Bug 8155

Summary:	Comply with UK Electronic Commerce (EC Directive) Regulations 2002
Product:	Koha	Reporter:	MJ Ray (software.coop) <mjr>
Component:	OPAC	Assignee:	MJ Ray (software.coop) <mjr>
Status:	RESOLVED DUPLICATE	QA Contact:
Severity:	enhancement
Priority:	P5 - low	CC:	cnighswonger, dcook, martin.renvoize, paul.poulain
Version:	unspecified
Hardware:	All
OS:	All
URL:	http://opac/
Change sponsored?:	Sponsored	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Attachments:	bug 8155 - comply with UK Electronic Commerce (EC Directive) Regulations 2002

Description MJ Ray (software.coop) 2012-05-25 10:59:37 UTC

The full details are on http://www.ico.gov.uk/for_organisations/privacy_and_electronic_communications/the_guide/cookies.aspx but as I understand it we need a way to avoid setting any cookies on the OPAC until the user has been warned and consented.

I intend to destroy the session and cookie in C4::Auth::get_template_and_user() just before it is sent back to the OPAC, as long as no cookie-using features are enabled; and to add a small notice to the OPAC login forms.

I am marking this as critical because it means Koha should not be used in the UK (arguably the whole EU) in public until this bug is fixed. Koha admins should ensure that a cookie notification is included in their staff user agreements/policies, to cover the intranet interface. (You can also do that if your OPAC is not public, rather than apply this fix.)

A patch, sponsored by software.coop, will be along shortly.

Comment 1 MJ Ray (software.coop) 2012-05-25 11:20:58 UTC

Created attachment 9775 [details] [review]
bug 8155 - comply with UK Electronic Commerce (EC Directive) Regulations 2002

C4/Auth.pm: destroy the session and cookie if it is not needed
installer/data/mysql/sysprefs.sql: change default for EnableOpacSearchHistory
koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref: add note about this law
koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt: add div#cookiewarning with consent request

Comment 2 Chris Nighswonger 2012-05-25 12:51:50 UTC

Correcting assignment

Comment 3 MJ Ray (software.coop) 2012-05-25 15:42:18 UTC

oleonard has pointed out that I need to exempt the cart cookie and probably the KohaOpacLanguage cookie.  Falling back while I code a new patch.

Comment 4 MJ Ray (software.coop) 2012-05-30 10:57:30 UTC

The responsible government agency has backed down at the last minute http://www.guardian.co.uk/technology/2012/may/26/cookies-law-changed-implied-consent so as long as libraries have a current privacy policy that mentions the cookies used by Koha (CGISESSID, KohaOpacLanguage, KohaOpacRecentSearches, bib_list... any others?), they should not be prosecuted for now.

I still think we should avoid setting cookies until we need them, but with the imminent kohacon, I'm putting this onto a backburner.

Comment 5 Paul Poulain 2012-11-21 16:56:39 UTC

lowering this bug to enhancement, as it's no more a CRI pb for UK

Comment 6 Katrin Fischer 2019-04-28 14:03:36 UTC

I wonder what the current status of this is?

Since this has been filed we have added cookie documentation to the wiki and a coding guideline that new ones need to be documented:
https://wiki.koha-community.org/wiki/Use_of_Cookies

Comment 7 Andrew Isherwood 2021-01-11 11:48:09 UTC

I am undertaking enabling compliance with EU Cookie Legislation in Bug 27378. Given the age of this bug, the new bug may be considered a replacement.

Comment 8 Katrin Fischer 2023-06-30 13:58:21 UTC


*** This bug has been marked as a duplicate of bug 27378 ***