Propose new features
Designing Decidim together
GDPR Compliance - Automate deletion of inactive users' accounts
Is your feature request related to a problem? Please describe.
GDPR states that personal data should only be kept the shortest time possible. Currently, if a user doesn't use his account (e.g. 12 months of inactivity), his data are kept forever (unless the user connects to his account and deletes it).
Describe the solution you'd like
Some cities are asking us for a feature to automatically delete users' accounts that haven't been used in a certain period of time. First they would receive an email asking them to connect if they want to keep their account. If they don't connect in a certain period, the account is deleted.
There is a possibility to fund the development of the feature.
This proposal has been accepted because:
- Developed by Open Source Politics
- Available as module here: https://github.com/OpenSourcePolitics/decidim-module-cleaner
List of Endorsements
Report inappropriate content
Is this content inappropriate?
Comment details
You are seeing a single comment
View all comments
Security wise, verification should probably be lost after the desactivation, because if not, someone else could create an account using someone else's email (an edge case, for sure, but still interesting to consider).
In our internal early specs, we wanted the inactivity period to be customizable from the BO.
Open Source Politics clients could co-finance part of the development costs and develop it, but we're looking for fellow implementors or users to chip-in financially. Let me know if that could interest you!
Loading comments ...