Managing GDPR implications of apps and privacy statements

As a europe based cloud provider or by providing service for european users, you have to obey the GDPR regulations, including a detailed privacy statement.

When setting up a nextcloud instance you will create a privacy statement taking into account all privacy implications and the planned usage. But what about the installation of new apps or updates to nextcloud itself? As they bring new features, they may imply necessary changes to the existing privacy statement, that might not have been considered before.

What I am proposing is to implement a privacy management / information standard for apps.
One element could be a standardised "privacy implications" form for apps, integrated in the app store completed and maintained by app developers. This standardised data collection should contain information like:

- Does this app harvest additional personal information? If yes, which and how is it collected?
- For what purposes is the information stored and used?
- How long is the information saved?
- Where is the information saved?
- Is the information shared with third parties? Which? For what purpose?
- How is the information protected (e.g. SSE, E2EE [optional or mandatory], pseudonymized, anonymized)?
- Is there a way for the user to delete this information, or request deletion?
- ... and all the other things required by the GDPR

## Basic usage
This information could be displayed in a user-friendly way in the apps menu, when clicking on an additional icon:


## Extended usage
If this system would exist, with the machine readable app privacy information in the database, even a sophisticated nextcloud-specific privacy statement generator, that takes all apps' privacy implications into account, could be developed and integrated.
Meaning that, on first install of the cloud itself or whenever you install an app, that expands the existing data collection / processing, the admin could get a privacy warning and a proposal to use a newly generated privacy statement.

## EDIT: Addendum for legal reference
Art. 13 (and possibly Art. 14) GDPR
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN