Activity

1. kylemh commented on May 28, 2018

   

   kylemh

   on May 28, 2018

   Member

   More actions

   Do you mean like a:

   "Read this... Do you agree?" system for all 3 of those links?
2. kylemh

   added

   Needs: More Detail

   Needs: Copy/Content

   Type: Feature/Redesign

   Priority: Immediate Need

   on May 28, 2018
3. hollomancer commented on May 28, 2018

   

   hollomancer

   on May 28, 2018

   MemberAuthor

   More actions

   Pretty much, plus a corresponding entry in the backend to record the date which this took place.
4. kylemh commented on May 28, 2018

   

   kylemh

   on May 28, 2018

   Member

   More actions

   @hollomancer is that specifically required by the policy? Registration date would be good enough for me, otherwise.
5. nellshamrell commented on May 29, 2018

   

   nellshamrell

   on May 29, 2018

   Last edited by nellshamrell

   Collaborator

   More actions

   Hello!

   Just went through the Privacy Shield docs in depth and want to share what they are and how the affect us (skip down to the bottom for what we need to do).

   This is indeed motivated by GDPR.

   What is Privacy Shield?

   • way of ensuring that we are compliant with user data requirements of GDPR. Although we have few non-US members, we do have some volunteers from outside the US, and even if we didn’t this is the right thing to do when it comes to treating our user’s data with care and respect.

   Main principles of Privacy Shield

   Notice

   • includes informing users the purpose of us collecting personal information, how to contuct us with inquiries or complaints, type of third parties we discolse personal information to and the purpose, right of individuals to access personal data, etc. (for more, check out https://www.privacyshield.gov/article?id=1-NOTICE)
   • this appears to be covered with our updated privacy policy

   Choice

   • gives people a chance to opt out (it appears that the only option to opt out of our limited data collection is to not sign up as a member of our org, which is certainly a bummer, but having the checkboxes will ensure that someone is aware that they have opted in)

   Accountability for Onward Transfer

   • I believe this is also covered in our updated privacy policy
   • basically - we need to be aware that any third parties we share data with (i.e. Google Analytics, Send Grid) are doing so in a limited purpose that the individual consented to - basically if we are going to use a 3rd party service, we need to make sure that they are following the same guidelines we do

   Security

   • This is around us taking reasonable and appropriate measures to protect and data from loss, misuse, and unauthorized access. I believe this is covered by our use of AWS IAM users, etc. to limit access to data. We do need to be more careful in the future or any data transfered outside of our core database (i.e. csv sheets) - these should be deleted as soon as they are no longer needed and should never be placed on external drive (i.e. USB drive). I’ll put together a data policy that covers this.

   Data Integrity and Purpose Limitation

   • we should only use the data exactly how we say we are (i.e. we should never, ever sell our user emails lists) - I’ll include this in a data policy as well.

   Access

   • this covers a user being able to correct, amend, or delete their information. They do have access to correct or amend it through editing their Operation Code profile - but if there is data they cannot access or if they want their data deleted entirely, they can reach out to us as stated in updated privacy policy

   Recourse, Enforcment, and Liability

   • TLDR; there are consequences for not complying with these policies

   What do we need to do?

   We absolutely need "Have your read this? Do you agree?" checkboxes for:

   • terms of use
   • code of conduct
   • privacy policy

   The privacy policy one is the most important, but it's also a good practice to have them for the terms of use and code of conduct as well.

   The reason we need to date the user agreed to these policies is so we can trace back exactly what language they agreed to. In case we ever decide to have users agree to updated policies (which I believe we should), this should be separate from the registration date.
6. dmarchante commented on Jun 19, 2018

   

   dmarchante

   on Jun 19, 2018

   Last edited by dmarchante

   Contributor

   More actions

   anyone assigned to this issue yet, and will we have to coordinate with the back-end
7. kylemh commented on Oct 1, 2018

   

   kylemh

   on Oct 1, 2018

   Member

   More actions

   Documented in OperationCode/front-end#174
8. kylemh

   closed this as completedon Oct 1, 2018