Recherche avancée

Sur d’autres sites (7583)

• Lawful basis for processing personal data under GDPR with Matomo

  30 avril 2018, par InnoCraft

  Disclaimer : this blog post has been written by digital analysts, not lawyers. The purpose of this article is to explain what is a lawful basis and which one you can use with Matomo in order to be GDPR compliant. This work comes from our interpretation of the following web page from the UK privacy commission : ICO. It cannot be considered as professional legal advice. So as GDPR, this information is subject to change. GDPR may be also known as DSGVO in German, BDAR in Lithuanian, RGPD in Spanish, French, Italian, Portuguese. This blog post contains public sector information licensed under the Open Government Licence v3.0.

  The golden rule under GDPR is that you need to have a lawful basis in order to process personal data. Note that it is possible to not process personal data with Matomo. When you do not collect any personal data, then you do not need to determine a lawful basis and this article wouldn’t apply to you.

  “If no lawful basis applies to your processing, your processing will be unlawful and in breach of the first principle.“

  Source : ICO, based on article 6 of GDPR.

  As you may process personal data in Matomo, you have to :

  1. define a lawful basis.
  2. document your choice.
  3. inform your visitor about it in a privacy notice.

  Even if you think you don’t process personal data, we recommend reading this post about personal data in Matomo (personal data may be hidden in many ways).

  Note that if you are processing special category data (ethnic origin, politics, religion, trade union membership…) or criminal offence data ; extra responsibilities are applied, and we will not detail them in this blog post.

  1 – Define a lawful basis

  There are 6 different lawful bases all defined within article 6 of the GDPR official text :

  1. Consent : the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
  2. Contract : processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  3. Legal obligation : processing is necessary for compliance with a legal obligation to which the controller is subject.
  4. Vital interests : processing is necessary in order to protect the vital interests of the data subject or of another natural person.
  5. Public task : processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller.
  6. Legitimate interests : processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party ; except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

  As you can see, most of them are not applicable to Matomo. As ICO is mentioning it within their documentation :

  “In many cases you are likely to have a choice between using legitimate interests or consent.”

  “Consent” or “Legitimate interests” : which lawful basis is the best when using Matomo ?

  Well, there is no right or wrong answer here.

  In order to make this choice, ICO listed on their website different questions you should keep in mind :

  • Who does the processing benefit ?
  • Would individuals expect this processing to take place ?
  • What is your relationship with the individual ?
  • Are you in a position of power over them ?
  • What is the impact of the processing on the individual ?
  • Are they vulnerable ?
  • Are some of the individuals concerns likely to object ?
  • Are you able to stop the processing at any time on request ?

  From our perspective, “Legitimate interests” should be used in most of the cases as :

  • The processing benefits to the owner of the website and not to a third party company.
  • A user expects to have their data kept by the website itself.
  • Matomo provides many features in order to show how personal data is processed and how users can exercise their rights.
  • As the data is not used for profiling, the impact of processing personal data is very low.

  But once more, it really depends ; if you are processing personal data which may represent a risk to the final user, then getting consent is for us the right lawful basis.

  If you are not sure, at the time of writing ICO is providing a tool in order to help you make this decision :

  

  Note that once you choose a lawful basis, it is highly recommended not to switch to another unless you have a good reason.

  What are the rights that a data subject can exercise ?

  According to the lawful basis you choose for processing personal data with Matomo, your users will be able to exercise different rights :

  	Right to be informed	Right of access	Right to erasure	Right to portability	Right to object	Right to withdraw consent
  Legitimate interests	X	X	X		X
  Consent	X	X	X	X		X

   

  • Right to be informed : whatever the lawful basis you choose, you need to inform your visitor about it within your privacy notice.
  • Right of access : as described in article 15 of GDPR. Your visitor has the right to access the personal data you are processing about them. You can exercise their right directly within the page “GDPR Tools” in your Matomo.
  • Right to erasure : it means that a visitor will be able to ask you to erase all their data. You can exercise the right to erasure directly within the page “GDPR Tools” in your Matomo.
  • Right to portability : it means that you need to export the data which concern the individual in a machine-readable format and provide them with their personal data. You can exercise their right directly within the page “GDPR Tools” in your Matomo.
  • Right to object : it means that your visitor has the right to say no to the processing of their personal data. In order to exercise this right, you need to implement the opt-out feature on your website.
  • Right to withdraw consent : it means that your visitor can remove their consent at any time. We developed a feature in order to do just that. You can learn more by opening the page “Privacy > Asking for consent” in your Matomo.

  2 – Document your choice

  Once you choose “Legitimate interests” or “Consent” lawful basis, you will have some obligations to fulfill. From our interpretation, “Legitimate interests” means writing more documentation, “Consent” means a more technical approach.

  What should I do if I am processing personal data with Matomo based on “Legitimate interests ?

  ICO is providing a checklist for “Legitimate interests”, below is our interpretation :

  • Check that legitimate interests is the most appropriate lawful basis.

  Our interpretation : document and justify why you choose this lawful basis in particular. This tool from ICO can help you.

  • Understand your responsibility to protect the individual’s interests.

  Our interpretation : you need to take all the measures in order to protect your users privacy and data security. Please refer to our guide in order to secure your Matomo installation.

  • Conduct a legitimate interests assessment (LIA) and keep a record of it to ensure that you can justify your decision. This document is composed of a set of questions on those 3 key concerns : 1) purpose, 2) necessity, 3) balancing.

  1) Purpose :

  • Why do you want to process the data – what are you trying to achieve ?
  • Who benefits from the processing ? In what way ?
  • Are there any wider public benefits to the processing ?
  • How important are those benefits ?
  • What would the impact be if you couldn’t go ahead ?
  • Would your use of the data be unethical or unlawful in any way ?

  2) Necessity :

  • Does this processing actually help to further that interest ?
  • Is it a reasonable way to go about it ?
  • Is there another less intrusive way to achieve the same result ?

  3) Balancing :

  • What is the nature of your relationship with the individual ?
  • Is any of the data particularly sensitive or private ?
  • Would people expect you to use their data in this way ?
  • Are you happy to explain it to them ?
  • Are some people likely to object or find it intrusive ?
  • What is the possible impact on the individual ?
  • How big an impact might it have on them ?
  • Are you processing children’s data ?
  • Are any of the individuals vulnerable in any other way ?
  • Can you adopt any safeguards to minimise the impact ?
  • Can you offer an opt-out ?

  • Identify the relevant legitimate interests.
  • Check that the processing is necessary and there is no less intrusive way to achieve the same result.
  • Perform a balancing test, and be confident that the individual’s interests do not override those legitimate interests.
  • Use individuals’ data in ways they would reasonably expect, unless you have a very good reason.

  Our interpretation : use those data to improve user experience for example.

  • Do not use people’s data in ways they would find intrusive or which could cause them harm, unless you have a very good reason.

  Our interpretation : ask yourself if this data is representing a risk for the individuals.

  • If you process children’s data, take extra care to make sure you protect their interests.
  • Consider safeguards to reduce the impact where possible.

  Our interpretation : Check if your web hosting provider is providing appropriate safeguards.

  • Consider whether you can offer an opt out.

  Our interpretation : Matomo is providing you the opt-out feature.

  • If your LIA identifies a significant privacy impact, consider whether you also need to conduct a DPIA.

  Our interpretation : A DPIA can easily be conducted by using this software from the French privacy commission.

  • Regularly review your LIA and update it when circumstances change.
  • Include information about your legitimate interests in your privacy information.

  As you see, going for “Legitimate interests” requires a lot of written documentation. Let’s see how “Consent” differ.

  What should I do if I am processing personal data with Matomo based on “Consent” ?

  As previously mentioned, using “Consent” rather than “Legitimate interests” is more technical but less intense in terms of documentation. Like for “Legitimate interests”, ICO is providing a checklist for “Consent” which is divided into 3 key categories : 1) asking for consent, 2) recording consent, and 3) managing consent.

  1. Asking for consent :
     1. Check that consent is the most appropriate lawful basis for processing.
     2. Make the request for consent prominent and separate from your terms and conditions.
     3. Ask people to positively opt in. Don’t use pre-ticked boxes or any other type of default consent.
     4. Use clear, plain language that is easy to understand.
     5. Specify why you want the data and what you are going to do with it.
     6. Give individual (‘granular’) options to consent separately to different purposes and types of processing.
     7. Name your organisation and any third party controllers who will be relying on the consent.
     8. Tell individuals they can withdraw their consent.
     9. Ensure that individuals can refuse to consent without detriment.
     10. Avoid making consent a precondition of a service.
     11. If you offer online services directly to children, only seek consent if you have age-verification measures (and parental-consent measures for younger children) in place.
  2. Recording consent :
     1. Keep a record of when and how you got consent from the individual.
     2. Keep a record of exactly what you told them at the time.
  3. Managing consent :
     1. Regularly review consents to check that the relationship, the processing and the purposes have not changed.
     2. Have processes in place to refresh consent at appropriate intervals, including any parental consent.
     3. Consider using privacy dashboards or other preference-management tools as a matter of good practice.
     4. Make it easy for individuals to withdraw their consent at any time, and publicise how to do so.
     5. Act on withdrawals of consent as soon as you can.
     6. Don’t penalise individuals who wish to withdraw consent.

     3 – Inform your visitor about it in a privacy notice

     Privacy notices are an important part within the GDPR process. Read our blog post dedicated to privacy notices to learn more.

     We really hope you enjoyed reading this blog post. Please have a look at our Matomo GDPR guide for more information.

  The post Lawful basis for processing personal data under GDPR with Matomo appeared first on Analytics Platform - Matomo.

• Revision 29159 : Tester une autre méthode pour que le multilinguisme fonctionne à la ...

  13 juin 2009, par marcimat@… — Log

  Tester une autre méthode pour que le multilinguisme fonctionne à la création de la mutualisation. Ca me parait plus portable.

• Running Windows XP In 2016

  2 janvier 2016, par Multimedia Mike

  I have an interest in getting a 32-bit Windows XP machine up and running. I have a really good yet slightly dated and discarded computer that seemed like a good candidate for dedicating to this task. So the question is : Can Windows XP still be installed from scratch on a computer, activated, and used in 2016 ? I wasn’t quite sure since I have heard stories about how Microsoft has formally ended support for Windows XP as of the first half of 2014 and I wasn’t entirely sure what that meant.

  Spoiler : It’s still possible to install and activate Windows XP as of the writing of this post. It’s also possible to download and install all the updates published up until support ended.

  The Candidate Computer
  This computer was assembled either in late 2008 or early 2009. It was a beast at the time.

  
  
  Click for a larger image
  

  It was built around the newly-released NVIDIA GTX 280 video card. The case is a Thermaltake DH-101, which is a home theater PC thing. The motherboard is an Asus P5N32-SLI Premium with a Core 2 Duo X6800 2.93 GHz CPU on board. 2 GB of RAM and a 1.5 TB hard drive are also present.

  The original owner handed it off to me because their family didn’t have much use for it anymore (too many other machines in the house). Plus it was really, obnoxiously loud. The noisy culprit was the stock blue fan that came packaged with the Intel processor (seen in the photo) whining at around 65 dB. I replaced the fan and brought the noise level way down.

  As for connectivity, the motherboard has dual gigabit NICs (of 2 different chipsets for some reason) and onboard wireless 802.11g. I couldn’t make the latter work and this project was taking place a significant distance from my wired network. Instead, I connected a USB 802.11ac dongle and antenna which is advertised to work in both Windows XP and Linux. It works great under Windows XP. Meanwhile, making the adapter work under Linux provided a retro-computing adventure in which I had to modify C code to make the driver work.

  So, score 1 for Windows XP over Linux here.

  The Simple Joy of Retro-computing
  One thing you have to watch out for when you get into retro-computing is fighting the urge to rant about the good old days of computing. Most long-time computer users have a good understanding of the frustration that computers keep getting faster by orders of magnitude and yet using them somehow feels slower and slower over successive software generations.
  

  This really hits home when you get old software running, especially on high-end hardware (relative to what was standard contemporary hardware). After I got this new Windows XP machine running, as usual, I was left wondering why software was so much faster a few generations ago.

  Of course, as mentioned, it helps when you get to run old software on hardware that would have been unthinkably high end at the software’s release. Apparently, the minimum WinXP specs as set by MS are a 233 MHz Pentium CPU and 64 MB of RAM, with 1.5 GB of hard drive space. This machine has more than 10x the clock speed (and 2 CPUs), 32x the RAM, and 1000x the HD space. Further, I’m pretty sure 100 Mbit ethernet was the standard consumer gear in 2001 while 802.11b wireless was gaining traction. The 802.11ac adapter makes networking quite pleasant.

  Purpose
  Retro-computing really seems to be ramping up in popularity lately. For some reason, I feel compelled to declare at this juncture that I was into it before it was cool.

  Why am I doing this ? I have a huge collection of old DOS/Windows computer games. I also have this nerdy obsession with documenting old video games in the MobyGames database. I used to do a lot of this a few years ago, tracking the effort on my gaming blog. In the intervening years, I have still collected a lot of old, unused, unloved video games, usually either free or very cheap while documenting my collection efforts on that same blog.

  So I want to work my way through some of this backlog, particularly the games that are not yet represented in the MobyGames database, and even more pressing, ones that the internet (viewed through Google at least) does not seem to know about. To that end, I thought this was a good excuse to get Windows XP on this old machine. A 32-bit Windows XP machine is capable of running any software advertised as supporting Windows XP, Windows ME, Windows 98, Windows 95, and even 16-bit Windows 3.x (I have games for all these systems). That covers a significant chunk of PC history. It can probably be made to run DOS games as well, but those are (usually) better run under DosBox. In order to get the right display feel, I even invested in a (used) monitor sporting a 4:3 aspect ratio. If I know these old games, most will be engineered and optimized for that ratio rather than the widescreen resolutions seen nowadays.

  I would also like to get back to that Xbox optical disc experimentation I was working on a few years ago. Another nice feature of this motherboard is that it still provides a 40-pin IDE/PATA adapter which makes the machine useful for continuing that old investigation (and explains why I have that long IDE cable to no where pictured hanging off the board).

  The Messy Details
  I did the entire installation process twice. The first time was a bumbling journey of discovery and copious note-taking. I still have Windows XP installation media that includes service pack 2 (SP2), along with 2 separate licenses that haven’t been activated for a long time. My plan was to install it fresh, then install the relevant drivers. Then I would investigate the Windows update and activation issues and everything should be fine.

  So what’s the deal with Windows Update for XP, and with activations ? Second item first : it IS possible to still activate Windows XP. The servers are still alive and respond quickly. However, as always, you don’t activate until you’re sure everything is working at some baseline. It took awhile to get there.

  As for whether Windows Update still works for XP, that’s a tougher question. Short answer is yes ; longer answer is that it can be difficult to kick off the update process. At least on SP2, the “Windows Update” program launches IE6 and navigates to a special microsoft.com URL which initiates the update process (starting with an ActiveX control). This URL no longer exists.

  From what I can piece together from my notes, this seems to be the route I eventually took :

  1. Install Windows XP fresh
  2. Install drivers for the hardware ; fortunately, Asus still has all the latest drivers necessary for the motherboard and its components but it’s necessary to download these from another network-connected PC since the networking probably won’t be running “out of the box”
  3. Download the .NET 3.5 runtime, which is the last one supported by Windows XP, and install it
  4. Download the latest NVIDIA drivers ; this needs to be done after the previous step because the installer requires the .NET runtime ; run the driver installer and don’t try to understand why it insists on re-downloading .NET 3.5 runtime before installation
  5. While you’re downloading stuff on other computers to be transported to this new machine, be sure to download either Chrome or Firefox per your preference ; if you try to download via IE6, you may find that their download pages aren’t compatible with IE6
  6. Somewhere along the line (I’m guessing as a side effect of the .NET 3.5 installation), the proper, non-IE6-based Windows Update program magically springs to life ; once this happens, there will be 144 updates (in my case anyway) ; installing these will probably require multiple reboots, but SP3 and all known pre-deprecation security fixes will be installed
  7. Expect that, even after installing all of these, a few more updates will appear ; eventually, you’ll be at the end of the update road
  8. Once you’re satisfied everything is working satisfactorily, take the plunge and activate your installation

  Residual Quirks
  Steam runs great on Windows XP, as do numerous games I have purchased through the service. So that opens up a whole bunch more games that I could play on this machine. Steam’s installer highlights a curious legacy problem of Windows XP– it seems there are many languages that it does not support “out of the box” :

  
  
  

  It looks like the Chinese options and a few others that are standard now weren’t standard 15 years ago.

  Also, a little while after booting up, I’ll get a crashing error concerning a process called geoforms.scr. This appears to be NVIDIA-related. However, I don’t notice anything obviously operationally wrong with the system.

  Regarding DirectX support, DirectX 9 is the highest version officially supported by Windows XP. There are allegedly methods to get DirectX 10 running as well, but I don’t care that much. I did care, briefly, when I realized that a bunch of the demos for the NVIDIA GTX 280 required DX10 which left me wondering why it was possible to install them on Windows XP.

  Eventually, by installing enough of these old games, I fully expect to have numerous versions of .NET, DirectX, QT, and Video for Windows installed side by side.

  Out of curiosity, I tried playing a YouTube HD/1080p video. I wanted to see if the video was accelerated through my card. The video played at full speed but I noticed some tearing. Then I inspected the CPU usage and noticed that the CPU was quite loaded. So either the GTX 280 doesn’t have video acceleration, or Windows XP doesn’t provide the right APIs, or Chrome is not able to access the APIs in Windows XP, or perhaps some combination of the foregoing.

  Games are working well, though. I tried one of my favorite casual games and got sucked into that for, like, an entire night because that’s what casual games do. But then, I booted up a copy of WarCraft III that I procured sometime ago. I don’t have any experience with the WarCraft universe (RTS or MMO) but I developed a keen interest in StarCraft II over the past few years and wanted to try WarCraft III. Unfortunately, I couldn’t get WarCraft III to work correctly on several different Windows 7 installations (movies didn’t play, which left me slightly confused as to what I was supposed to do).

  Still works beautifully on the new old Windows XP machine.

  The post Running Windows XP In 2016 first appeared on Breaking Eggs And Making Omelettes.