Get active consent from new partners approving them being on PlaceCal

[kimadactyl]

User story

Currently, we just take it on trust that organisers have asked partners before adding their details to the site.

This also has the side effect that it's not possible to use PlaceCal itself to invite new partners, this is done using external tools (email, face to face)

It would be nice if partnership and neighbourhood admins could add partners as unlisted until the named contact manually clicks to verify them. This will then let PlaceCal do the actual work of onboarding people.

More research needed to see if this is something we enforce for everyone or if we let people bypass it. There are also possibly GDPR implications to consider here if people's personal contact info is being added.

"as an organiser, i want an option to get active consent from each partner i add before they are visible on the public site, in order we can both clearly establish our commitment and they can double check all the details are accurate"

"as PHT, we want to ensure we have a record of consent from everyone whose information is on there, in order that we can clearly show chain of custody if anyone tries to sue us or claim we didnt have permission to add them"

Acceptance criteria

• [ ] When admins invite partners, they get a nicely formatted email inviting them to verify themselves on the platform
• [ ] Partners are not visible on PlaceCal until the link is clicked
• [ ] Possibly allow this function to be bypassed for either everyone or just roots

OR

• [ ] Allow organisers to log when and where consent was given to add them when the partner is created (i.e. the same as Mailchimp asking you the basis for adding people to your email list)

Implementation notes & questions

Implementation plan

To be written by the developer

[kimadactyl]

Slight retitle to reflect that this might be a big feature that lets organisers get on with it without needing an interim stage worrying about who to invite. For example, home ed network has 5,000 members and flourish 200 - it would be great if we can make it as easy as possible for them to onboard these people

[kimadactyl]

from discord convo to explain this better:

what organisers do is get consent in principle. they talk to people in the pub, organise meetings, have some whatsapp convos, ask people if they would like to be involved in a project theyre organising. this is generally a mess paperwork wise. its getting people onside and being able to say "yes that project sounds cool count me in". this is great but people are often unsure what exactly it is thats being asked of them.

what i think we need is consent in practice. its a thing saying "this person has added you to this platform with this information based on your previous discussion. is this a thing you still deffo want?". its a legal checkmark PHT can put down as well as a moral authorisation for the organiser

[ivan-kocienski-gfsc]

Discussing this on discord and thinking about this I have had some thoughts on this that may be helpful

Firstly I think the objective of this feature is: get permission from non-placecal people that using their partner on placecal is a-okay (sign off).

From that I developed the following diagram explaining the permission granting flow:

Where time flows from top to bottom. The break in the Admin User timeline represents separate flows where the Admin User can navigate to the show partner info page at any point.

This workflow does not involve creating a user account for the non-placecal person (which could happen in a later feature).

Questions:

• What happens if a non-placecal person declines their consent? does the partner become inactive?
• How do we stop PC admins from spamming someone if they have declined?
• What happens if the non-placecal person gives permission and then that partner changes in a way that the non-placecal person would object to?
• What happens if the non-placecal person just ignores the request

[kimadactyl]

I did some iteration on this and I'm starting to see why it's such a pain!

I just realised there's a much simpler solution to this -- we can do what the email list providers do and just ask for the basis of consent being given when the partner is created, and store who created them.

Annoyingly this would be another step to partner creation, which we are trying to speed up not slow down. But it would be way simpler to implement.

Not sure if I should open this idea in a new ticket or edit this one?

[katjam]

I think we can leave the idea in this ticket. Hopefully will have time to figure out what makes most sense during in time to get the work done in cycle 29.

[katjam]

It feels like this is too big to start now, but I think the minimum viable AC is:

• [ ] When I make a new partner, I can optionally add a partner_admin (which would have to be already in the system and someone I have access to - i.e. I am root or I created the user)
• [ ] When I make a new partner, they are inactive / hidden by default (already the case?)
• [ ] When I add a user as partner_admin to a partner, they receive an email asking them to verify that they would like to be included in any PlaceCal instances they'd be in
• [ ] Mechanism TBC for "accepting the invite" and "declining the invite"
• [ ] For now, they cannot opt in to some PlaceCal instances and out of others - all or nothing,