The module send information to an external site without informing the people who are using it

Assuming it is acceptable to send information to an external site, the project page should inform people installing and using the module which data is sent, to whom, and why. No data must be sent without information. Preferably, the same information should be given in a page rendered from the module; the module setting page would be fine too.
Eventually, there should be an option to avoid that data is sent.

Editing the project page and changing the module code are task for the project queue. Bear in mind it is not acceptable to send data without informing people or without their consens.

For a site that provides services to users located in Europe, it is illegal for a website to do this without prior informed consent from the user. The GDPR (the EU legal framework for data protection) imposes some very huge fines on the site's data controller (usually the site's owner) for doing this.

@apaderno, @gisle

We understand your concern and will take the necessary steps to get this changed. We currently have 2 options. One, as rightly pointed by @apaderno, would be declaration of whatever data that would be sent, will be shown to the user asking for their consent, with an option to skip the transmission. And two, deprecate the transfer of email + domain data back to our servers.

We will ensure the fix in place and the latest release will go out within the next 48 hours with the fix implemented.

Here is a reference to the provisions of the GDPR you must address if you want the module to comply with the GDPR:

1. Information to be provided where personal data are collected from the data subject
2. Conditions for Consent
3. Transfers on the basis of an adequacy decision
4. Right to erasure

Please take into account that the first item information ("Information to be provided") is very detailed and goes well beyond a simple declaration of whatever data that would be sent.

As for the last two items (transfers of personal data to a location outside of Europe, and the right to erasure, those requirements are not addressed by apaderno and may be very hard for you to satisfy.

IMHO, anyone using this module in Europe in its current state risks paying a fine, for example, see: European supervisory authority issues €8.15m fine for international data transfer and processing failings

hi @apaderno @gisle, we have made the required changes in the 3.0.6 version of the module.

We have handled this in the module in the following manner:
1) Informing the people of what data will be sent if they choose to submit the feedback during uninstallation on that same form itself.
2) We have also added the option to avoid sending any data via the skip feedback option.

Let us know in case any further changes are required.

Did you read my comment #6?

In it. I tried to provide some guidance about what was required to make your module comply with privacy laws in Europe, but you choose to ignore it. Here is another attempt, that relieves of the burden of following links to the actual legal framework:

When requesting information from the data subject, article 13 requires that the following information is provided:

• the identity and the contact details of the controller and, where applicable, of the controller’s representative; the contact details of the data protection officer
• the legal basis for the processing;
• the legitimate interests pursued by the controller or by a third party;
• the recipients or categories of recipients of the personal data, if any;
• the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
• the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
• the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
• the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• the right to lodge a complaint with a supervisory authority;
• meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Version 3.0.6 provides none of this information.

The GDPR (Recital 32) also says:

• Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

I.e. the blank opt-out checkbox that you provide does not constitute valid consent.

Hi @gisele, my intention was not to ignore your comment or any of your insights on the issue at hand. I also appreciate you providing the relevant links and detailed information on the subject.

I will go through all the provided information(links as well as the detailed text) in order to get a better understanding. But before that, I will make the required changes to eradicate the complete feedback process from the module so that there is no export of the data during the entire process.

This feedback form was removed from the 3.0.7 version

Automatically closed - issue fixed for 2 weeks with no activity.