for people who still don't know about it, Europe’s General Data Protection Regulation is coming on May 25 and that has implications even for companies hosting sites outside the EU:
as good latinos we're leaving things until the last moment (minute 45 of the second half, they use to say over here).
my question is this: are there any Plone add-ons to show a message to site visitors like this one on El Pais website?
Sorry guys but the requirements related to the GDPR are broader than you might think. This included documentation of processes and e.g. to delete or export customer related data and content on request by a user...nothing of that is available out of the box in Plone.
yes, I'm aware of that but is out of the scope I'm trying to reach at this time.
for the vast majority of our sites we don't store any customer related data besides the IP address on web logs and that's fine as long as we erase it periodically (encrypting old logs may be needed also).
UPDATE: here are some good articles:
You can’t collect and store any personal data without having obtained, and being able to document that you obtained, consent from the persons you’re collecting data from. You can, however, collect and store personal data as part of web servers logs for the purposes of detecting and preventing fraud and unauthorized access and maintaining the security of your systems.
"Under GDPR, organisations of less than 250 employees will not have to employ or train a data-protection officer (DPO)." Essentially, they won't have to change the structure of their organisation, whereas larger businesses probably will.
Smaller organisations will also benefit from no longer having to notify the ICO of data-processing activities. The GDPR instead requires businesses to keep detailed records on their own processing activity.
ZODB is no different to any other database with regard to compliance related to backups. You should bear the time since the last pack in mind when considering the state of your backups and manage your pack and backup schedules accordingly.
Also, consent is not the only legal basis for processing. You are allowed to retain data for (for example) legal defence or to comply with local laws. Secondly, you can be transparent with your users about how you apply their rights. It's fine to tell them that it will take some time for their data to be fully removed from non-operational sources such as backups as long as your restore processes handle the withdrawal of consent not being reverted.
I analyzed collective.cookiecuttr and I decided not to go ahead with it; I prefer simple stuff and, IMO, this looks more like an unmaintained hack: all browsers have configuration options to disable cookies and I think that's the way a user has to proceed.
I ended up creating a new add-on only to display a disclaimer the first time a user visits a site:
as a side note, it doesn't use cookies at all: it stores the information in the HTML5 Storage just because it's more fun and we are in 2018.
I'm all in for simple solutions and showing transparency about how user data is handled is imho in the sense of the GDPR.
In terms of cookies it seems to me the way to comply best with is, grouping cookies for example by required/functional/advertising and to let the user decide what is acceptable. Also sending a user to the browsers cookie settings and expect to manage his gazillions of cookies there, isn't acceptable in the probably near future.
There are already some commercial solutions to kind of allow this (not advertising any of the shown services)
Not knowing all of the technical implications, can somebody explain what's necessary to make something this possible within Plone and are there maybe already OSS solutions for it?
and I can tell you this "solution" is ridiculously complex and probably not affordable in the short/medium term; just take a look at a couple of slides on their presentation:
For people striving to get this ultimately right: That does not yet take into account the layer of inactive users whom have only agreed to some previous iterations of your ToS / marketing registry inclusions and is thus not yet a complete solution for the scope.
So I tried out a cookie consent service (cookiebot) and it works like a charm.
Register the domain, they scan the site, tell what cookies are active, pregroup them in necessary, statistic, marketing,...
Implementation is a js snippet, which disables/enables cookies according to the users settings, without touching any of the existing js/cookie/tracking implementations.
