010101 Iâve wondered, what could they do to a website owner who offers a free service, makes zero, or technically makes negative. Because nothingâs coming in, and youâre paying for hosting.
Free or not, this doesn't matter under GDPR. It's all about the data you hold, how it's handled and processed, and how you are securing it.
010101 Maybe the answer is, if you canât pay the fine, youâd be forced to shutdown the website? Do they come after your personal assets? Scary. I wish theyâd make these laws extremely clear.
The current maximum fine that can be levied by the ICO is âŹ20m, or four times the annual turnover of your entity, or it's parent.
010101 Technically Flarum isnât compliant, right? Thereâs no user data download extension. Thatâs a key component of the law. I mean you can manually export data from your database I guess if a member asks for it.
Technically, yes and no. The key here is data anonymity. Flarum doesn't permit a full profile with Full Name, Address, etc, but does record an email. The GDPR is all about personal data, and attribution. That same data can only be classed as identifiable if it can be aligned with a specific user to identify them personally. However, if IP addresses are being stored, then that is in scope. Arguably, you can state in your privacy policy that you record IP addresses in order to manage the site, and providing the user accepts that at signup, you are covered. It's always going to be a case of tl;dr, but these policies are specifically geared towards protecting both the user, and the individual. In a similar sense, each site must provide a mechanism for the user to "opt out" of cookies, mailing etc - for this reason, you should not set your forum to automatically follow posts, or be sent an email without the user's prior consent. The best approach is to let the user control that process, and give them a mechanism to change it - which Flarum does out of the box.
010101 I mean, any webmaster who installs Flarum core only, and gets a lot of members, would they be compliant?
Natively, no. They would still need to define their own privacy policy, and provide the mechanisms I stated above.
010101 But if you have to be told that a website uses cookies then you probably donât know what cookies are, and therefore a notice does nothing but make someone more nervous. Oh, and the checkboxes for forms that say something like, weâre about to collect what you input into this form, ok? ... isnât that obvious? All because some large sites started handling data poorly. Ugh.
An excellent point. Unfortunately, it's the law - even for contact forms - you place the decision in the user's hands, and ultimately have to be able to prove that the form cannot be submitted without the user ticking the consent box.
010101 Long live small niche sites and forums!
Yes. Again, there is a minor exception in the GDPR that permits the above, but it's not entirely clear as to what defines this. You have to remember that the ICO mandated these before the regulation went live, and there are already various changes to the law that are being considered.
Ultimately, GDPR, like CPPA is a potential minefield. We aren't lawyers, but also have to be on the right side of the law - even if that does negate the overall experience for the user.
