GDPR tooling - User data export

InezMc commented 1 year ago

Your use case

What would you like to do?

Enable users to automatically request and download their personal data to fulfill Article 15 of the GDPR, Right of access by a data subject.

Why would you like to do it?

The GDPR gives data subjects the right to request (Access Art. 15 GDPR) their personal data and for the right to data portability (Art. 20, GDPR) Currently this process is a manual one which can take several hours per request. As Matrix grows allowing data subjects and data controllers (our customers) to extract this data will need to become a priority. Especially as Matrix is expanding within Germany where the GDPR is strongly enforced.

Business case: Customers will need to be able to export the data of one of their users. Giving the option for users to get their data when they delete their account.
Element / Matrix need to be able to export data for compliance purposes.

How would you like to achieve it?

What we require is a tool / button in Element which exports all the data of a user in a readable format. Preferably one that acts automatically

What we need the feature to do:

Something that is readable (human / machine)
Return Media - including audio (voice notes), Images, other media?
- currently all we pull is links. A downloadable folder of all media shared by user.
Room memberships (Room ID; Room name; Power level; room description; join date/leave date)
- Is it possible to do historic memberships? As that information is stored in room events. Technically this is user data. That is stored on the server.
Profile Picture + Historic ones.(Are these stored?)
User name and all changes.
3pID
IP data & User agent
User activity - All messages sent.
Any other ommited or future user data collected

Urgency

This is not immediately urgent or on fire as we are able to do Subject access requsts using other tooling, but as the network grows and more users in especially Germany are using the matrix protocal, some means of enacting this right will become more urgent.

Have you considered any alternatives?

We can continue with what we have. Currently matrix-CLI is used for M.org. I am unsure what tools are used or available for EMS or PS customers.

Additional context

General considerations

If it is the user requesting woud encrypted room content remain encrypted? Or can that be returned in an unencrypted format. I found this issue which may link to this https://github.com/vector-im/element-web/issues/15281
If it is the administrator of a homeserver requesting, would encrypted rooms return encrypted state events.

This request probably has similarities to exporting conversations. the https://github.com/matrix-org/matrix-react-sdk/pull/6081