Feature plugin proposal: Privacy Data Request Form

As part of the core-privacy team’s 2019 roadmap, the team has begun a discussion on the possibility of creating a front-end forms feature to handle Privacy Data Requests introduced in WordPress 4.9.6, most likely as a feature plugin.

We welcome all thoughts on this proposal, which you are welcome to leave as comments on this post, or share with us directly in the #core-privacy channel on Making WordPress SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/..

Introducing this feature pluginFeature Plugin A plugin that was created with the intention of eventually being proposed for inclusion in WordPress Core. See Features as Plugins. proposal

In 4.9.6, the ability for an administrator to initiate a data export or data erasure for a user by email address was added.

While this provided sites with the tools to be compliant with new laws and regulations, site owners are still left to find a way to accommodate those requests.

Adding a way for users to initiate this request on their own would prove a more “out of the box” experience and decrease the burden on site administrators to initiate these requests themselves.

Source: Core Privacy Team Roadmap

Creating a privacy front-end form mechanism –first as a feature plugin– presents an opportunity for the project to make a positive impact across privacy areas. It will empower administrators within the ecosystem to better comply with privacy-related requirements, while contributing to a better standard of protecting user privacy across the open web.

Integrated in the Privacy Policy page, this feature would help big websites administrators to automatize privacy requests management (exactly as in WordPress.org related page).

This feature would also help regulation organisms to directly verify the conformity of WordPress powered websites by creating privacy requests and checking the result directly.

Last but not least, using the feature in websites privacy policy pages would eventually made visitors more confident about the website owner as they could request their data by themselves.

Technical scope of the feature plugin

The feature plugin should at least handle the following scope:

  • PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 5.6.20 or higher functions to generate privacy data requests front-end forms
  • PHP filters to handle forms customizations like editing wording and choosing either to use data removal action, data export action, or both
  • Privacy Request WidgetWidget A WordPress Widget is a small block that performs a specific function. You can add these widgets in sidebars also known as widget-ready areas on your web page. WordPress widgets were originally created to provide a simple and easy-to-use way of giving design and structure control of the WordPress theme to the user.
  • Privacy Request ShortcodeShortcode A shortcode is a placeholder used within a WordPress post, page, or widget to insert a form or function generated by a plugin in a specific location on your site.
  • Privacy Request GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/ BlockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience.
  • PHP documentation for both functions and filters
  • CSSCSS Cascading Style Sheets. classes documentation

Introducing the existing base pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party

During previous meetings, the #core-privacy team discussed about an existing plugin reported by @garrett-eclipse and @xkon.

This existing plugin is already managing some parts of the feature:

  • PHP functions to generate front-end Privacy Requests Forms
  • PHP filters to handle forms customizations (like choosing either to show remove request, export request, or both)
  • Privacy Request Widget
  • Privacy Request Shortcode
  • Privacy Request Gutenberg Block

It has 5000+ active installs and the idea is to use this plugin to prepare and test a potential coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. merge of the Privacy Data Request Form feature in WordPress Core.

As the initial author of the plugin, I already made some changes:

  • The plugin’s SVN repository is open for core privacy team contributions (current contributors: @xkon and @audrasjb).
  • The plugin’s GitHub repository is open for contributions as well.
  • The plugin is not displaying anymore my employer’s logo.

What’s next?

Once the plugin is confirmed as a feature plugin, the next steps would be:

  • To increase the number of users of the feature plugin.
  • To change the display name of the plugin from “GDPR Data Request Form” to “Privacy Data Request Form” (though we must keep the actual slug, I guess we could edit the plugin Display Name).
    – Plugin Review team validation needed on that point.
  • To add other interested privacy team members and core developers as contributors of the plugin.
  • To keep an eye on the feature plugin’s support questions and ratings.
  • To iterate on the feature plugin development.
  • To audit some specific aspects of the feature plugin:
    • wording/copywriting
    • accessibilityAccessibility Accessibility (commonly shortened to a11y) refers to the design of products, devices, services, or environments for people with disabilities. The concept of accessible design ensures both “direct access” (i.e. unassisted) and “indirect access” meaning compatibility with a person’s assistive technology (for example, computer screen readers). (https://en.wikipedia.org/wiki/Accessibility)
    • design/theme compliance
    • security
    • coding-standards and documentation
  • To create a TracTrac An open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress. ticketticket Created for both bug reports and feature development on the bug tracker. to handle a potential future merge proposal – if the feature plugin deserves it.
    Note: I already created a GitHub repo and generated a core diff file to test the feature directly against WordPress trunktrunk A directory in Subversion containing the latest development code in preparation for the next major release cycle. If you are running "trunk", then you are on the latest revision. (though it doesn’t contains the Gutenberg block nor AJAX validation)