vBulletin Mods

The Official vBulletin Modifications Site
https://www.vbulletin.org/forum/showthread.php?t=326471

[DBTech] GDPR Compliance
by DragonByte Tech
13 Jun 2018 15:31

1 Attachment(s)
GDPR Compliance is a mod designed to aid you in becoming compliant with GDPR, with features such as logged consent for privacy policy / terms of service and downloading user data.


Uses
GDPR Compliance is a mod designed to aid you in becoming compliant with GDPR, by allowing admins to force agreement to the Privacy Policy / Terms of Service and recording this consent. Furthermore, admins can download user data in machine readable format via the AdminCP.

Documentation
N/A


Extended Product Information

Force Privacy Policy acceptance: Admins can force all users to accept the privacy policy, and users will see a date stamp of when it was last updated.

Force Terms of Service acceptance: Admins can force all users to accept the Terms of Service, and users will see a date stamp of when it was last updated.

Logged consent: A machine readable database table logs the time stamp of the last time a user ID consented to the privacy policy and/or terms of service.

User data download: Administrators with the "Can Administer Users" permission can download user data via a new page in the AdminCP.


Copyright Information

This mod does not display any copyright information.

djbaxter 14 Jun 2018 12:30

Has anyone tried this yet? I have downloaded it to give it a shot but haven't yet had a chance to try it out. Wondering about any conflicts with other mods.

In Omnibus 14 Jun 2018 15:45

Quote:

Originally Posted by djbaxter (Post 2595129)
Has anyone tried this yet? I have downloaded it to give it a shot but haven't yet had a chance to try it out. Wondering about any conflicts with other mods.

Haven't tested it because prima facie it fails the litmus test of allowing a "data subject" to request their data be forgotten without first agreeing to terms with which they may not agree. If they have to agree to terms or policies to even access the contact link it violates the spirit of the GDPR, if not the letter of the GDPR.

djbaxter 14 Jun 2018 16:42

Thanks.

Rob Graves 18 Jun 2018 20:10

Quote:

Originally Posted by In Omnibus (Post 2595131)
Haven't tested it because prima facie it fails the litmus test of allowing a "data subject" to request their data be forgotten without first agreeing to terms with which they may not agree. If they have to agree to terms or policies to even access the contact link it violates the spirit of the GDPR, if not the letter of the GDPR.

Maybe I am confused, but how can a "data subject" ask to be forgotten when they have not registered? They have no identifiable personal information to be forgotten without registering prior.

The GDPR allows for necessary information to be collected, as long as it is not personal in nature, which, from what I know it cannot be if they are a "guest" and not registered. Article 17 of the GDP states that the right to erasure means in certain circumstances an individual can submit a request to the data controller to have personal information erased or to prevent further processing of that data.

How can they possibly not be registered and ask for personal information, of which there would be none, to be erased?

Our contact link is available to everyone, so maybe I am missing something here.

Please let me know!

In Omnibus 18 Jun 2018 21:48

Quote:

Originally Posted by Rob Graves (Post 2595162)
Maybe I am confused, but how can a "data subject" ask to be forgotten when they have not registered? They have no identifiable personal information to be forgotten without registering prior.

The GDPR allows for necessary information to be collected, as long as it is not personal in nature, which, from what I know it cannot be if they are a "guest" and not registered. Article 17 of the GDP states that the right to erasure means in certain circumstances an individual can submit a request to the data controller to have personal information erased or to prevent further processing of that data.

How can they possibly not be registered and ask for personal information, of which there would be none, to be erased?

Our contact link is available to everyone, so maybe I am missing something here.

Please let me know!

Guest IP addresses are logged. IP addresses are considered personal data under the GDPR. So, a guest could visit the site one time and ask for their personal data to be forgotten.

djbaxter 18 Jun 2018 23:29

Quote:

Originally Posted by In Omnibus (Post 2595164)
Guest IP addresses are logged. IP addresses are considered personal data under the GDPR. So, a guest could visit the site one time and ask for their personal data to be forgotten.

What personal data? An anonymous IP address?

I think you'd better recheck your sources.

In Omnibus 19 Jun 2018 00:10

Quote:

Originally Posted by djbaxter (Post 2595166)
What personal data? An anonymous IP address?

I think you'd better recheck your sources.

GDPR Rule 30:

Quote:

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
What is it you believe I need to re-check?

djbaxter 19 Jun 2018 00:27

There is no way your forum database can identify anyone using the site as a guest by their IP address alone. In many cases, it cannot even identify the person's location let alone any thing else about the person - it is more likely to identify the head office of the ISP. Sometimes my IP address gets the city right but it is just as likely to show me as their head office in another city 450 kms away.

If you are really concerned about it, don't let Guests post. That's a whole lot better for spam prevention anyway.

In Omnibus 19 Jun 2018 01:31

Quote:

Originally Posted by djbaxter (Post 2595169)
There is no way your forum database can identify anyone using the site as a guest by their IP address alone. In many cases, it cannot even identify the person's location let alone any thing else about the person - it is more likely to identify the head office of the ISP. Sometimes my IP address gets the city right but it is just as likely to show me as their head office in another city 450 kms away.

If you are really concerned about it, don't let Guests post. That's a whole lot better for spam prevention anyway.

I'm not arguing whether or not an IP address or a cookie can be used by a site to identify a data subject. The EU thinks it can and they ruled as such. Having said that I decided to ban EU / EEU users rather than deal with this ridiculous nonsense. I'm not going to play footsie with the EU regulator because, as primarily a U.S. business servicing primarily U.S. clients I have that luxury. I feel badly for E.U. based businesses that are forced to tiptoe around such rulings at the risk of exorbitant fines.

djbaxter 19 Jun 2018 02:18

Fair enough. But I think if the issue of an IP address for guest visitors to a site ever gets tested in court it will get thrown out.

In Omnibus 19 Jun 2018 05:08

Quote:

Originally Posted by djbaxter (Post 2595171)
Fair enough. But I think if the issue of an IP address for guest visitors to a site ever gets tested in court it will get thrown out.

As a lawyer I would say the element of proof of damages is on the individual who claims to have suffered a loss as a result of "personal data" being kept by a site. If someone can't prove that your use of their data caused them harm they have no case. Therefore, I would hope you are correct in your assessment that any such case would be summarily dismissed.

Total666 23 Jun 2018 02:42

Hello : I installed the product , where in the admin panel are the settings to edit ?

XotelHotel 23 Jun 2018 19:44

yeah i can't find the admin pannel for this anyone help me please

ikorolis 24 Jun 2018 01:33

Quote:

Originally Posted by XotelHotel (Post 2595227)
yeah i can't find the admin pannel for this anyone help me please

check 3.8 thread and found answer your question

check here http://prntscr.com/jyl1kc
http://prntscr.com/jyl20m
http://prntscr.com/jyl28o
http://prntscr.com/jyl2d4


All times are GMT. The time now is 23:49.

Powered by vBulletin® Version 3.8.13
Copyright © 2019, MH Sub I, LLC dba vBulletin. All Rights Reserved. vBulletin® is a registered trademark of MH Sub I, LLC
Copyright ©2001 - , vbulletin.org. All rights reserved.