Bug 21189 - GDPR: Log all CRUD actions on patron data
Summary: GDPR: Log all CRUD actions on patron data
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: unspecified
Hardware: All All
: P2 enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 22794
  Show dependency treegraph
 
Reported: 2018-08-09 13:28 UTC by Vitor Fernandes
Modified: 2020-08-24 12:05 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vitor Fernandes 2018-08-09 13:28:07 UTC
Under the auspices of the recently issued European legislation regarding data privacy (GDPR), the Portuguese government has issued a series of mandatory requirements, as well as general recommendations, for software applications that are implemented under the umbrella of public bodies (RCM 41/2018).

Since Koha is mostly used by municipalities and universities in Portugal, some of these mandatory requirements need to be address by Koha implementers in Portugal.

We believe that this requirement is also useful for the community at large. Here’s a description of the requirement.

*** Requirement description ***

Every operation that has to do with creating, updating, deleting and changing permissions of user personal data should be logged.

One should know who, when, on who and from the operation has been performed.

*** Scope ***

Applies in all cases.
Comment 1 Michal Denar 2018-09-27 11:20:43 UTC
Hello,
many actions are logged now, but I agree that we need to make review and set this to perfect fit to GDPR. Maybe we need to create new Syspref like "Log actions with personal data".

Related to bug 20028 we should logged export of data in package too.


Mike