Add notes for 2018-05-16

content/posts/2018-05.md

@@ -250,3 +250,12 @@ $ curl -X POST -H 'Content-type:application/json' --data-binary '{"add-field": {
 - Apparently the default search field is the `df` parameter and you could technically just add it to the query string, so no need to bother with that in the schema now
 - I copied over the DSpace `search_text` field type from the DSpace Solr config (had to remove some properties so Solr would start) but it doesn't seem to be any better at matching than the `text_en` type
 - I think I need to focus on trying to return scores with conciliator
+
+## 2018-05-16
+
+- Discuss GDPR with James Stapleton
+  - As far as I see it, we are "Data Controllers" on CGSpace because we store peoples' names, emails, and phone numbers if they register
+  - We set cookies on the user's computer, but these do not contain personally identifiable information (PII) and they are "session" cookies which are deleted when the user closes their browser
+  - We use Google Analytics to track website usage, which makes Google the "Data Processor" and in this case we merely need to *limit* or *obfuscate* the information we send to them
+  - As the only personally identifiable information we send is the user's IP address, I think we only need to enable [IP Address Anonymization](https://support.google.com/analytics/answer/2763052) in our `analytics.js` code snippets
+  - Then we can add a "Privacy" page to CGSpace that makes all of this clear