element-hq / element-hq/element-meta

GDPR tooling - User data export

Open
#809 3 comments 0 reactions 0 assignees View on GitHub
T-Enhancement X-Needs-Product Z-Compliance-GDPR-access Z-Compliance-PersonalData
Dominant language
No language data
Stars
112
Forks
25
Avg merge
6h 6m
Merged PRs (30d)
4

Description

### Your use case

### What would you like to do?
Enable users to automatically request and download their personal data to fulfill Article 15 of the GDPR, Right of access by a data subject.

### Why would you like to do it?

The GDPR gives data subjects the right to request (Access Art. 15 GDPR) their personal data and for the right to data portability (Art. 20, GDPR) Currently this process is a manual one which can take several hours per request. As Matrix grows allowing data subjects and data controllers (our customers) to extract this data will need to become a priority. Especially as Matrix is expanding within Germany where the GDPR is strongly enforced.

Business case:
Customers will need to be able to export the data of one of their users.
Giving the option for users to get their data when they delete their account.
Element / Matrix need to be able to export data for compliance purposes.

### How would you like to achieve it?
What we require is a tool / button in Element which exports all the data of a user in a readable format. Preferably one that acts automatically

#### What we need the feature to do:

- Something that is readable (human / machine)
- Return Media - including audio (voice notes), Images, other media?
- currently all we pull is links. A downloadable folder of all media shared by user.
- Room memberships (Room ID; Room name; Power level; room description; join date/leave date)
- Is it possible to do historic memberships? As that information is stored in room events. Technically this is user data. That is stored on the server.
- Profile Picture + Historic ones.(Are these stored?)
- User name and all changes.
- 3pID
- IP data & User agent
- User activity - All messages sent.
- Any other ommited or future user data collected

### Urgency

This is not immediately urgent or on fire as we are able to do Subject access requsts using other tooling, but as the network grows and more users in especially Germany are using the matrix protocal, some means of enacting this right will become more urgent.

### Have you considered any alternatives?

We can continue with what we have.
Currently matrix-CLI is used for M.org. I am unsure what tools are used or available for EMS or PS customers.

### Additional context

**General considerations**

- If it is the user requesting woud encrypted room content remain encrypted? Or can that be returned in an unencrypted format. I found this issue which may link to this https://github.com/vector-im/element-web/issues/15281
- If it is the administrator of a homeserver requesting, would encrypted rooms return encrypted state events.

This request probably has similarities to exporting conversations. the https://github.com/matrix-org/matrix-react-sdk/pull/6081

### Are you willing to provide a PR?

No

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.