Scope and guideline for privacy and compliance

I am happy to assist here and give my knowledge around this topic.

@jurgenhaas please could we add the Media Management track to the list of tracks for attention? https://www.drupal.org/project/drupal_cms/issues/3461533 📌 [META] Track 15: Proposal for media management Active

In particular, we need to consider privacy and compliance for embedded media, such as embedded YouTube videos that track users. I am conscious too of identifiable data relating to media such as names, faces and location especially if we have exif data uploaded or at some point we use features like face detection AI.

@tonypaulbarker this is a great suggestion, I totally missed that. Added your track to the list, thanks.

An additional aspect came out of a discussion with @rkoller who stated that we may also have to provide some mechanism to encrypt sensitive data to protect users from getting data points exposed after a data breach.

aside the aspect of providing an opportunity to encrypt sensitive data, another important point to mention and maybe to consider might be the creation of technical organizational measures (TOMs).

https://thegdprcomplianceconsultancy.co.uk/the-meaning-of-technical-and-...
https://aigner-business-solutions.com/en/blog/gdpr-explained-simply-toms...

The scope of TOMs is definitely broader than just the CMS, but it might be worth to consider the option to autogenerate a TOMs template for a site. It is impossible to autogenerate a complete TOMs template but based on the sites config you already know the technical measure in place for the drupal site (which modules and configuration are used and which process are defined, and for example certain workflows in eca that have processes in place that are relevant to the gdpr, same as content moderation workflows and so forth). the other relevant points for the TOMs could be left blank and the user is able to fill those blanks. so the user has a template speeding up the generation of the initial TOMs as well as making it easier to keep those up to date?

At the very least, the European Data Protection Regulation applies not only to companies and authorities based in Europe, but to anyone who processes the personal data of European citizens. On the World Wide Web, a website operator is therefore likely to have to comply with the regulations of different countries, not just those of the country in which its website is located. Consequently, the recipe should cover the sum of all regulations, not just those of the website's home country. Presumably we cover everything if we go by the most restrictive legislation.

This is a broad topic and a lot of information has already been collected here. Considering that Drupal CMS is due to be released at the end of 2024, we should start creating tasks for concrete implementation steps and discuss details there. The selection of features should initially be based on the target audience: Content creators and marketers and a broader range of budgets.

I've updated the issue description. In particular removed the "education" and replaced that with "information" as discussed and agreed last week. Also added a status summary for where we're now, right at the beginning of executing the plan.

Please review, comment, update, as you see fit and let us know if you're OK with it, setting this to RTBC. I'm planning to mark this fixed by the end of this week.

jurgenhaas → credited kjay → .

jurgenhaas → credited murrayw → .

jurgenhaas → credited rosk0 → .

Granting credits to interview partners. Thank you so much for your time and input.

Closing issue as work is being captured in separate issues.

Automatically closed - issue fixed for 2 weeks with no activity.