For the past few months we have been focusing our development efforts at Moodle HQ on a major project to allow compliance of the incoming European General Data Protection Regulation (GDPR). This EU directive is due to come into place on the 25th May 2018.
Why should I care? - I'm not in the EU
Although this is an EU directive, it does affect everyone. If you have any users who are EU citizens then they have a right to invoke this law, and many non-EU countries around the world have arrangements in place which mean that organisations within those locations must also comply.
Why are you telling me all of this?
Well, under the law, users have a whole set of new rights, and these rights will affect all Moodle plugins. Amongst other things these rights include:
- the right to request information on what types of personal data you hold, along with how each instance of that data is used, and how long you intend to keep it for;
- the right to request a copy of all personal data that you hold; and
- the right to request deletion of all personal data that you hold.
In short, we're telling you because you will need to take action to ensure that your plugin can comply with the EU legislation.
This document only describes the part of the ongoing work which plugin developers need to be aware of.
What if I don't update my plugin to comply?
If you do not update your plugin, then any site which intends to use your plugin will not be able to fully comply with the requirements of GDPR, and they may be required to uninstall your plugin as a result.
Whether your plugin implements the privacy API may also be indicated within the Moodle Plugins database.
What does this mean for me as a plugin developer?
In short it means that you need to provide a way for that data to be described, exported, and deleted.
That sounds intense. Can't Moodle do that for me?
Moodle would love to do all of that for you, but unfortunately the core codebase does not know what your plugin does, what information it stores, how it stores it, what format it is stored in, and what that data really means.
However we are working on a new Privacy API which will make this much easier for you. It's that API that I'm posting about now as we have been considering how best to allow you to fulfill all of the requirements of the new legislation, whilst keeping things simple, efficient, performant, and keeping both plugin developers and the requirements of the legislation in mind.
We'd love some feedback on what we have so far. We have limited time available to get this functionality complete, so we don't have much time to get feedback.
We intend to create a new Privacy Subsystem. This contains a number of PHP Interfaces which we encourage you to implement.
We have tried to keep these Interfaces clear and concise with minimal coding required for developers.
We have written some documentation which gives hints on how the API is structured and answers a number of Frequently Asked Questions.
We have also pushed a working prototype of this code to https://git.in.moodle.com/gdpr/sar/tree/MDL-61306-master. Please note that this branch is a work in progress and is subject to change.
We have a working prototype of the GDPR Subject Access Request Tool at https://git.in.moodle.com/gdpr/sar/tree/MDL-59718-master. Please note that this branch is a work in progress and is subject to change.
We would love to have some feedback on this plugin. We do realise that it is a complex API, but we have tried to ensure that it is not overly complex for plugin developers whilst fully implementing the spirit of the new regulations, as well as any similar regulations and laws which may be implemented in other countries too.
Andrew, Adrian, Al, Barbara, David, Jake, Jun, Zig, and all others involved in the team.