EU General Data Protection Regulation (GDPR) compliance

Re: EU General Data Protection Regulation (GDPR) compliance

by Randy Thornton -
Number of replies: 5
Picture of Documentation writers

Claudio,

La respuesta es que cualquier empresa o institución o organización que procese datos personales sobre ciudadanos de la EU está obligada a su observancia, no importa donde está. 

Por eso si su universidad tiene usuarios, como alumnos o profesores, los cuales son ciudadanos de la EU, entonces tiene que cumplirlo. Esto no sólo pertenece a datos de Moodle sino que a todos sistemas.  

Yo no sé las detalles para Argentina o otros países sudamericanos pero esto es lo que el reglamento general manda.

Sugiero que se debería de comenzar un hilo sobre esta tema en los foros hispanohablantes. Ahí hay unas personas enteradas sobre esto o por lo menos tendrá la misma pregunta.

Salud,

Randy

Average of ratings: Useful (1)
In reply to Randy Thornton

Re: EU General Data Protection Regulation (GDPR) compliance

by Gareth J Barnard -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers

Hello,

It's great that Moodle are putting together a Privacy API, what I'm currently struggling with pertains to the definition of 'personal data' from a GDPR legal standpoint to know and understand what data in my plugins needs to comply.  So with reference to https://moodle.org/mod/forum/discuss.php?d=365857#p1475972 - as administrators are users who are people then clearly the data they enter would be covered when attributed to (and logged as an event) then they have a right to be forgotten to.

As 'personal data' is defined in GDPR as 'means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;'.  So clearly the 'user id' is such, but what about other data associated with it?  Is the whole aspect here to determine if a bit of data can directly or indirectly be tracked back to a given user then it needs to have the rights of: knowing of it, knowing its value and to be deleted.

Take the scenario of an administrator setting the colour of a theme, then if the theme does not associate a user id with that colour value via any storage mechanism then possibly no need to worry about GDPR.  But what if the action is logged?  Then given one element of data being the colour setting value then you could indirectly track back to the administrator who set it.  Thus they would have the right for the data to be deleted and the defaults set.

Another scenario is the developers rights, as we are people too.  So if I were to remove a plugin from the Moodle.org database then I could request under GDPR that everyone delete that plugin as the PHP files have my name and contact details = personal identification of a user with data stored on a computer.  If valid, how would this scenario be handled?

What about course format options (https://github.com/moodle/moodle/blob/MOODLE_34_STABLE/course/format/lib.php#L563) that can be defined for a course in a course format (contributed)?  Is it possible for events / logs to be activated when an editing teacher changes a course setting?  If so, is that 'personal data'?

Also in Andrew Nicols document (https://docs.google.com/document/d/1Y7n4Qkez4Tl83rWArOQPQCpE2NeSA2bUa8gOR2r_JFE) there is the mention of 'Additionally, any free text field which allows the user to enter information must also be considered to be the personal data of that user.' on page 6, so does that imply that all free text fields need to be validated to ensure that they contain the type of data required (like CSS) and not personal data?  And how can a developer ever truly validate that when there is the CSS 'content' attribute?  But.... as the controller under GDPR (I believe) is responsible then where does blame lie when things go wrong?

Thus then, does GPLv3 protect developers from violations of GDPR?

Also, if I have a 'mind that bus, what bus? Splat' moment, would I have the right (being in the UK under EU law before Brexit when GDPR comes in) after I'm gone for all my posts on Moodle.org to be removed?  Not that really I'd want to because of the informational value I consider it gives as a benefit to the community.  But what would happen?

So what are people's thoughts out there please?  Are there any lawyers in the community whom can answer what does and does not constitute 'personal data' and other points I've raised please?

Cheers and happy head scratching,

Gareth

Average of ratings: Useful (1)
In reply to Gareth J Barnard

Re: EU General Data Protection Regulation (GDPR) compliance

by Josiah Carberry -

I should think that the right to be forgotten needs to be distinguished from other rights, such as the right to know what personal data is being held. Suppose a student at a university fails a course miserably and the teacher records comments about the student's performance. The student could hardly demand that those comments be deleted, thanks to a right to be forgotten. Similarly, someone buys an item online and pays for it. Those transactions must appear in the accounts of the vendor and cannot be deleted simply because the customer would prefer that there be no trace of the purchase.

The big issue I see concerns the distinction between data that is related to a person, but is not used by the operator to identify that person and the same data, often used together with other data, that together could be used, and is indeed being used, to attempt to identify the person. For example, suppose knowing which browser version is used by a person is of little use in identifying that person, but is nonetheless often used by the system for various other purposes. However, the browser version in combination with a variety of other elements (OS version, IP address, etc. etc.) is regularly being used by some organizations to try to identify individuals and track their behavior. So, outside of the cases where data is obviously used to identify people (names, ID numbers and such), what is the deciding factor for compliance requirements: the fact that the data could conceivably be used as personal data, or the fact that the operator is using the data as personal data?

Average of ratings: -
In reply to Gareth J Barnard

Re: EU General Data Protection Regulation (GDPR) compliance

by Randy Thornton -
Picture of Documentation writers


Gareth,

Some good questions here.

Some of those scenarios have been provided for. There's a very important difference between the data itself and the metadata, the fact that it is set by a particular person and what is set. 

The GDPR defines personal data pretty clearly and it covers basically "all the means likely reasonably to be used either by the controller or by any other person to identify the said person.”  

So, if an admin sets a color in a theme, that fact that they set it at a particular place and time may be a personally identifiable fact about them because the event is logged with a userid. But the setting per se is not a personally identifiable fact (certainly not "reasonably"). 

So, to comply I would remove the personally identifying fact by changing the username to de-identify the admin but I am not changing the setting. 

Likewise for code or content: I may need to de-identify or remove your name or email from the copyright statement in the code in your plugin to comply, but I am not uninstalling the plugin. As copyright holder you licensed it already under GPL and removing  your personally identifying information doesn't change that. 

The admin situation complies because it has become "pseudonymous data" since simply de-identifying a person is sufficient in many situations. There's sections in the GDPR to cover this (eg Recital 26, 28, 29) and how to do it (e.g using tokens.)

Plus of course, the right to erasure is not unlimited or general: there are very specific grounds required to invoke this as set out in Article 17. And even in many of those cases, the data can remain as long as it is de-identified. 

Admins, as for HR staff and Data Privacy Officers, often view and manage personal data of others as part of their duties. So, some of what an admin does as part of their job may need to be kept for compliance itself. That's one reason for using de-identification through pseudonymisation.

Personally, I would take the conversative approach that I would never simply delete any admin's personal data from Moodle but I would de-identify through pseudonymisation instead. That's a decision for the DPO to make in any case, not the admin. There's whole buckets of rules about this, and local laws have an influence too, and that's why there's a DPO.


Average of ratings: Useful (1)
In reply to Randy Thornton

Re: EU General Data Protection Regulation (GDPR) compliance

by Randy Thornton -
Picture of Documentation writers

I thought a bit about the issue of the GPL and GDPR, in the hypothetical case where a developer requests removal of their name from code under the right of erasure provision of GDPR. I said before, I would not remove the code, but I may remove the attribution. On reflection, I think I would not remove even that.

If you submitted a request to me under right to erasure for removing your copyright information from code, I would reject it under Article 17.3(e). 

It states that right to erasure does not apply when processing is necessary "for the establishment, exercise or defence of legal claims."

Since the GPL is a license, and as licensee I have the right to the legal protection of the license and that means knowing who the copyright holder is to defend my claim to the use the license. 

The copyright statement is required in the GPL along with the full text of the license, which makes complete sense since only the actual copyright holder has the right to make the license. As GPL 3 puts it, ".... Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software ..."  If you are a copyright holder, you have to assert that in the license. GPL requires it and Moodle requires it.

If you just want to get your copyright out of the code, you could, if your country allows and not all do, transfer your copyright to another person, or also to an organization or company (which are not covered under right to erasure anyway).

Now, there might be cases where the right of erasure request is valid. For instance, if you weren't actually the copyright holder. Say someone had falsely put your copyright into some malicious code, had gotten caught, and you were trying to correct that to clear up your reputation, I imagine that would fall under the right of erasure. I didn't actually license it from you, as it turns out. So, the reason for the request is important because the DPO has to make sure the request meets the criteria for erasure.



Average of ratings: Useful (1)
In reply to Randy Thornton

Re: EU General Data Protection Regulation (GDPR) compliance

by Tim Gildersleeve -

There are many cases were the "right to erasure" does not apply.   This makes sense really when you consider its original intent.  It was written to protect people from things like old index entries in search engines.    For example someone accused of a crime and reported in papers but later exonerated - they can request that google (for example) remove links to the reports of their suspected guilt.   The right to erasure wasn't designed for someone just wanting their stuff removed for no reason.

Average of ratings: -