mahara-contributors team mailing list archive

[Cecilia Vela Gurovic <1739688@xxxxxxxxxxxxxxxxxx>]

** Changed in: mahara
     Assignee: (unassigned) => Cecilia Vela Gurovic (ceciliavg)

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1739688

Title:
  Turn on "strict privacy" modus on the site level

Status in Mahara:
  Confirmed

Bug description:
  We need to make a series of changes in Mahara to comply with the GDPR.
  More info is available on the wiki at
  https://wiki.mahara.org/wiki/Developer_Area/Specifications_in_Development/GDPR_compliance

  The GDPR requires that users consent to the privacy statement of a
  site explicitely. Mahara can have multiple institutions and in theory
  it is possible that a user can be in multiple institutions.

  We are excluding the case of users being in multiple institutions at
  the same time from the initial development work as it makes the
  consent and also removal of accounts much more complicated for the
  amount of time that we have available until the GDPR takes effect.
  Furthermore, the majority of Mahara sites is not multi-tenanted and
  thus people wouldn't be in multiple accounts.

  What is to be done:

  1. Create a Yes/No switch in Config site -> Site options ->
  Institutions settings as first option in that panel: Strict privacy.

  2. The short grey description should have a sentence along the lines
  of: Turn on this option when your site needs to adhere to the GDPR
  (link to it).

  3. Info icon for this option (text to be confirmed):
  - Link to the GDPR
  - Turning on this option will require everyone to accept the T&C and the privacy statement for the site / their institution.
  - It will not be possible for people to be in multiple institutions at the same time.
  - The option is not available if the current site has people in multiple institutions. If you need to turn on the strict privacy, then these accounts will need to be cleaned up.
  - For more information and any text changes you may need to make to your T&C and privacy statement, please consult your lawyer. The Mahara project cannot provide legal advice.

  4. When displaying this option, Mahara needs to be checked if there
  are users in multiple institutions. If so, the option is greyed out.
  If multiple institutions are allowed but there aren't any users in
  multiple institutions, the multi institution switch is moved to "No"
  and greyed out. If multi institutions is not allowed, the switch is
  greyed out.

  5. Turning the "Strict privacy" switch to "Yes" also requires everyone
  to accept the T&C and privacy statement when they log in for the first
  time (once changes were made etc. as per the separate Launchpad items
  on that).

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1739688/+subscriptions