Bug 18081

Summary: [omnibus] GDPR (General Data Protection Regulation)
Product: Koha Reporter: Michal Denar <black23>
Component: PatronsAssignee: Bugs List <koha-bugs>
Status: In Discussion --- QA Contact: Testopia <testopia>
Severity: new feature    
Priority: P5 - low CC: bugzilla, claire.hernandez, dcook, george, gmcharlt, jonathan.druart+koha, josef.moravec, katrin.fischer, kyle.m.hall, lisettepalouse+koha, m.de.rooy, magnus, niamh.walker-headon, paul.poulain, rbit
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 18003, 20024, 20025, 20026, 20027, 20028, 20605, 20606, 20645, 20863, 25673, 31495, 13667, 18242, 19008, 20604, 20819, 20876, 21301, 21336, 24151, 24541    
Bug Blocks:    

Description Michal Denar 2017-02-08 11:48:34 UTC
Next year (2018) all EU countries must apply new regulations about data protection. So let's talk how to prepare Koha for this.
More about regulation in english: http://www.privacy-regulation.eu/en/index.htm
Mailing debate: http://lists.koha-community.org/pipermail/koha-devel/2016-November/043314.html

Main questions: 
- how protect private data of borrowers (Qvarn etc.)
- how connect people into Koha by secure way (https/SSL, Gloo etc.)
- how protect APIs access (better documentation, best practise etc.)
- how drive access to private data in system (new set of permissions?)
- how to track security accidents and "damage" (more logs and analyse tool?)
- how to offer better support for automatic anonymization/delete of non-active borrowes and their data from system
- how to declare/certify Koha as system that protect private data and respect EU regulations

This topis is very important for all libraries with Koha from EU countries. But data protection and security are universal topics at this time. It can be competetive advantage for Koha too.

Comment 1 Katrin Fischer 2017-06-05 11:53:29 UTC
Hi Mike, I think while this could serve as an omnibus bug for improvements discussion is not going to happen on bugzilla. I suggest collecting ideas on the wiki and adding the topics to a dev meeting agenda. What do you think?
Comment 2 Michal Denar 2017-06-08 07:07:18 UTC
Hi Katrin,
now I try to analyse many GDPR sources and collect some points relevant to Koha. Wiki is good place for it. We can start talk about it and later we will make some goals for Koha 18.05. 
Do You create page on wiki a give link here?


Comment 3 Katrin Fischer 2017-08-17 10:52:02 UTC
Hi Mike, sorry, I had missed this comment. I have created this page, is it ok?
Please also take a look at our Kanban, where data privacy was suggested for a new "EPIC" that can include several tasks and subtasks. It's better suited for discussions than the wiki: https://tree.taiga.io/project/joubu-koha-rm-1711/us/37
Comment 4 Marcel de Rooy 2018-05-25 08:57:37 UTC
I would prefer a patron consent field as a datetime somewhere. This helps us to comply to the need to prove that a patron gave consent. It should be added to self registration too.
Comment 5 Marcel de Rooy 2018-06-05 14:12:18 UTC
(In reply to Marcel de Rooy from comment #4)
> I would prefer a patron consent field as a datetime somewhere. This helps us
> to comply to the need to prove that a patron gave consent. It should be
> added to self registration too.

Please have a look at bug 20819 now for the above.
It adds a 'your consents' tab in the OPAC account menu. And includes a consent during self-registration. (No staff changes there.)