GDPR - Extension needed

MikeJones

So Google just added GDPR pop up for users of adense which is kind of nice:

I enabled it but couldn't see it on my site... Maybe it's because I live in the United States? Also may not show due to similar bugs related to adsense in Flarum Ad Extension

010101

Everything has a cost. For whatever reason this just came to mind.

I like privacy. And so, I like the idea of these laws.

However, once your company is big enough to be a target, you probably need to hire full time lawyers and privacy experts just to handle GDPR. Plus, all the money you put into paying for website redesign and GDPR tracking/tools.

This means, a widget you used to sell for $50, is now $100 to offset all the extra stuff you’re having to do.

GDPR also means we are full of pop ups, banners, checkboxes, reminders, and so on and so forth.

Since all of this GDPR stuff I don’t use the Internet any differently. It feels like it was designed more for people who don’t know what a cookie is. If they didn’t know before, they still won’t know if there’s a banner in their face. It’s just more to click through to get to what you want.

poVoq

010101 GDPR also means we are full of pop ups, banners, checkboxes, reminders, and so on and so forth.

This is actually not fully true. The GDPR is written in a way that it still allows a lot of user-tracking if the user consents to it. If your website does not do any user-tracking you don't need any of those pop-ups etc. IANAL just a public link to your privacy policy in the footer is sufficient.

So what I am trying to say is... those annoying pop ups etc are only showing you that these websites have not changed at all, they are just now forced to inform you about their data abuse.

010101

poVoq If your website does not do any user-tracking you don't need any of those pop-ups etc.

True. My forum doesn't have notices because I don't have any tracking. But, many websites do extra tracking and not always for abusive reasons.

Every other website I go to has a cookie notice. Whether they need it or not. Because GDPR law was written poorly and it makes people nervous so they add pop ups and extra notices even if they don't need to.

I go back and forth as far as whether I like or hate GDPR. 😄 Sometimes, I think it was written by people who did not grow up with the Internet and just don't fully know what a cookie is. And, what I call "cookie hysteria" or "cookie propaganda" was around long before GDPR. Most of it is over reaction. Cookies are as natural to the Internet as "www." It's all very silly (the laws, notices, etc.).

How many people see a cookie notice and then say, "Oh, OK... I'm exiting this site then because I don't want these cookies on my computer." Not many. Most people including myself plow ahead and use the websites they want to use. I like the website, and so, I'm using it. I trust it. Therefore, it's useless noise making the Internet ugly and annoying... And many times it's simply because the website owner isn't sure if they need the banner or not... so they add it just in case. Or, to make a certain group of people feel better.

I do agree that Amazon and Facebook most likely deserve any fines they get. Which is why GDPR should have been written to only focus on huge, global platforms and/or online stores, banks, and similar sites that store a ton of personal information. GDPR should add language that basically leaves everyone else alone. The bad guys are gonna be bad regardless. GDPR won't stop them. So, leave everyone else alone and let the Internet thrive. Just focus on the humongous sites.

Maybe the laws should say... if your website gets over X visitors and has over X users/members, then you must follow these rules. 🙂

Having said all this... I actually do agree that Flarum needs a GDPR extension which is the point of this thread. Sorry for going off on tangents. 😆

streaps

[deleted] It's highly likely someone has complained to the ICO directly and they have performed an investigation as a result.

I'm pretty sure there are very good reasons for that huge fine. Looks like Amazon has a systemic problem and they were unwilling to fix it. Politico links to an article from February:
https://www.politico.eu/article/data-at-risk-amazon-security-threat/

ACCORDING TO THE TWO U.S. information-security employees, data is at risk because Amazon has a poor grasp of what data it has, where it is stored and who has access to it.

“If you wanted to do a 'right to be forgotten,' it would be next to impossible for Amazon to identify all of the places where your data resides within their system,” said the first former U.S.-based employee.
[...]
“Amazon has grown so fast, it doesn't know what it owns … They don't know where their data is at, so they don’t know if they are protecting it correctly,” the person said.
[...]
“The quality of the controls that Amazon has in place is appalling. We found hundreds of thousands of accounts where the employee is no longer there but they still have system access,”

[deleted]

streaps Totally unsurprising - given Amazon's (pretty much like Facebook) somewhat "cavalier" approach to privacy and security.

Justoverclock

If someone would collaborate : 👀

https://github.com/justoverclockl/flarum-ext-cookieconsent/blob/main/js/src/forum/CookieConsent.js

PascalBoschma

Justoverclock 👀

sylv38

Hello the flarum team !

I haven't found any thread about Pusher to post this message.

I think that, regarding GDPR, it would really be nice to let the user choose if he wants to use Pusher or not. A checkbox would logically find its place to enable/disable pusher extension in confidentiality settings. To be GDPR compliant, this checkbox should be disabled by default. Would it be possible ? Of course, a setting could be added in admin panel to enable this possibility only for those who want.

Thus, I could use the cookie consent notification to explain that Pusher can be used to have realtime notifications and that it can be enabled in user settings.

[deleted]

I've chosen to leave the Flarum ecosystem based on the fact that there is no GDPR capability meaning that communities operating within the EU (or in the case of the UK, operating within Europe) are not and should not be classed as compliant. This represents a major issue for me given my professional capacity.

Frankly, I'm shocked that Blomstra is being marketed in Europe when it has no GDPR capabilities making it non compliant.

A real pity as Flarum has a brilliant ecosystem, but sadly, a complete lack of direction when it comes to GDPR. Personally, I've moved to NodeBB where this is a feature of the core and has been since the inception of GDPR.

matteocontrini

[deleted] meaning that communities operating within the EU (or in the case of the UK, operating within Europe) are not and should not be classed as compliant

What do you mean exactly? My community is GDPR-compliant, no cookie is installed without consent, explicit consent to the privacy policy is required to join the community, and I fulfil citizen rights on request, as the Regulation and my privacy policy require.

I agree it could be nice to have some additional features to let users manage their data on their own, but GDPR isn't really about having buttons in the UI.

matteocontrini

[deleted] Policies are one thing, but validation of existence and execution is another. This is why organisations have to regularly attest as part of due diligence that they are GDPR compliant.

How can Flarum help with that? In this case the organization is me and you, we are the data controllers. Flarum has no responsibility.

[deleted] They've been fully compliant since version 1.9.0 (1.18.2 was just released) and were the first forum platform to achieve certified compliance.

To be honest I only see a link to Wikipedia in that blog post... They just added some features to help forum administrators be compliant, as they say. Nice to have, but not required for a community to be compliant.

[deleted] It's been classed as not a priority, which is completely the wrong approach.

I agree with that.

[deleted] I never actually said that.

Maybe I misunderstood...

[deleted] [Flarum] communities operating within the EU [...] are not [...] compliant

Darkle

[deleted]

What @matteocontrini said is exactly what I plan to use, I think it's feasible, but it's true that with a really big community it can be something really laborious/unsustainable.

I don't know how the development of Blomstra is going with the GDPR extension, @luceos could you update us about it, are there problems or it just requires a lot of development time?

Maybe in that case, you could start a fundraiser to accelerate its development (as happened with the ad extension), I think a lot of people would be willing to help.

[deleted]

matteocontrini You have a mechanism for users to be able to request data corrections, perform an export of their own data, and delete their own account under Flarum ? I don't think you do unless you've written an extension yourself ?

Cookie compliance is an EU directive and whilst considered in line with GDPR they aren't the same thing. Flarum isn't GDPR compliant at all.

matteocontrini

[deleted] You have a mechanism for users to be able to request data corrections, perform an export of their own data, and delete their own account under Flarum ?

Yes, they can send an email and I handle those requests. I receive GDPR requests weekly. It's GDPR compliant and that's what a lot of companies do. I don't see where the GDPR says there should be buttons in the UI to do this. Compliance is about your policies and practices.

[deleted]

matteocontrini Yes, that's very true, but unless you can prove that you have the ability to respond to any GDPR request in 30 days as mandated by the ICO, and have a means of performing data anonymity to remove IP addresses, email addresses, and anything else classed as personally identifiable information, then you are not fully compliant.

The real problem with GDPR and the regulation is that people read it then suddenly become overnight experts. Flarum isn't GDPR compliant out of the box and should be. If you've never had your policies and procedures independently audited, you cannot assume compliance based on self review.

matteocontrini

[deleted] my policies were written by a lawyer, I handle requests within hours, I remove IP addresses from the database and any other personal information.

I don't think it's correct to say that every Flarum community is automatically not compliant. You can say that Flarum doesn't provide tools to aid with that, but that's a different thing.

[deleted]

matteocontrini Written by an expert lawyer and independently audited and validated as in place and functional by whom ? Anyone can have a set of policies drafted. Your can copy them from the internet also.

Policies are one thing, but validation of existence and execution is another. This is why organisations have to regularly attest as part of due diligence that they are GDPR compliant.

This is how NodeBB does it
https://blog.nodebb.org/nodebb-1-9-0/

They've been fully compliant since version 1.9.0 (1.18.2 was just released) and were the first forum platform to achieve certified compliance. Note how they also targeted their EU hosted customers as a priority to ensure they were also fully compliant.

Flarum hasn't done any of this, despite the GDPR officially landing on May 25 2018. It's been classed as not a priority, which is completely the wrong approach.

matteocontrini I don't think it's correct to say that every Flarum community is automatically not compliant.

I never actually said that. I said that Flarum itself is not GDPR compliant and needs to be if blomstra as an entity is to be taken seriously in Europe.

[deleted]

matteocontrini How can Flarum help with that? In this case the organization is me and you, we are the data controllers

Flarum should provide the necessary tooling as part of its core. Not an extension. Data obfuscation is not the same as data portability and right to erasure by the way - they are two different things, and Flarum provides neither.

matteocontrini To be honest I only see a link to Wikipedia in that blog post... They just added some features to help forum administrators be compliant, as they say. Nice to have, but not required for a community to be compliant.

That link is just for reference to the GDPR itself. See https://nodebb.org/gdpr

matteocontrini Maybe I misunderstood...

Well, that comment is factual in the sense that data portability and right to erasure are part of the GDPR so seeing as Flarum doesn't offer this, it's not compliant, and any community using Flarum by definition won't automatically be.

askvortsov

[deleted] Flarum should provide the necessary tooling as part of its core. Not an extension

I want to emphasize again that providing or not providing some systems in core is not in any way a reflection of the importance of those systems. There are some incredibly important things (tags, private messaging, redis / caching, etc) that will probably never be in core, and Flarum will be stronger for it. It's an engineering decision that allows us to keep core streamlined and maintainable while still enabling all these useful features to exist. If you'd like to read a bit more about this philosophy, see this post.

As to the status of the GDPR extension, I agree that it's been going way slower than any of us initially hoped, but the only active developers on it are myself and @IanM, and we've both been very pressed for time. However, that extension will have all the features discussed in this thread, and I am still optimistic that we will get it done.

Hari

matteocontrini >> they can send an email

People do not read the terms and FAQs. when they want to delete their profile like people do in FB they need a delete button otherwise they start using bad words and that can be seen by others too (which causes a bad reputation). instead of all this mess, it would be nice to have a "delete profile" extension just like the change username extension.

here is an a example (a real conversation)

[deleted]

Darkle Maybe in that case, you could start a fundraiser to accelerate its development (as happened with the ad extension), I think a lot of people would be willing to help.

I offered this I'm my starting post for this thread. Sadly, even that wasn't enough to steer momentum.

« Previous Page Next Page »