Page MenuHomeMiraheze

Create a DataDownload extension
Closed, DeclinedPublic

Description

We need to install DownloadYourData ASAP to be able to comply with gdpr.

We will need to fork it as it's wikia specific and is also running against mw 1.19.

https://github.com/Wikia/app/tree/dev/extensions/wikia/DownloadYourData

Event Timeline

Paladox triaged this task as High priority.May 22 2018, 16:07
Paladox created this task.
John renamed this task from Fork and install DownloadYourData to Create a DataDownload extension.May 22 2018, 16:16
John edited projects, added Extensions, Goal-2018-Jan-Jun; removed MediaWiki.
John subscribed.

It is literally impossible to even change that extension. A whole rewrite from scratch is needed.

https://github.com/miraheze/DownloadData is for anyone who wants to start working on this. :)

John lowered the priority of this task from High to Normal.May 22 2018, 18:23
MacFan4000 raised the priority of this task from Normal to Unbreak Now!.May 22 2018, 21:07

UBN as this needs to be done by Friday to comply with gdpr.

John lowered the priority of this task from Unbreak Now! to Normal.May 22 2018, 21:49

This has nothing to do with compliance.

If labster can provide me with a list of data we must give, I am willing to take this task.

It’s just things like name, username, email address, gender etc. In my opinion it just a simple easy display of special:preferences. Plus we don’t really even need this anyway.

John removed John as the assignee of this task.May 24 2018, 18:28

Though download your data that we have on the user, special preference may show some info but it dosen't let you download it in one easy go :)

Assinging to @labster to get his opinion per @Southparkfan comment.

IP address can be PII too, especially when tied to a user account. You'd have to get all IPs recorded for all edits from that user. And a list of all edits made by that user -- honestly not sure if we'd have to include the revision text or not.

Am I correct to say that piwik anonymizes IPs when storing them? So essentially, you don't get a full IP address stored there, so nothing could directly tie it back to a user?

piwiki was updated i think to be in compliance with the gdpr.

Yeh from the settings it shows that it hides parts of the ip out.

we have it set at 1byte(s)

https://matomo.org/docs/gdpr/

(updating piwik to 3.5.0 https://matomo.org/changelog/matomo-3-5-0/)

IP address can be PII too, especially when tied to a user account. You'd have to get all IPs recorded for all edits from that user. And a list of all edits made by that user -- honestly not sure if we'd have to include the revision text or not.

Am I correct to say that piwik anonymizes IPs when storing them? So essentially, you don't get a full IP address stored there, so nothing could directly tie it back to a user?

CheckUser data remains on the fleet for 90 days.

I could tie Matomo information back to a user in certain circumstances, because a user may be the very own person using an IP address in the 1.2.3.X space - and via CheckUser/access logs I can look for requests with a matching User-Agent.

The data is deleted after 90 days in Matomo (internal handling) as well as CheckUser (maintenance script) and access logs (logrotated).

John claimed this task.

On reviewing this, this is work for no reason. All it would be is a copy of Special:Preferences at this rate which is pointless because the info is there. MediaWiki (unlike most websites) works well by showing users easily personal information we store.

But it's not easily downloadable though?

Otherwise facebook could say the same thing.

But it's not easily downloadable though?

Otherwise facebook could say the same thing.

It's all on one page. Facebook stores a lot of data over a period of years you can't have on one page.