View Issue Details

This bug affects 1 person(s).
 8
IDProjectCategoryView StatusLast Update
19958Bug reportsUsability/user experiencepublic2025-02-19 15:22
Reportertassoman Assigned ToDenisChenu  
PrioritynoneSeverityminor 
Status feedbackResolutionopen 
Product Version6.6.x 
Summary19958: Public registration is not compliant to GDPR
Description

Hello there, when a survey is set with "public registration" = true, a web form asking for personal data is exposed at first, before privacy page is seen.
Although "sending an email" is itself a personal data usage purpose itself. E-Mail address is considered itself personal data by GDPR.

Themes must display privacy informative message and agreement before registration page, not behind, it's too late.

Steps To Reproduce

Steps to reproduce

Create a new survey
Put it in closed access list
Enable privacy text display
Enable public registration
Enable survey
Open survey in a private window
See: registration form

Expected result

Open survey in a private window
See: privacy policy text agreement
Submit: agreement
See: public registration form
Submit: form

Actual result

Registration form is submitted without any privacy agreement display.

Tagsdata protection, email, GDPR, participants, privacy, public registration, theme, ux
Bug heat8
Complete LimeSurvey version number (& build)6.10.x
I will donate to the project if issue is resolvedNo
BrowserAny
Database type & versionAny
Server OS (if known)Any
Webserver software & version (if known)Any
PHP Version8.2

Relationships

related to 19972 new Privacy agreement are done without server control and do not have date or anything else 

Users monitoring this issue

DenisChenu, tassoman

Activities

DenisChenu

DenisChenu

2025-02-12 08:16

developer   ~82006

Last edited: 2025-02-12 08:18

My opinion : Must show privacy policy in registering process (option to no to have semver API compatible system)

PS : i think we can have

Open survey in a private window
See: privacy policy text agreement and public registration form
can not submit form without policy agreement checked (javascript, user control) , and if policy agreement is not checked (PHP control, server control) : don't save token

tassoman

tassoman

2025-02-12 16:29

reporter   ~82014

Hello @DenisChenu thanks for your comment. In italy, public sector is "automagically" allowed to deal with personal data, just by providing informative context before data handling.
In public sector scenario, obtaining explicit consent is not mandatory when data is not published or disclosed to 3rd parties and other situations.
I agree with you that a server side validation is safer. Simply, maybe can be configured not a mandatory check by advanced customization?
I guess Italian Public Sector have same allowance of other EU countries so this feature could be useful to any public sector organization inside EU, using LS.

tassoman

tassoman

2025-02-17 14:22

reporter   ~82038

I'm working on a custom theme based on Vanilla core theme. I was able to display privacy logic by adding an inclusion command inside ./views/subviews/registration/register_form.twig

{% include('./subviews/privacy/privacy.twig') %}

It's only a display, no validation logic is included.

DenisChenu

DenisChenu

2025-02-19 14:57

developer   ~82085

It's only a display, no validation logic is included.

It's the case too with Survey : same issue : no server validation.

DenisChenu

DenisChenu

2025-02-19 14:57

developer   ~82086

It's the case too with Survey : same issue : no server validation.

I report this issue

DenisChenu

DenisChenu

2025-02-19 14:58

developer   ~82087

@tibor.pacalat : adding this line fix the issue, but need an option ? Theme option at on or off by default ?

Issue History

Date Modified Username Field Change
2025-02-11 18:23 tassoman New Issue
2025-02-11 18:25 tassoman Tag Attached: GDPR
2025-02-11 18:25 tassoman Tag Attached: data protection
2025-02-11 18:26 tassoman Tag Attached: email
2025-02-11 18:26 tassoman Tag Attached: participants
2025-02-11 18:26 tassoman Tag Attached: privacy
2025-02-11 18:27 tassoman Tag Attached: theme
2025-02-11 18:27 tassoman Tag Attached: ux
2025-02-11 18:28 tassoman Tag Attached: public registration
2025-02-11 18:28 tassoman Issue Monitored: tassoman
2025-02-11 18:28 tassoman Bug heat 0 => 2
2025-02-12 08:16 DenisChenu Note Added: 82006
2025-02-12 08:16 DenisChenu Bug heat 2 => 4
2025-02-12 08:16 DenisChenu Issue Monitored: DenisChenu
2025-02-12 08:16 DenisChenu Bug heat 4 => 6
2025-02-12 08:18 DenisChenu Note Edited: 82006
2025-02-12 11:38 tibor.pacalat Assigned To => DenisChenu
2025-02-12 11:38 tibor.pacalat Status new => assigned
2025-02-12 16:29 tassoman Note Added: 82014
2025-02-12 16:29 tassoman Bug heat 6 => 8
2025-02-17 14:22 tassoman Note Added: 82038
2025-02-19 14:57 DenisChenu Note Added: 82085
2025-02-19 14:57 DenisChenu Note Added: 82086
2025-02-19 14:58 DenisChenu Status assigned => feedback
2025-02-19 14:58 DenisChenu Note Added: 82087
2025-02-19 15:22 DenisChenu Relationship added related to 19972