Bug 18081 - [omnibus] GDPR (General Data Protection Regulation)
Summary: [omnibus] GDPR (General Data Protection Regulation)
Status: In Discussion
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low new feature with 1 vote (vote)
Assignee: Bugs List
QA Contact: Testopia
Depends on: 18003 20025 20026 20027 20028 20605 20606 20645 20863 25673 13667 18242 19008 20024 20604 20819 20876 21301 21336 24151 24541 31495
  Show dependency treegraph
Reported: 2017-02-08 11:48 UTC by Michal Denar
Modified: 2022-08-31 12:05 UTC (History)
15 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description Michal Denar 2017-02-08 11:48:34 UTC
Next year (2018) all EU countries must apply new regulations about data protection. So let's talk how to prepare Koha for this.
More about regulation in english: http://www.privacy-regulation.eu/en/index.htm
Mailing debate: http://lists.koha-community.org/pipermail/koha-devel/2016-November/043314.html

Main questions: 
- how protect private data of borrowers (Qvarn etc.)
- how connect people into Koha by secure way (https/SSL, Gloo etc.)
- how protect APIs access (better documentation, best practise etc.)
- how drive access to private data in system (new set of permissions?)
- how to track security accidents and "damage" (more logs and analyse tool?)
- how to offer better support for automatic anonymization/delete of non-active borrowes and their data from system
- how to declare/certify Koha as system that protect private data and respect EU regulations

This topis is very important for all libraries with Koha from EU countries. But data protection and security are universal topics at this time. It can be competetive advantage for Koha too.

Comment 1 Katrin Fischer 2017-06-05 11:53:29 UTC
Hi Mike, I think while this could serve as an omnibus bug for improvements discussion is not going to happen on bugzilla. I suggest collecting ideas on the wiki and adding the topics to a dev meeting agenda. What do you think?
Comment 2 Michal Denar 2017-06-08 07:07:18 UTC
Hi Katrin,
now I try to analyse many GDPR sources and collect some points relevant to Koha. Wiki is good place for it. We can start talk about it and later we will make some goals for Koha 18.05. 
Do You create page on wiki a give link here?


Comment 3 Katrin Fischer 2017-08-17 10:52:02 UTC
Hi Mike, sorry, I had missed this comment. I have created this page, is it ok?
Please also take a look at our Kanban, where data privacy was suggested for a new "EPIC" that can include several tasks and subtasks. It's better suited for discussions than the wiki: https://tree.taiga.io/project/joubu-koha-rm-1711/us/37
Comment 4 Marcel de Rooy 2018-05-25 08:57:37 UTC
I would prefer a patron consent field as a datetime somewhere. This helps us to comply to the need to prove that a patron gave consent. It should be added to self registration too.
Comment 5 Marcel de Rooy 2018-06-05 14:12:18 UTC
(In reply to Marcel de Rooy from comment #4)
> I would prefer a patron consent field as a datetime somewhere. This helps us
> to comply to the need to prove that a patron gave consent. It should be
> added to self registration too.

Please have a look at bug 20819 now for the above.
It adds a 'your consents' tab in the OPAC account menu. And includes a consent during self-registration. (No staff changes there.)