rights provided by the GDPR (e.g. the right to be forgotten) -- the business can retain the essential information required to comply with this legislation. There are exemptions in the GDPR for this. There is nothing contradictory here.

Additionally, regarding another response you made, you cannot rely on PayPal to collect and retain that information for you. You are to retain that information yourself. By the way, as the first link you linked mentions, I'd recommend collecting 3 pieces of data. Often 2 can be contradictory, and you don't want to have to reject a transaction. If you collect 3, there's a higher chance that 2 of them will be the same.