Next year (2018) all EU countries must apply new regulations about data protection. So let's talk how to prepare Koha for this.
More about regulation in english: http://www.privacy-regulation.eu/en/index.htm
Mailing debate: http://lists.koha-community.org/pipermail/koha-devel/2016-November/043314.html
- how protect private data of borrowers (Qvarn etc.)
- how connect people into Koha by secure way (https/SSL, Gloo etc.)
- how protect APIs access (better documentation, best practise etc.)
- how drive access to private data in system (new set of permissions?)
- how to track security accidents and "damage" (more logs and analyse tool?)
- how to offer better support for automatic anonymization/delete of non-active borrowes and their data from system
- how to declare/certify Koha as system that protect private data and respect EU regulations
This topis is very important for all libraries with Koha from EU countries. But data protection and security are universal topics at this time. It can be competetive advantage for Koha too.
Hi Mike, I think while this could serve as an omnibus bug for improvements discussion is not going to happen on bugzilla. I suggest collecting ideas on the wiki and adding the topics to a dev meeting agenda. What do you think?
now I try to analyse many GDPR sources and collect some points relevant to Koha. Wiki is good place for it. We can start talk about it and later we will make some goals for Koha 18.05.
Do You create page on wiki a give link here?
Hi Mike, sorry, I had missed this comment. I have created this page, is it ok?
Please also take a look at our Kanban, where data privacy was suggested for a new "EPIC" that can include several tasks and subtasks. It's better suited for discussions than the wiki: https://tree.taiga.io/project/joubu-koha-rm-1711/us/37
I would prefer a patron consent field as a datetime somewhere. This helps us to comply to the need to prove that a patron gave consent. It should be added to self registration too.
(In reply to Marcel de Rooy from comment #4)
> I would prefer a patron consent field as a datetime somewhere. This helps us
> to comply to the need to prove that a patron gave consent. It should be
> added to self registration too.
Please have a look at bug 20819 now for the above.
It adds a 'your consents' tab in the OPAC account menu. And includes a consent during self-registration. (No staff changes there.)