Implementing Privacy API in my plugin but it doesn't show in compliance registry

Implementing Privacy API in my plugin but it doesn't show in compliance registry

by P Reid -
Number of replies: 4

Hi, I am in the process of writing my first Moodle plugin, a block. I've done my own projects in Java and PHP but found it difficult getting my head around integrating into Moodle. My plugin is very basic - just displays a 'leader board' of rewards/achievement points. This data is pulled from an external server - so the block sends the user ID in the request.

I've read the Privacy API notes and implemented a provider.php:

namespace block_rewardstally\privacy;
use core_privacy\local\metadata\collection;
defined('MOODLE_INTERNAL') || die();

/**
 * Implements the Moodle privacy API
 */
class provider implements \core_privacy\local\metadata\provider {

    /**
     * Called by the Moodle Privacy API interface.
     * @param collection $collection Moodle privacy collection object.
     * @return collection The updated Moodle privacy collection object.
     */
    public static function get_metadata(collection $collection): collection {

        $collection->add_external_location_link('block_rewardstally_api', [
            'userid' => 'privacy:metadata:rewards_api:userid',
            ], 'privacy:metadata:rewards_api');

        return $collection;
    }

}


and I have the language strings:

$string['privacy:metadata:rewards_api'] = 'In order to integrate with the remote data source providing the rewards data, user data needs to be exchanged with that service.';
$string['privacy:metadata:rewards_api:userid'] = 'The user ID is sent from Moodle to allow a user to see the total of their rewards points to date.';

but under Site admin -> Users -> Privacy and policies -> Plugin privacy registry my block has the red exclamation triangle and doesn't report as it should. My thanks to the Moodle moderator (David) who identified a typo with the language string on my initial commit; I've fixed this but it still doesn't work. Any help would be appreciated.

link to git: https://github.com/moodleuser101/moodle-block_rewardstally/blob/main/classes/privacy/provider.php

Average of ratings: -
In reply to P Reid

Re: Implementing Privacy API in my plugin but it doesn't show in compliance registry

by Benjamin Ellis -
Picture of Particularly helpful Moodlers
Hi,

You might have to increase your plugin version - worth a try.
In reply to Benjamin Ellis

Re: Implementing Privacy API in my plugin but it doesn't show in compliance registry

by P Reid -
Thank you for taking the time to reply. Yes, I have tried iterating the version (several times) and done the 'upgrade database' steps etc, but it doesn't seem to change the compliance registry entry. Is there anything 'wrong' with my code or something else I need to do to register my plugin's compliance?
In reply to P Reid

Re: Implementing Privacy API in my plugin but it doesn't show in compliance registry

by Davo Smith -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers
Well, I've not looked through the code that displays this compliance indicator (or, to be honest, at the page itself), but I have written several plugins that include privacy declarations.

At a guess, the reason it is showing a compliance error, is that you've described what data your plugin stores, but not implemented any of the functions needed to export or delete that data ( https://docs.moodle.org/dev/Privacy_API#Providing_a_way_to_export_user_data ).

It may well be, that as your plugin only sends data to an external system, but does not store it internally, that it is entirely appropriate that you do not provide export/delete interfaces. However it may also be the case that the compliance report isn't clever enough to realise that is the case and is showing non-compliance, because you declare you do handle personal data, but don't provide these extra functions (again, I'm guessing here - I could be wrong, you'd have to check the code).

One final guess, if you implemented the export / delete functions, but didn't actually do anything inside them, that might be enough to sort out the compliance report (again, I could be completely wrong here).
In reply to Davo Smith

Re: Implementing Privacy API in my plugin but it doesn't show in compliance registry

by P Reid -
Thanks for your reply; I tried adding in those methods and it didn't make any difference.

*However*, I downloaded the Privacy API/Utilities CLI scripts and ran those, delving into the methods the CLI scripts called to see why they were reporting my plugin 'fails' the privacy tests. I eventually located the problem:

I needed to implement the

\core_privacy\local\request\data_provider

interface too. That's it! It now works. My thanks to those replying for helping me to think this problem through a bit more.

Average of ratings: Useful (1)