Using phpList for compliance with the GDPR: manual chapter feedback and discussion

[samtuke]

@Dain

Is it really now routinely necessary to have a check box where subscribers confirm on the subscribe page that there age is above 16 when the topic of the mailing list is not all related to age or critical in this sense?

I’m not sure, but my reading is that it’s safer to include it if content is not meant for children.

@Dain

there is one word “which” too much (Chapter Consent line 11)

Please can you quote the context? I can’t see this on the Manual page for GDPR.

@Dain

so no more unsuscribed clients on the blacklist in order to avoid accidental inclusion in the next campaign or to avoid bounces?

There is an exception for this case, see this post.

@Dain

“use the Data Export feature…” for “Right of Access” but in this general subscriber info and history file there may be/is a lot (!) not really self explanatory stuff. And the GDPR demands easy to understand explanation and presentation of data. Do you think subscribers should access this download automatically and by themselfs, respectively. I thought the stored data on the preference page are already enough and regarded as “complete”?

I’m not sure. The safest option seems to be to export everything that we have, and necessarily that will not always be easy to digest (e.g. should IP addresses include an explanation of the technology and meaning behind them?). So long as requests for access are met in a timely manner then the subscriber does not need direct access to export them themselves. Clearly that would be more convenient, but also raises potential security questions about the identity of the subscriber (e.g. “appropriate security measures in relation to the sensitivity of the data”).

@Dain

what about the stored IP address in this file?

What about them?

@Dain

So what is your recommendation (not in a strict legal sense of course) can be fixed concerning GDPR by offering the necessary access (links) to the related pages (mostly preferences) to subscribers and where to tell them to contact the administrator to achieve what they want (regarding the above problem of complicated history files with IPs in it)?

My understanding is that what you described, in combination with consistent use of double opt-in and adequate server security, covers the bases as far as GDPR compliance is concerned.