{"action":"created","issue":{"url":"https://api.github.com/repos/alextselegidis/easyappointments/issues/535","repository_url":"https://api.github.com/repos/alextselegidis/easyappointments","labels_url":"https://api.github.com/repos/alextselegidis/easyappointments/issues/535/labels{/name}","comments_url":"https://api.github.com/repos/alextselegidis/easyappointments/issues/535/comments","events_url":"https://api.github.com/repos/alextselegidis/easyappointments/issues/535/events","html_url":"https://github.com/alextselegidis/easyappointments/issues/535","id":348096564,"node_id":"MDU6SXNzdWUzNDgwOTY1NjQ=","number":535,"title":"Implementation of additional GDPR features in Easy!Appointments.","user":{"login":"chrisbols","id":42155798,"node_id":"MDQ6VXNlcjQyMTU1Nzk4","avatar_url":"https://avatars0.githubusercontent.com/u/42155798?v=4","gravatar_id":"","url":"https://api.github.com/users/chrisbols","html_url":"https://github.com/chrisbols","followers_url":"https://api.github.com/users/chrisbols/followers","following_url":"https://api.github.com/users/chrisbols/following{/other_user}","gists_url":"https://api.github.com/users/chrisbols/gists{/gist_id}","starred_url":"https://api.github.com/users/chrisbols/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrisbols/subscriptions","organizations_url":"https://api.github.com/users/chrisbols/orgs","repos_url":"https://api.github.com/users/chrisbols/repos","events_url":"https://api.github.com/users/chrisbols/events{/privacy}","received_events_url":"https://api.github.com/users/chrisbols/received_events","type":"User","site_admin":false},"labels":[{"id":151742295,"node_id":"MDU6TGFiZWwxNTE3NDIyOTU=","url":"https://api.github.com/repos/alextselegidis/easyappointments/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"alextselegidis","id":4527441,"node_id":"MDQ6VXNlcjQ1Mjc0NDE=","avatar_url":"https://avatars3.githubusercontent.com/u/4527441?v=4","gravatar_id":"","url":"https://api.github.com/users/alextselegidis","html_url":"https://github.com/alextselegidis","followers_url":"https://api.github.com/users/alextselegidis/followers","following_url":"https://api.github.com/users/alextselegidis/following{/other_user}","gists_url":"https://api.github.com/users/alextselegidis/gists{/gist_id}","starred_url":"https://api.github.com/users/alextselegidis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alextselegidis/subscriptions","organizations_url":"https://api.github.com/users/alextselegidis/orgs","repos_url":"https://api.github.com/users/alextselegidis/repos","events_url":"https://api.github.com/users/alextselegidis/events{/privacy}","received_events_url":"https://api.github.com/users/alextselegidis/received_events","type":"User","site_admin":false},"assignees":[{"login":"alextselegidis","id":4527441,"node_id":"MDQ6VXNlcjQ1Mjc0NDE=","avatar_url":"https://avatars3.githubusercontent.com/u/4527441?v=4","gravatar_id":"","url":"https://api.github.com/users/alextselegidis","html_url":"https://github.com/alextselegidis","followers_url":"https://api.github.com/users/alextselegidis/followers","following_url":"https://api.github.com/users/alextselegidis/following{/other_user}","gists_url":"https://api.github.com/users/alextselegidis/gists{/gist_id}","starred_url":"https://api.github.com/users/alextselegidis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alextselegidis/subscriptions","organizations_url":"https://api.github.com/users/alextselegidis/orgs","repos_url":"https://api.github.com/users/alextselegidis/repos","events_url":"https://api.github.com/users/alextselegidis/events{/privacy}","received_events_url":"https://api.github.com/users/alextselegidis/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2018-08-06T22:00:06Z","updated_at":"2019-07-22T18:08:26Z","closed_at":null,"author_association":"NONE","body":"Hi there,\r\n\r\nFurther studies of GDPR requirements revealed that there are still some 'must haves' that EA! seems not to comply with the way it could, at least at the moment:\r\n\r\n1) Deletion of a customer does not remove his/her name, surname and e-mail address from the database - it is recommended that customer's ID should be used instead of name, surname and e-mail in a consents' table\r\n2) Admin's password should be changed between every 14 to 30 days :-/ depends on a risk - worth reminding about it or making it a requirement\r\n3) Customer without any appointment should be able to remove his personal info or change it in EA! database in any time as easily as e.g. giving his consent for processing personal data; maybe link in an e-mail confirming the appointment that refers to the personal info as it is now, but working even after the appointment or after cancellation of an appointment would help\r\n4) Collection of unnecessary data i.e. in most cases collection of an address of a customer must be very well justified in case of inspection; e.g. address fields as an option turned on by administrator if needed would do the trick\r\n5) Automatic personal data erasement after 'X' days due to necessity to inform the customer for how long personal data will be kept\r\n\r\nThere is also advice on good pratice to encrypt the database content in case it was stolen to sleep well and avoid reporting youself to inspector.\r\n\r\nLack of conformity with GDPR poses a great risk of financial consequences from GDPR inspector in case sb reports us using EA!.\r\n\r\nMinor issues:\r\n- Cookie info on solid background without transparency could be better solution as does not display well on some devices due to text on text (transparent background ommitted)\r\n- Translation of some parts does not work, e.g. 'delete' button when removing personal data by customer (on confirmation) - always in English.\r\n\r\nI consider EA! as a very good product, but from what I've found present GDPR requirements made it risky to use.\r\n\r\nRegards,\r\nChris"},"comment":{"url":"https://api.github.com/repos/alextselegidis/easyappointments/issues/comments/513893106","html_url":"https://github.com/alextselegidis/easyappointments/issues/535#issuecomment-513893106","issue_url":"https://api.github.com/repos/alextselegidis/easyappointments/issues/535","id":513893106,"node_id":"MDEyOklzc3VlQ29tbWVudDUxMzg5MzEwNg==","user":{"login":"skylarmt","id":6668965,"node_id":"MDQ6VXNlcjY2Njg5NjU=","avatar_url":"https://avatars2.githubusercontent.com/u/6668965?v=4","gravatar_id":"","url":"https://api.github.com/users/skylarmt","html_url":"https://github.com/skylarmt","followers_url":"https://api.github.com/users/skylarmt/followers","following_url":"https://api.github.com/users/skylarmt/following{/other_user}","gists_url":"https://api.github.com/users/skylarmt/gists{/gist_id}","starred_url":"https://api.github.com/users/skylarmt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skylarmt/subscriptions","organizations_url":"https://api.github.com/users/skylarmt/orgs","repos_url":"https://api.github.com/users/skylarmt/repos","events_url":"https://api.github.com/users/skylarmt/events{/privacy}","received_events_url":"https://api.github.com/users/skylarmt/received_events","type":"User","site_admin":false},"created_at":"2019-07-22T18:08:26Z","updated_at":"2019-07-22T18:08:26Z","author_association":"NONE","body":">Admin's password should be changed between every 14 to 30 days\r\n\r\nWhy?  Requiring password changes tends to decrease security.  Use a long, high-entropy, random password and store it in a password manager like you should already be doing.  A change that would actually increase security by a large amount is adding TOTP (six-digit pin generated by an offline app) and/or WebAuthn two-factor support.\r\n\r\nhttps://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes  \r\nhttps://www.wired.com/2016/03/want-safer-passwords-dont-change-often/"}}
{"actor":{"display_login":"skylarmt"}}