Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-59718

Create a process to send a request to the site data protection officer

XMLWordPrintable

    • MOODLE_34_STABLE
    • Hide
      Prerequisites
      1. Outgoing email server. Alternatively, you can use Mailcatcher:
        1. Open your terminal
        2. Install Mailcatcher: gem install mailcatcher
        3. Run mailcatcher: mailcatcher
        4. Open your browser and go to http://localhost:1080
        5. Edit your moodle instance's config.php and add the following line: 

          $CFG->smtphosts = 'localhost:1025';

      Update/Install
      1. Update your Moodle source code to the latest branch that contains this patch.
      2. Do an upgrade process.
        • Confirm that the upgrade process completes successfully.
      3. Uninstall your Moodle instance and do a fresh install.
        • Confirm that the install process completes successfully.
      Data Protection Officer (DPO) role creation
      1. Login as an admin
      2. Go to "Site administration / Users / Define roles"
      3. Create a Data Protection Officer role with the following settings:
        Short name dpo
        Custom full name Data Protection Officer
        Role archetype None
        Context types where this role may be assigned System
        Capability "moodle/site:configview" (Allow)
        Capability "tool/dataprivacy:managedatarequests" (Allow)
      4. Save changes.
        • Confirm that the role is successfully created.
      5. Go to "Site administration / Users / Permissions / Assign system roles"
      6. Assign at least one user to the DPO role.
      7. Save the changes.
      System settings
      1. Go to "Site administration"
      2. Scroll down to the bottom of the "Site administration" tab
        • Confirm that you see a "Data privacy" category
      3. Click "Data privacy settings"
        • Confirm that the "Contact Data Protection Office" setting is ticked by default.
      4. Check the "Data Protection Officer role mapping" setting.
        • Confirm that it only contains the Data Protection Officer role that you created earlier.
      5. Select the "Data Protection Officer" role for the "Data Protection Officer role mapping".
      6. Save changes.
      Contacting a Data Protection Officer (DPO)
      1. Login as a user
      2. Go to your profile page.
        • Confirm that there is a "Privacy" section on your profile page.
        • Confirm that you see the following links:
          • Contact Data Protection Officer
          • Data requests
      3. Click on the "Contact Data Protection Officer" link.
        • Confirm that a dialogue comes up that contains:
          • The "Reply to" field containing your email address.
          • A message text area where you can enter your message for the DPO.
      4. Without entering anything into the Message field, click "Send"
        • Confirm that you get an error message indicating that the field is required.
      5. Enter some message and click "Send"
        • Confirm that the dialogue is closed.
      6. Go to the Mailcatcher browser window.
        • Confirm that you see an email to the DPO about the message that you sent.
      7. Login as the user that you assigned as the site DPO.
      8. Check your notification.
        • Confirm that you get a "General inquiry" notification about the user's message through Moodle.
      9. Click on the notification.
        • Confirm that you are redirected to the "Data requests" page.
      10. Check the contents of the "Data requests" page.
        • Confirm that you see an entry referring to the message that the user sent you.
      11. Click on the "Actions" menu of the message.
      12. Click "View the request"
        • Confirm that you see a modal showing the user's name, email, the message date, the status and the message itself.
      Data request: Export
      1. Login as a user
      2. Go to your profile page.
      3. Click on "Data requests"
      4. Click on "New request"
        • Confirm that you are redirected to the "Contact Data Protection Officer" form.
      5. Select "Export all of my personal data" for the Type field
      6. Enter a message (optional)
      7. Click "Save changes"
        • Confirm that you are redirected back to the "Data requests" page.
        • Confirm that you get a notification that your request has been submitted to the site's DPO.
        • Confirm that you see your request on the data requests table and that it's status is currently "Pending"
      8. Click again on the "New request" button and try to create another data export request.
      9. Save the changes.
        • Confirm that you get an error that you already have an ongoing request.
      10. Go back to the data requests page.
      11. Click on the "Actions" menu of your data export request.
      12. Click "Cancel request"
        • Confirm that you see a confirmation dialogue about the cancellation of your request.
      13. Confirm the request cancellation.
        • Confirm that your request's status is now shown as "Cancelled"
      14. Repeat the above steps to create another data export request but don't cancel it this time.
      15. Open a terminal.
      16. Go to the root directory of your moodle instance.
      17. Execute CRON 

        php admin/cli/cron.php

        • Confirm that the CRON script completes successfully and that you don't encounter any errors.
      18. Go to the Mailcatcher browser window.
        • Confirm that you see two more emails to the DPO about the data requests that the user sent.
      19. Login as the DPO.
      20. Check your notifications.
        • Confirm that you get two notifications about the user's export data requests.
      21. Click on one of the notifications.
        • Confirm that you are redirected to the "Data requests" page.*
      22. Check the contents of the "Data requests" page.
        • Confirm that you see two entries referring to the data export requests that the user sent you.
        • Confirm that the cancelled request is shown with the status "Cancelled".
        • Confirm that the other request is shown with the status "Awaiting approval".
      23. Click on the "Actions" menu of the cancelled request.
        • Confirm that you only see "View the request"
      24. Click "View the request"
        • Confirm that you see a modal showing the user's name, email, the message date, the status and the message itself.
        • Confirm that you only see the "Cancel" button that closes the dialogue when clicked.
      25. Click on the "Actions" menu of the request that is awaiting approval.
        • Confirm that you see the options "View the request", "Approve request", and "Deny request".
      26. Click "View the request"
        • Confirm that you see a modal showing the user's name, email, the message date, the status and the message itself.
        • Confirm that you also see the "Review data", "Approve" and "Deny" buttons in the dialogue.
      27. Click "Approve".
        • Confirm that you see a confirmation dialogue regarding the approval.
      28. Confirm the approval.
      29. Confirm that the request's status is now shown as "Approved"
      30. Back to your terminal, run CRON again.
        • Confirm that the CRON runs successfully.
      31. Go to the Mailcatcher browser window.
        • Confirm that you see an email to the requesting user that tells them that their data is now ready for download.
      32. Login as the user who made the data export request.
      33. Confirm that you get a notification that tells you that your data is now ready for download.
      34. Click on the notification to go to the data requests page.
      35. On the Data requests page, check your data request.
        • Confirm that its status is now set to "Completed"
      36. Open the actions menu of the request.
        • Confirm that you see a "Download" action link. (Clicking on the link though will do nothing at this time)
      37. Repeat the data export request creation. This time though, as DPO, deny the request.
        • Confirm that the status of the request becomes "Rejected"
      Data request: Deletion
      1. Login as a user
      2. Go to your profile page.
      3. Click on "Data requests"
      4. Click on "New request"
        • Confirm that you are redirected to the "Contact Data Protection Officer" form.
      5. Select "Delete all of my personal data" for the Type field
      6. Enter a message (optional)
      7. Click "Save changes"
        • Confirm that you are redirected back to the "Data requests" page.
        • Confirm that you get a notification that your request has been submitted to the site's DPO.
        • Confirm that you see your request on the data requests table and that it's status is currently "Pending"
      8. Click again on the "New request" button and try to create another data deletion request.
      9. Save the changes.
        • Confirm that you get an error that you already have an ongoing request.
      10. Open a terminal.
      11. Go to the root directory of your moodle instance.
      12. Execute CRON 

        php admin/cli/cron.php

        • Confirm that the CRON script completes successfully and that you don't encounter any errors.
      13. Go to the Mailcatcher browser window.
        • Confirm that you an email to the DPO about the data deletion request that the user sent.
      14. Login as the DPO.
      15. Check your notifications.
        • Confirm that you get a notification about the user's data deletion request.
      16. Click on one of the notifications.
        • Confirm that you are redirected to the "Data requests" page.*
      17. Check the contents of the "Data requests" page.
        • Confirm that you see the entry referring to the data deletion request that the user sent you.
        • Confirm that the data deletion request is shown with the status "Awaiting approval".
      18. Click on the "Actions" menu of the request that is awaiting approval.
        • Confirm that you see the options "View the request", "Approve request", and "Deny request".
      19. Click "View the request"
        • Confirm that you see a modal showing the user's name, email, the message date, the status and the message itself.
        • Confirm that you also see the "Review data", "Approve" and "Deny" buttons in the dialogue.
      20. Click "Approve".
        • Confirm that you see a confirmation dialogue regarding the approval.
      21. Confirm the approval.
      22. Confirm that the request's status is now shown as "Approved"
      23. Back to your terminal, run CRON again.
        • Confirm that the CRON runs successfully.
      24. Go to the Mailcatcher browser window.
        • Confirm that you see an email to the requesting user that tells them that their data has now been deleted and they would no longer be able to log into the site. (At this point, the actual deletion functionality hasn't been implemented yet, so the user would still be able to log in. Don't mind this.)
      Creating data requests for other users.
      1. As a DPO, confirm that when you click on "New request" you will be able to create data requests on behalf of other users.
      2. Login as an admin.
      3. Create a Parent role, but also give it the "tool/dataprivacy:makedatarequestsforchildren" capability.
      4. Assign a user p1 as a parent of a student s1.
      5. Login as p1 and go to the Data requests page.
      6. Click "New request"
        • Confirm that you can create a data request for s1.
      Show
      Prerequisites Outgoing email server. Alternatively, you can use Mailcatcher: Open your terminal Install Mailcatcher: gem install mailcatcher Run mailcatcher: mailcatcher Open your browser and go to http://localhost:1080 Edit your moodle instance's config.php and add the following line: $CFG->smtphosts = 'localhost:1025'; Update/Install Update your Moodle source code to the latest branch that contains this patch. Do an upgrade process. Confirm that the upgrade process completes successfully. Uninstall your Moodle instance and do a fresh install. Confirm that the install process completes successfully. Data Protection Officer (DPO) role creation Login as an admin Go to " Site administration / Users / Define roles " Create a Data Protection Officer role with the following settings: Short name dpo Custom full name Data Protection Officer Role archetype None Context types where this role may be assigned System Capability "moodle/site:configview" (Allow) Capability "tool/dataprivacy:managedatarequests" (Allow) Save changes. Confirm that the role is successfully created. Go to " Site administration / Users / Permissions / Assign system roles " Assign at least one user to the DPO role. Save the changes. System settings Go to " Site administration " Scroll down to the bottom of the " Site administration " tab Confirm that you see a "Data privacy" category Click "Data privacy settings" Confirm that the " Contact Data Protection Office " setting is ticked by default. Check the " Data Protection Officer role mapping " setting. Confirm that it only contains the Data Protection Officer role that you created earlier. Select the " Data Protection Officer " role for the " Data Protection Officer role mapping ". Save changes. Contacting a Data Protection Officer (DPO) Login as a user Go to your profile page. Confirm that there is a " Privacy " section on your profile page. Confirm that you see the following links: Contact Data Protection Officer Data requests Click on the " Contact Data Protection Officer " link. Confirm that a dialogue comes up that contains: The " Reply to " field containing your email address. A message text area where you can enter your message for the DPO. Without entering anything into the Message field, click " Send " Confirm that you get an error message indicating that the field is required. Enter some message and click " Send " Confirm that the dialogue is closed. Go to the Mailcatcher browser window. Confirm that you see an email to the DPO about the message that you sent. Login as the user that you assigned as the site DPO. Check your notification. Confirm that you get a "General inquiry" notification about the user's message through Moodle. Click on the notification. Confirm that you are redirected to the " Data requests " page. Check the contents of the " Data requests " page. Confirm that you see an entry referring to the message that the user sent you. Click on the " Actions " menu of the message. Click " View the request " Confirm that you see a modal showing the user's name, email, the message date, the status and the message itself. Data request: Export Login as a user Go to your profile page. Click on " Data requests " Click on " New request " Confirm that you are redirected to the " Contact Data Protection Officer " form. Select " Export all of my personal data " for the Type field Enter a message (optional) Click " Save changes " Confirm that you are redirected back to the " Data requests " page. Confirm that you get a notification that your request has been submitted to the site's DPO. Confirm that you see your request on the data requests table and that it's status is currently " Pending " Click again on the " New request " button and try to create another data export request. Save the changes. Confirm that you get an error that you already have an ongoing request. Go back to the data requests page. Click on the " Actions " menu of your data export request. Click " Cancel request " Confirm that you see a confirmation dialogue about the cancellation of your request. Confirm the request cancellation. Confirm that your request's status is now shown as "Cancelled" Repeat the above steps to create another data export request but don't cancel it this time. Open a terminal. Go to the root directory of your moodle instance. Execute CRON php admin/cli/cron.php Confirm that the CRON script completes successfully and that you don't encounter any errors. Go to the Mailcatcher browser window. Confirm that you see two more emails to the DPO about the data requests that the user sent. Login as the DPO. Check your notifications. Confirm that you get two notifications about the user's export data requests. Click on one of the notifications. Confirm that you are redirected to the " Data requests " page.* Check the contents of the " Data requests " page. Confirm that you see two entries referring to the data export requests that the user sent you. Confirm that the cancelled request is shown with the status "Cancelled". Confirm that the other request is shown with the status "Awaiting approval". Click on the " Actions " menu of the cancelled request. Confirm that you only see " View the request " Click " View the request " Confirm that you see a modal showing the user's name, email, the message date, the status and the message itself. Confirm that you only see the " Cancel " button that closes the dialogue when clicked. Click on the " Actions " menu of the request that is awaiting approval. Confirm that you see the options " View the request ", " Approve request ", and " Deny request ". Click " View the request " Confirm that you see a modal showing the user's name, email, the message date, the status and the message itself. Confirm that you also see the " Review data ", " Approve " and " Deny " buttons in the dialogue. Click " Approve ". Confirm that you see a confirmation dialogue regarding the approval. Confirm the approval. Confirm that the request's status is now shown as " Approved " Back to your terminal, run CRON again. Confirm that the CRON runs successfully. Go to the Mailcatcher browser window. Confirm that you see an email to the requesting user that tells them that their data is now ready for download. Login as the user who made the data export request. Confirm that you get a notification that tells you that your data is now ready for download. Click on the notification to go to the data requests page. On the Data requests page, check your data request. Confirm that its status is now set to "Completed" Open the actions menu of the request. Confirm that you see a " Download " action link. ( Clicking on the link though will do nothing at this time ) Repeat the data export request creation. This time though, as DPO, deny the request. Confirm that the status of the request becomes " Rejected " Data request: Deletion Login as a user Go to your profile page. Click on " Data requests " Click on " New request " Confirm that you are redirected to the " Contact Data Protection Officer " form. Select " Delete all of my personal data " for the Type field Enter a message (optional) Click " Save changes " Confirm that you are redirected back to the " Data requests " page. Confirm that you get a notification that your request has been submitted to the site's DPO. Confirm that you see your request on the data requests table and that it's status is currently " Pending " Click again on the " New request " button and try to create another data deletion request. Save the changes. Confirm that you get an error that you already have an ongoing request. Open a terminal. Go to the root directory of your moodle instance. Execute CRON php admin/cli/cron.php Confirm that the CRON script completes successfully and that you don't encounter any errors. Go to the Mailcatcher browser window. Confirm that you an email to the DPO about the data deletion request that the user sent. Login as the DPO. Check your notifications. Confirm that you get a notification about the user's data deletion request. Click on one of the notifications. Confirm that you are redirected to the " Data requests " page.* Check the contents of the " Data requests " page. Confirm that you see the entry referring to the data deletion request that the user sent you. Confirm that the data deletion request is shown with the status "Awaiting approval". Click on the " Actions " menu of the request that is awaiting approval. Confirm that you see the options " View the request ", " Approve request ", and " Deny request ". Click " View the request " Confirm that you see a modal showing the user's name, email, the message date, the status and the message itself. Confirm that you also see the " Review data ", " Approve " and " Deny " buttons in the dialogue. Click " Approve ". Confirm that you see a confirmation dialogue regarding the approval. Confirm the approval. Confirm that the request's status is now shown as " Approved " Back to your terminal, run CRON again. Confirm that the CRON runs successfully. Go to the Mailcatcher browser window. Confirm that you see an email to the requesting user that tells them that their data has now been deleted and they would no longer be able to log into the site. ( At this point, the actual deletion functionality hasn't been implemented yet, so the user would still be able to log in. Don't mind this. ) Creating data requests for other users. As a DPO, confirm that when you click on " New request " you will be able to create data requests on behalf of other users. Login as an admin. Create a Parent role , but also give it the " tool/dataprivacy:makedatarequestsforchildren " capability. Assign a user p1 as a parent of a student s1. Login as p1 and go to the Data requests page. Click " New request " Confirm that you can create a data request for s1.

      Create a simple form to send a request to the site data protection officer.

      By creating the form in Moodle, we can verify the identity of the user making the request.

      The record of the request should be stored in Moodle and an email sent directly to the data protection officer.

      We can then describe the process of contacting the data protection officer on the privacy policy page.

      User Stories Acceptance Criteria
      As a Moodle administrator I want moodle to provide a form for contacting the data protection officer for my moodle site.
      • There is a site admin setting "contactdataprotectionofficerthroughmoodle"
      • If enabled, users will be provided links from the site privacy policy, as well as from their own profile page to contact the sites data protection officer.
      • The link will go to a new form with simple instructions and a text box for providing more details.
      • When submitted - a record of the request will be stored and an email will be sent to the data protection officer.
      • The language of these automated links will respect the users current language.
      As a Moodle administrator with an alternate process for contacting my data protection officer, I do not want these requests to go through moodle.
      • I can disable the new setting and no automatic links will be shown in the privacy policy or in users profiles.
      • I can write manual instructions for contacting the data protection officer in my privacy policy.

            jpataleta Jun Pataleta
            damyon Damyon Wiese
            David Monllaó David Monllaó
            Votes:
            1 Vote for this issue
            Watchers:
            10 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.