This document discusses GDPR and its implementation in Open Social, a Drupal distribution. It begins with an overview of GDPR, including its goals of giving citizens control over personal data and simplifying regulations for international business. It then discusses key GDPR concepts like personal and sensitive data. Next, it outlines steps for GDPR compliance in Open Social, such as obtaining user consent for data policies and usage, and allowing users to correct, export or delete their personal data. It notes actors defined in GDPR and potential penalties for non-compliance. Finally, it suggests building a proper social network rather than just deleting Facebook accounts.

1. You should
or how GDPR tries to save us all
Taras Kruts

2. About me
● Drupal Developer at Lemberg
● Open Social team member
● Not a lawyer
● Not addicted to Facebook

3. What this presentation is about?
1. Basic GDPR concepts
2. GDPR implementation in Open Social (Drupal 8 distro)
3. Why you should delete Facebook (IMHO)

4. What is GDPR?
The General Data Protection Regulation (GDPR) (EU) 2016/679 is a
regulation in EU law on data protection and privacy for all individuals
within the European Union (EU) and the European Economic Area (EEA). It
also addresses the export of personal data outside the EU and EEA areas.
The GDPR aims primarily to give control to citizens and residents over
their personal data and to simplify the regulatory environment for
international business by unifying the regulation within the EU

5. What is personal data?

6. What is sensitive and confidential data?

7. The golden rules of privacy
1. You need to know what you really need the info for and do not use if
for any other purposes.
2. Make sure info stays complete and up do date.
3. Do not simply share info with others.
4. Make sure that nobody can get to info and destroy that info when you
no longer need it.
5. Be open and transparent to people on whom you have information:
tell them what you do with their information, what you need it for,
where and how long you are going to store it.

8. Privacy rights for individuals

9. Actors
The Data Controller: Open Social customers.
This is the entity that decides the means,
purpose, and processing of the data.
The Data Processor: Open Social. This is the
entity that handles and processes the
personal data on behalf of the controller.
The Data Subject: Users of an Open Social
online community. This is who the law has
been designed to protect.

10. What if I do not follow the GDPR rules?

11. Stupid GDPR joke
- Do you know a good GDPR consultant?
- Yes.
- Can you give me his email address?
- No.

12. 4 easy steps to GDPR compliance

13. Ask for consent to data policies

14. Ask for consent to data policies

15. Ask for consent to data policies

16. Inform users of data usage

17. Inform users of data usage

18. Rectification (right to correct personal data)

19. Disable profile fields

20. Disable profile fields

21. Disable profile fields

22. Content Visibility

23. Delete User Account and Personal Data (Erasure)

24. Still to come
● Allow users to export their data from Open Social.
● Encrypt personal data by default (SaaS)

25. gdprhallofshame.com

26. Ghostery accidentally put everyone in the TO: field

27. Instapaper is shutting down in EU

28. Should you delete facebook?

30. It’s time for a
proper social network.

32. Don’t just #deletefacebook.
Let’s build something better.

34. More about GDPR and Drupal
● Think Your Website is GDPR Compliant? - DrupalCon Nashville 2018
● GDPR: we have to live with it by Alexey Gorushkin - Drupal Cafe Lutsk # 11
● Overview of GDPR contrib modules - Drupalcamp Transylvania 2018 May 6
● drupal.org/project/gdpr
● drupal.org/project/data_policy
● drupal.org/project/drupal_gdpr_team