Why GDPR matters when building concrete5 websites

What has the new EU General Data Protection Regulation to do with concrete5 websites?

GDPR stands for EU General Data Protection Regulation. It's regulation on data protection and privacy for all individuals in the EU. The law is enforced on 25 May 2018 and also applies to organizations who do business with EU individuals. More information can be read on Wikipedia.

This article focusses on why GDPR is important if you are developing websites in concrete5.

concrete5

First of all, concrete5 is working hard to change things in the core that are GDPR related. The core team recognizes that Europe is a big market, and that this affects websites worldwide. To the people who are familiar with Github, here is a list of issues that relate to GDPR. The core team has also blogged about concrete5 and GDPR.

Why is it so much of a deal?

It involves a lot. For example, how data is stored, how it is collected, how long it is stored, how it can be ported, how it is deleted, etc. Because it's a law that will be enforced, sanctions can be carried out if an organization is not complying. However, how the law is enforced may differ from country to country. Law enforcement will probably first focus on larger organizations, because their impact is bigger. To get a more concrete idea of what it may mean for a small website and a large website, I'll describe two use cases.

Use case 1: a basic website

With a basic website I mean mostly informative, some images, but that's it. Nothing fancy or out of the ordinary. Could be a bakery, a church, a restaurant, etc.

Things to consider are:

  • If you use forms on a page, e.g. a contact form, you are processing user data. Does the visitor know that your Express Form submissions are stored in a database with Logs (by default) and Form Results (by default)?
  • Security. Lots of websites still run on http. If you have forms on your website, that data is sent unencrypted to the server. This also applies to the Login page.
  • Tracking and cookies. Most websites use a tool like Google Analytics to see where their visitors are from. In some cases you are required to ask consent from the visitor, before setting any cookies.
  • A privacy policy page where is explained what data is collected, why, how long, etc.

Use case 2: an advanced website

A more advanced website could be a hotel website where you can book a room, a portal where users can log in, an eCommerce website, etc.

  • If you have a member system, you may have to deal with options to close an account, export user data, or to modify data via a web interface. Do you have consent to store personal identifiable information?
  • Portability of user data. Say you use the Community Store solution, how are you, for example, going to export all orders from a certain user?
  • Deletion of user data. If a user closes his / hers account, how do you make sure that there are no references in the database that still associate with a certain user? E.g. via a userId? Will orders, reservations, logs, form entries, etc. also be deleted?
  • The user needs to give consent before processing. How are you keeping track of which and when certain consents were given?
  • Contracts with other parties. For example, if your website uses MailChimp for newsletters, Bugsnag for error reporting, or a connection to a CRM to sync client data with, you may need a contract with that party and you may have to inform your users in the privacy policy document.
  • If you send an email via concrete5, it's by default logged. If you send a form, it's also logged by default. Is this really needed? They may contain personal data. Maybe you need to add a required checkbox to all forms that visitors should agree to certain terms?
  • Cookie control. As your website probably uses more than just Google Analytics, it's likely that more cookies are 'installed'. For most of those, the user needs to approve. It becomes more technically challenging if you also have to describe the cookies, prevent them from being set, and opt-in for certain cookies only.

Conclusion

GDPR is causing us a lot of work and it may cost you a lot of money. However, the underlying principle is good; we should respect the data of our customers. Are you ready to start making your concrete5 website GDPR proof?