Have a page for data protection details

[emanuele45]

Article 15:

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f) the right to lodge a complaint with a supervisory authority;

(g) where the personal data are not collected from the data subject, any available information as to their source;

(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

I feel it means we'd need to re-show the relevant part of the agreement somewhere in a page.

Probably related to #3142

[Spuds]

And maybe update the default agreement text ?

[emanuele45]

Yep.

Also, it may be worth considering the option to let the admin periodically cleanup "old" data, but I think right now it would be way too complex to realize.

[kode54]

We have some serious data cleanup to deal with on our forum, for instance. There are at least 800k accounts in our database, many of which are banned for spamming, and quite a few of which are just old users who may or may not ever come back. We just had a user come back after posting twice since they registered in 2012, asking for their account's deletion. I suppose all replies to their original posts should also be deleted, so that context doesn't belie any unwanted information.

[emanuele45]

@kode54 the regulation (I think I wrote it somewhere else) is not about deleting posts, it's about deleting personal data. If you want to delete posts, that's up to you, your agreement and how aggressive the requester is, I guess.