Extend GDPR compliance

[barnabwhy]

Responsibility of the controller/processor:

Data protection by design and by default

• [x] ...by default, only personal data which are necessary for each specific purpose of the processing are processed. (only personal data we collect is email, is used for specific purposes of account verification and account recovery, will also be used for right of access)

  Security of processing

  • [x] Implements data-protection principles (password hashing, data minimisation, prevention of data leakage)
  • [x] Pseudonymisation & confidentiality (Usernames used instead of names, email not exposed to OAuth applications without express user consent)

    Communication of a personal data breach to the data subject

• [ ] Have method of sending email informing of a breach to affected customers (Not necessary to implement further measures as those operating the database are under such obligations to inform)

Rights of the data subject:

Information to be provided where personal data are collected from the data subject

• [ ] List what personally identifiable information (PII) and additional information is stored in the database on some accessible info page

  Right of access by the data subject

• [ ] Ability to request data sent to email

  Right to rectification

• [ ] Ability to change email address used on account? (Only PII in database, but if email is wrong then it isn't PII cause it's not theirs?)

  Right to erasure (‘right to be forgotten’)

• [x] Request deletion of account
• [ ] Automated account deletion (Or account lock by hashing existing data and requiring verification to unlock?) (After how long and what excludes it this taking place?)

  Right to object

• [x] Initial objection (Not accepting ToS and Privacy Policy) will prevent account creation
• [x] Late objection (Requesting account deletion (see right to erasure)

Information for those managing Oathent server:

• [ ] Have information easily accessible on what GDPR obligations are automatically handled by the program
• [ ] Have information easily accessible on what GDPR obligations fall upon those operating the program

[barnabwhy]

At the moment there are no apparent breaches in GDPR regulation, however, a large portion of responsibilities fall upon those managing an instance of Oathent server which could instead be handled by the server itself.