On May 25:th, roughly a month from the time of me writing this, the General Data Protection Regulation (GDPR)
will take effect. The GDPR is an European Union (EU) regulation on data protection and privacy for individuals within the EU.
This regulation affects all services that collect what is called "Personal Data". In this context, Personal Data means not only the obvious things (your name, email address, and various things advertisers like to track about you), but also some non-obvious things like your IP number, cookies used to maintain your login or things like device identifiers for your mobile devices (phones, tablets, etc), and things you do such as forum posts and posts to social media.
The official regulation document is 216 pages long. Take some time to let that sink in.
So.. Without expecting you all to read those 216 pages, what does that mean for FUMBBL?
Well, a couple of things:
1. FUMBBL will need explicit "Consent" from every member to "Process" their "Personal Data". This only really applies to people within the EU, but I (like more or less everyone else) have no reliable way to identify EU coaches so it will apply to everyone. Given that FUMBBL doesn't function without cookies, this will be a new completely blocking page that will appear before anything on the site shows up.
3. FUMBBL currently uses Google Analytics to keep tabs on how users access the site, and various things like which operating system and browser versions you use. In order to not have to look into how Google maintains IP numbers and how that relates to GDPR, I will very likely get rid of that connection. It's simply not important enough for me to spend the time and effort figuring it out. No real change for you all, but a loss of functionality on my end.
4. "Right of access". This is an article of the GDPR that gives citizens the "right to access their personal data and information about how this personal data is being processed". What this means is that FUMBBL has to be very clear about what is tracked about its users, and have a way for users to view this data. In practise, most of what is tracked is directly visible (your teams, your bios, your forum posts, blogs, etc), but I will need to add views of certain other information (session cookies and corresponding IP numbers).
5. "Right to erasure". This article states that FUMBBL has to provision for a way for members to have their personal information removed from the site. Drawn to the full extreme, this would be the equivalent of removing everything relating to the coach (cookies, IP numbers, email addresses, forum posts, blog entries, teams and bios, the user account itself and all matches having been played). Luckily, it's not quite that extreme in reality. the GDPR allows for data to be retained "for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes", assuming measures are taken to "respect for the principle of data minimisation", using something that's referred to as "pseudonymisation" for example. This follows more or less what the site allows for now where people can contact me personally to request to have their private information be removed from the site, but I need to be more clear about this process and what it involves in a more precise way.
There are of course mote to the 216 pages than I can reasonably fit in a blog entry, but the above are the (in my opinion) most important parts.
Oh the joys of regulations... :)