How to handle private information?

[Te-k]

Is your feature request related to a problem? Please describe.

By design, pytition will have to deal with private information (names, emails, phone numbers etc.). How to deal with that ?

Describe the solution you'd like

I see two options :

• Pytition does not allow the petition owner to have access to the full data. In that case, Pytition because the third party that owns the responsibility of having and keeping the data, and displaying the right number of signatures
• Pytition allows the petition owner to fully download the data of the user that signed the petition (it is the case today), in that case the petition owner is responsible for the data.

I am not sure what is the best option, in both cases, we have to make sure that the policy is clear to the user. We should also check what GDPR is saying about all that.

Maybe having Framasoft involved in the discussion would help.

[fallen]

I think organizations (and also user who own petitions) should be able to print the list of signatories (with names and emails at least). This is necessary when, at the end (or start) of a campaign you want to "give the petition" to a public representative (like a mayor or a deputy or such).

[fallen]

I also think it's fairly reasonable to give control of the data to both signing user and the petition owner. I would like the hosting organization to not gain power over hosted organizations. So no data retention. But indeed the policy should be very clear to user. Even if I find it logical that the data you enter in a formular will be accessible by the organization which made the formular.

[fallen]

CNIL paper about RGPD: https://www.cnil.fr/fr/guide-rgpd-du-developpeur