GDPR Plugin
Note: I am looking for betatesters for two really cool (I think so at least) Limesurvey integrations I wrote: A service to connect Limesurvey to Zapier, that will allow you to connect your Limesurvey responses and tokens to any platform Zapier supports (which is a lot) and a webapp that uses your Limesurvey surveys to create chatbots on Telegram and Facebook.
Interested? Contact me at beta[at]evently.nl!
As the GDPR law is going into effect this week, I think most of us users of Limesurvey are currently unclear on how to succesfully comply. I am going for the path of storing as little as possible while still staying as user friendly as possible.
My first step towards this is this plugin: It allows you toadd a link to your survey invites/reminders that users can click and shows them what is stored in their token, and allows for deletion of that token data. Hopefully with input from the community we can develop this plugin into a complete GDPR plugin. any bugs, security issues, enhancements are welcome!
What it currently does: After enabling it you should first edit its settings.
You have the following options:
Enable the plugin: self explanatory
Redact the token data when someone opts out: also redact token data when someone opts out
Show the tokendata: allows a user to see its token data prior to deleting it
Secret to hash the url: a phrase or key combination you should add that creates a unique hash per token, so only users can access their data. Once set, don’t change this: all links created earlier will no longer work if you do!
Next, you can edit the text on the pages the user sees: Headers for both, some explanatory text and an e-mail address people can contact regarding their privacy/GDPR. You can add your own e-mailadres or your privacy officer, whoever is in charge.
So how do you get the urls: it works similar to the {TOKENURL} shortcodes: you can add @@TOKENREMOVE@@ to your e-mail templates and the plugin will substitute this with a clickable link (or use@@@TOKENREMOVE@@@ to create just the url text).
Finally, when a user clicks on this link the following page will be shown:
and after clicking on Delete my data in the background the following tokendata will be set to redacted: firstname, lastname, email, attributes 1–25, emailstatus, and uses left will be set to 0.
What’s next:
There are many more ideas I have: allow for deletion of tokens instead of redacting, changing (some)token data, create delete links for tokenless responses, delete responses along with a token, and more.
But these are sometimes difficult to allow while stillkeeping data integrity, accountability and the law itself in mind: so hopefully we can look into this as a community and see how to go on.
Currently this plugin is working on v3, i have not yet tested it on version 2.5+, will do so as soon as possible!
See the code:
or download a zip:
Did this help you and you want to donate? That’s awesome, thanks! And yes you can:
Bitcoin: 3NwsmXjo1h1NHvR8DgyMqNhiFvSxLDvDFA
Eth: 0x885BDb1284982642E5aA4dF2ec37e33bf630D9De
