Bug 8155 - Comply with UK Electronic Commerce (EC Directive) Regulations 2002
Summary: Comply with UK Electronic Commerce (EC Directive) Regulations 2002
Status: RESOLVED DUPLICATE of bug 27378
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: MJ Ray (software.coop)
QA Contact:
URL: http://opac/
Keywords:
Depends on:
Blocks:
 
Reported: 2012-05-25 10:59 UTC by MJ Ray (software.coop)
Modified: 2023-06-30 13:58 UTC (History)
5 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
bug 8155 - comply with UK Electronic Commerce (EC Directive) Regulations 2002 (5.81 KB, patch)
2012-05-25 11:20 UTC, MJ Ray (software.coop)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description MJ Ray (software.coop) 2012-05-25 10:59:37 UTC
The full details are on http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/cookies.aspx but as I understand it we need a way to avoid setting any cookies on the OPAC until the user has been warned and consented.

I intend to destroy the session and cookie in C4::Auth::get_template_and_user() just before it is sent back to the OPAC, as long as no cookie-using features are enabled; and to add a small notice to the OPAC login forms.

I am marking this as critical because it means Koha should not be used in the UK (arguably the whole EU) in public until this bug is fixed. Koha admins should ensure that a cookie notification is included in their staff user agreements/policies, to cover the intranet interface. (You can also do that if your OPAC is not public, rather than apply this fix.)

A patch, sponsored by software.coop, will be along shortly.
Comment 1 MJ Ray (software.coop) 2012-05-25 11:20:58 UTC
Created attachment 9775 [details] [review]
bug 8155 - comply with UK Electronic Commerce (EC Directive) Regulations 2002

C4/Auth.pm: destroy the session and cookie if it is not needed
installer/data/mysql/sysprefs.sql: change default for EnableOpacSearchHistory
koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref: add note about this law
koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt: add div#cookiewarning with consent request
Comment 2 Chris Nighswonger 2012-05-25 12:51:50 UTC
Correcting assignment
Comment 3 MJ Ray (software.coop) 2012-05-25 15:42:18 UTC
oleonard has pointed out that I need to exempt the cart cookie and probably the KohaOpacLanguage cookie.  Falling back while I code a new patch.
Comment 4 MJ Ray (software.coop) 2012-05-30 10:57:30 UTC
The responsible government agency has backed down at the last minute http://www.guardian.co.uk/technology/2012/may/26/cookies-law-changed-implied-consent so as long as libraries have a current privacy policy that mentions the cookies used by Koha (CGISESSID, KohaOpacLanguage, KohaOpacRecentSearches, bib_list... any others?), they should not be prosecuted for now.

I still think we should avoid setting cookies until we need them, but with the imminent kohacon, I'm putting this onto a backburner.
Comment 5 Paul Poulain 2012-11-21 16:56:39 UTC
lowering this bug to enhancement, as it's no more a CRI pb for UK
Comment 6 Katrin Fischer 2019-04-28 14:03:36 UTC
I wonder what the current status of this is?

Since this has been filed we have added cookie documentation to the wiki and a coding guideline that new ones need to be documented:
https://wiki.koha-community.org/wiki/Use_of_Cookies
Comment 7 Andrew Isherwood 2021-01-11 11:48:09 UTC
I am undertaking enabling compliance with EU Cookie Legislation in Bug 27378. Given the age of this bug, the new bug may be considered a replacement.
Comment 8 Katrin Fischer 2023-06-30 13:58:21 UTC

*** This bug has been marked as a duplicate of bug 27378 ***