General Data Protection Rules GDPR

Hello

Anyone knows about this new rules ?

consentmanager.net Newsletter 02/2022

Hello ---------------,

We're excited to announce the latest update that has gone live! Among many new things, these are the most important features available with the new update:
Illegal #1: Google Fonts illegal?
At the end of January, the Munich Regional Court had to deal with the topic of Google Fonts (integrating fonts into a website). The court ruled that embedding Google Fonts via Google's server without consent was illegal and awarded the plaintiff damages. As you are used to from consentmanager, we reacted directly and in this month's update created the possibility to block Google Fonts and other external font and style elements (automatic blocking: Menu > CMPs > Edit > Other settings > Block stylesheets or manual blocking via code customization, see help).
Our recommendation: Activate blocking or, best of all, simply download the fonts and place them on your own server.
Illegal #2: Google Analytics illegal?
In addition to Google Fonts, Google Analytics was also recently "under fire": In Austria, the data protection authority decided in a case that Google Analytics was not compatible with the principles of the GDPR, since data is sent to the USA and there is no adequate level of protection. The website operator was therefore prohibited from using Google Analytics (especially since an insufficient consent banner was used in this case). A little later, the Dutch and French data protection authorities followed and also ruled that the (unprotected) integration of Google Analytics was not GDPR-compliant. It can be assumed that other data protection authorities of other countries will follow.
Our recommendation: Only use Google Analytics when consent is given or look for alternatives that are friendly to data protection (e.g. etracker or Matomo).
Illegal #3: IAB TCF illegal?
The Belgian data protection authority has also caused a stir. This had to decide on the IAB TCF standard. The authority found that under the current circumstances, the IAB Transparency and Consent Framework, as well as IAB Europe as the administrative body behind the standard, do not meet various conditions of the GDPR. The IAB has now been given a two-month period to develop an "Action Plan" with proposed changes. The proposed changes are intended to show how the TCF can be redesigned to be GDPR compliant. The IAB Europe has since appealed against the decision. We have collected more details in our FAQ (german).
Our recommendation: If you have nothing to do with online advertising (e.g. e-commerce or company websites), you should not use the IAB TCF standard. If you can't do without it, you shouldn't panic now, but wait and see how the situation develops.
Purposes & Slider
Also new this month is the possibility of rearranging and sorting purposes: Simply "drag" the entry and move it to where it should appear.

Hello.

I just notice when you make delete a customer can't sign in of course but when he try to apply the module forgot my password the dat abase not pop up the message sorry we re not in our data this email account, just said ( Thank you. If that email address is in our system, we will send password recovery instructions to that email address.) of course not send any email to the customer but the right it is (sorry we re not in our data this email account)

I'm attempting to integrate my GDPR customisations (I think they were from JSWeb's mod) into ZC v1.5.8. In /includes/modules/MY_TEMPLATE/create_account.php

I have, in ZC v1.5.7d, the additional code in red

 if ($error == true) {
    // hook notifier class
    $zco_notifier->notify('NOTIFY_FAILURE_DURING_CREATE_ACCOUNT');
  } elseif ($antiSpam != '') {
    $zco_notifier->notify('NOTIFY_SPAM_DETECTED_DURING_CREATE_ACCOUNT');
    $messageStack->add_session('header', (defined('ERROR_CREATE_ACCOUNT_SPAM_DETECTED') ? ERROR_CREATE_ACCOUNT_SPAM_DETECTED : 'Thank you, your account request has been submitted for review.'), 'success');
    zen_redirect(zen_href_link(FILENAME_SHOPPING_CART));
  } else {
    $sql_data_array = array(array('fieldName'=>'customers_firstname', 'value'=>$firstname, 'type'=>'stringIgnoreNull'),
                           array('fieldName'=>'customers_lastname', 'value'=>$lastname, 'type'=>'stringIgnoreNull'),
                           array('fieldName'=>'customers_email_address', 'value'=>$email_address, 'type'=>'stringIgnoreNull'),
                           array('fieldName'=>'customers_nick', 'value'=>$nick, 'type'=>'stringIgnoreNull'),
                           array('fieldName'=>'customers_telephone', 'value'=>$telephone, 'type'=>'stringIgnoreNull'),
                           array('fieldName'=>'customers_fax', 'value'=>$fax, 'type'=>'stringIgnoreNull'),
                           array('fieldName'=>'customers_newsletter', 'value'=>$newsletter, 'type'=>'integer'),
                           array('fieldName'=>'customers_email_format', 'value'=>$email_format, 'type'=>'stringIgnoreNull'),
                           array('fieldName'=>'customers_default_address_id', 'value'=>0, 'type'=>'integer'),
			   [B]array('fieldName'=>'gdpr_accept', 'value'=>$gdpr_accept, 'type'=>'integer'),
                           array('fieldName'=>'gdpr_accept_date', 'value'=>date('Y-m-d H:i:s'), 'type'=>'date'),[/B]
                           array('fieldName'=>'customers_password', 'value'=>zen_encrypt_password($password), 'type'=>'stringIgnoreNull'),
                           array('fieldName'=>'customers_authorization', 'value'=>$customers_authorization, 'type'=>'integer'),
    );

    if ((CUSTOMERS_REFERRAL_STATUS == '2' and $customers_referral != '')) $sql_data_array[] = array('fieldName'=>'customers_referral', 'value'=>$customers_referral, 'type'=>'stringIgnoreNull');
    if (ACCOUNT_GENDER == 'true') $sql_data_array[] = array('fieldName'=>'customers_gender', 'value'=>$gender, 'type'=>'stringIgnoreNull');
    if (ACCOUNT_DOB == 'true')  $sql_data_array[] = array('fieldName'=>'customers_dob', 'value'=>empty($_POST['dob']) || $dob_entered == '0001-01-01 00:00:00' ? zen_db_prepare_input('0001-01-01 00:00:00') : zen_date_raw($_POST['dob']), 'type'=>'date');

    $db->perform(TABLE_CUSTOMERS, $sql_data_array);

    $_SESSION['customer_id'] = $db->Insert_ID();

    $zco_notifier->notify('NOTIFY_MODULE_CREATE_ACCOUNT_ADDED_CUSTOMER_RECORD', array_merge(array('customer_id' => $_SESSION['customer_id']), $sql_data_array));


    $sql_data_array = array(array('fieldName'=>'customers_id', 'value'=>$_SESSION['customer_id'], 'type'=>'integer'),
                            array('fieldName'=>'entry_firstname', 'value'=>$firstname, 'type'=>'stringIgnoreNull'),
                            array('fieldName'=>'entry_lastname', 'value'=>$lastname, 'type'=>'stringIgnoreNull'),
                            array('fieldName'=>'entry_street_address', 'value'=>$street_address, 'type'=>'stringIgnoreNull'),
                            array('fieldName'=>'entry_postcode', 'value'=>$postcode, 'type'=>'stringIgnoreNull'),
                            array('fieldName'=>'entry_city', 'value'=>$city, 'type'=>'stringIgnoreNull'),
                            array('fieldName'=>'entry_country_id', 'value'=>$country, 'type'=>'integer'),
    );

    if (ACCOUNT_GENDER == 'true') $sql_data_array[] = array('fieldName'=>'entry_gender', 'value'=>$gender, 'type'=>'stringIgnoreNull');
    if (ACCOUNT_COMPANY == 'true') $sql_data_array[] = array('fieldName'=>'entry_company', 'value'=>$company, 'type'=>'stringIgnoreNull');
    if (ACCOUNT_SUBURB == 'true') $sql_data_array[] = array('fieldName'=>'entry_suburb', 'value'=>$suburb, 'type'=>'stringIgnoreNull');

    if (ACCOUNT_STATE == 'true') {
      if ($zone_id > 0) {
        $sql_data_array[] = array('fieldName'=>'entry_zone_id', 'value'=>$zone_id, 'type'=>'integer');
        $sql_data_array[] = array('fieldName'=>'entry_state', 'value'=>'', 'type'=>'stringIgnoreNull');
      } else {
        $sql_data_array[] = array('fieldName'=>'entry_zone_id', 'value'=>0, 'type'=>'integer');
        $sql_data_array[] = array('fieldName'=>'entry_state', 'value'=>$state, 'type'=>'stringIgnoreNull');
      }
    }

    $db->perform(TABLE_ADDRESS_BOOK, $sql_data_array);

    $address_id = $db->Insert_ID();

    $zco_notifier->notify('NOTIFY_MODULE_CREATE_ACCOUNT_ADDED_ADDRESS_BOOK_RECORD', array_merge(array('address_id' => $address_id), $sql_data_array));

    $sql = "UPDATE " . TABLE_CUSTOMERS . "
              SET customers_default_address_id = '" . (int)$address_id . "'
              WHERE customers_id = '" . (int)$_SESSION['customer_id'] . "'";

    $db->Execute($sql);

    $sql = "INSERT INTO " . TABLE_CUSTOMERS_INFO . "
                          (customers_info_id, customers_info_number_of_logons,
                           customers_info_date_account_created, customers_info_date_of_last_logon)
              VALUES ('" . (int)$_SESSION['customer_id'] . "', '1', now(), now())";

    $db->Execute($sql);

    // do any 3rd-party nick creation
    $nick_email = $email_address;
    $zco_notifier->notify('NOTIFY_NICK_CREATE_NEW', $nick, $password, $nick_email, $extra_welcome_text);

    if (SESSION_RECREATE == 'True') {
      zen_session_recreate();
    }

    $_SESSION['customer_first_name'] = $firstname;
    $_SESSION['customer_last_name'] = $lastname;
    $_SESSION['customer_default_address_id'] = $address_id;
    $_SESSION['customer_country_id'] = $country;
    $_SESSION['customer_zone_id'] = $zone_id;
    $_SESSION['customers_authorization'] = $customers_authorization;

    // restore cart contents
    $_SESSION['cart']->restore_contents();

    // hook notifier class
    $zco_notifier->notify('NOTIFY_LOGIN_SUCCESS_VIA_CREATE_ACCOUNT', $email_address, $extra_welcome_text, $send_welcome_email);

in ZC v1.5.8 that part of the create_account.php file now reads

    if ($error == true) {
        // hook notifier class
        $zco_notifier->notify('NOTIFY_FAILURE_DURING_CREATE_ACCOUNT');
    } elseif ($antiSpam != '') {
        $zco_notifier->notify('NOTIFY_SPAM_DETECTED_DURING_CREATE_ACCOUNT');
        $messageStack->add_session('header', (defined('ERROR_CREATE_ACCOUNT_SPAM_DETECTED') ? ERROR_CREATE_ACCOUNT_SPAM_DETECTED : 'Thank you, your account request has been submitted for review.'), 'success');
        zen_redirect(zen_href_link(FILENAME_SHOPPING_CART));
    } else {

        $ip_address = zen_get_ip_address();

        $customer = new Customer;

        $data = compact(
            'firstname', 'lastname', 'email_address', 'nick', 'email_format', 'telephone', 'fax',
            'newsletter', 'password', 'customers_authorization', 'customers_referral',
            'gender', 'dob', 'company', 'street_address',
            'suburb', 'city', 'zone_id', 'state', 'postcode', 'country', 'ip_address'
        );

        $result = $customer->create($data);
        if (!empty($result)) {
            $customer->login($result['customers_id'], $restore_cart = true);
            if (SESSION_RECREATE == 'True') {
                zen_session_recreate();
            }
        }

        // do any 3rd-party nick creation
        $nick_email = $email_address;
        $zco_notifier->notify('NOTIFY_NICK_CREATE_NEW', $nick, $password, $nick_email, $extra_welcome_text);

        // hook notifier class
        $zco_notifier->notify('NOTIFY_LOGIN_SUCCESS_VIA_CREATE_ACCOUNT', $email_address, $extra_welcome_text, $send_welcome_email);

How do I incorporate my gdpr code into the new ZC v1.5.8 code? I had thought that something like this might be appropriate

$data = compact(
            'firstname', 'lastname', 'email_address', 'nick', 'email_format', 'telephone', 'fax',
            'newsletter', [B]'gdpr_accept', 'gdpr_accept_date',[/B] 'password', 'customers_authorization', 'customers_referral',
            'gender', 'dob', 'company', 'street_address',
            'suburb', 'city', 'zone_id', 'state', 'postcode', 'country', 'ip_address'
        );

but am not sure if that works for 'gdpr_accept_date' with its value of 'date'.

Your edit to /includes/modules/MY_TEMPLATE/create_account.php is correct.

You will also need to edit includes/classes/Customer.php, adding the following code at line 727.

/* bof gdpr */
$sql_data_array [] = ['fieldName'=>'gdpr_accept', 'value'=>$data['gdpr_accept'], 'type'=>'integer'];
$sql_data_array [] = ['fieldName'=>'gdpr_accept_date', 'value'=>date('Y-m-d H:i:s'), 'type'=>'date'];
/* eof gdpr */

strelitzia:

Your edit to /includes/modules/MY_TEMPLATE/create_account.php is correct.

You will also need to edit includes/classes/Customer.php, adding the following code at line 727.

/* bof gdpr /
$sql_data_array [] = ['fieldName'=>'gdpr_accept', 'value'=>$data['gdpr_accept'], 'type'=>'integer'];
$sql_data_array [] = ['fieldName'=>'gdpr_accept_date', 'value'=>date('Y-m-d H:i:s'), 'type'=>'date'];
/ eof gdpr */

That's great, thank you for this.

simon1066:

That's great, thank you for this.

You're welcome.

If you get any further issues with it, let me know and I'll help you out.

I'll try and find time to update the package we offer via Zen Cart downloads!

strelitzia:

Your edit to /includes/modules/MY_TEMPLATE/create_account.php is correct.

You will also need to edit includes/classes/Customer.php, adding the following code at line 727.

/* bof gdpr /
$sql_data_array [] = ['fieldName'=>'gdpr_accept', 'value'=>$data['gdpr_accept'], 'type'=>'integer'];
$sql_data_array [] = ['fieldName'=>'gdpr_accept_date', 'value'=>date('Y-m-d H:i:s'), 'type'=>'date'];
/ eof gdpr */

FWIW, there *is *a notification issued by that class just after the base customer record has been created

    $this->notify('NOTIFY_MODULE_CREATE_ACCOUNT_ADDED_CUSTOMER_RECORD', array_merge(['customer_id' => $customer_id], $sql_data_array));

... which you could use via an observer-class to add those gpdr-related fields without carving up a **core file**.

strelitzia:

I'll try and find time to update the package we offer via Zen Cart downloads!

If you don't have time, even an old copy of the plugin would be very helpful and could be adopted by another developer.

Thanks for your contributions to Zen Cart!

lat9:

FWIW, there *is *a notification issued by that class just after the base customer record has been created

I’m aware of the notifier. I gave a quick fix to a forum member wanting to get his/her upgraded site working.
When the full module is checked and updated for 158 it will be updated to make use of this notifier. 😉

The copy of the JSWeb gdpr mod one customer has adds three more fields prev_gdpr_accept_date1, prev_gdpr_accept_date2, prev_gdpr_accept_date3.
These have no default value and are not nullable. They seem only partially integrated into the code as well - have these been removed or have they been changed to nullable? The current schema wouldn't work at all on a modern PHP/MySQL.

Also, are the gdpr_decline and gdpr_decline_date fields no longer used in the customers table by the JSWeb GDPR mod?

@strelitzia if you want to put what's available now in the plugins library, I can get it updated for 1.5.8.

swguy:

Also, are the gdpr_decline and gdpr_decline_date fields no longer used in the customers table by the JSWeb GDPR mod?

Those are definitely integral to the mod. When JSweb did this quickie thing - they also did a paid version. I found it just now - it still says it's for 1.5.5. So it was a quickie that they have abandoned - I saw problems and redid a bit of it from the start. I had integrated it into my template for a while but pulled it as it didn't turn out to be required as we thought at the time.

There is no question something like this is needed - I feel it should be integrated fully in zen cart default. But is this worth updating? It was never intended to be a mod for adding to the plugin directory. Not one of my clients use it. (My clients are now all US based) It is only an interface really for alerting customers that they have options. It doesn't provide anyway to delete or to decide how to delete a customer's data - that was in the commercial version. In other words this is very deceptive, only making a website look like it's obeying the intent of the GDPR regulations.

I would grateful for an uninstall script or instructions on converting the database fields (one of the employees of that website actually did this instead of me). I may have to come up with that myself. But the biggest issue is actually a website who has these changed fields, not using the mod, no indication of the mod being installed and then having the upgrade create issues - after the fact. I know that putting in some kind of check in the upgrade is more than one wants to do for one little used mod. But in reality - that's what I need ahead of the upgrade. Any ideas you have along those lines would be super!

delia:

Those are definitely integral to the mod. When JSweb did this quickie thing - they also did a paid version. I found it just now - it still says it's for 1.5.5. So it was a quickie that they have abandoned - I saw problems and redid a bit of it from the start. I had integrated it into my template for a while but pulled it as it didn't turn out to be required as we thought at the time.

There is no question something like this is needed - I feel it should be integrated fully in zen cart default. But is this worth updating? It was never intended to be a mod for adding to the plugin directory. Not one of my clients use it. (My clients are now all US based) It is only an interface really for alerting customers that they have options. It doesn't provide anyway to delete or to decide how to delete a customer's data - that was in the commercial version. In other words this is very deceptive, only making a website look like it's obeying the intent of the GDPR regulations.

I would grateful for an uninstall script or instructions on converting the database fields (one of the employees of that website actually did this instead of me). I may have to come up with that myself. But the biggest issue is actually a website who has these changed fields, not using the mod, no indication of the mod being installed and then having the upgrade create issues - after the fact. I know that putting in some kind of check in the upgrade is more than one wants to do for one little used mod. But in reality - that's what I need ahead of the upgrade. Any ideas you have along those lines would be super!

Has this moved on at all? I am upgrading to v158a and already use GDPR in my current ZC155f shop.
If it is of any use I attach the original files I had for installation on earlier versions

Attachment #20374

nope, it's dead in the water to my knowledge. Tho it may well work okay with 1.5.8 with little fixing. I simply haven't used it in years.

Those of us in the EU and the UK must have a solution in place. Both for GDPR and Cookie Control. The lack of both is a serious omission and a significant obstacle to Zen Cart being chosen or even tried by EU customers. It would be on my roadmap for world domination.

But while we may think ZC should have this in core, it is not going to happen while the development input is almost purely US-centric.
No that "they" don't care, but there is a lot of tedious detail to be reviewed and dealt-with and, inevitably, if you don't have an EU customer driving the work, you are not going to do it.

I wrote my own solution based on the ideas/code supplied at the start of this thread, but if I were starting now I would go to the German Zen Cart (where I would expect it to be built-in) and extract it from there.

torvista:

Those of us in the EU and the UK must have a solution in place. Both for GDPR and Cookie Control. The lack of both is a serious omission and a significant obstacle to Zen Cart being chosen or even tried by EU customers.

I too would have to agree that not even having at least a cookie control dialogue built into the core of Zen Cart is an omission that really needs to be looked at now. Whatever ones viewpoint is and yes I live in a country that has purposefully left the EU, you cannot overlook the fact that the EU represents a potential customer base of hundreds of millions of people. Very few businesses could realistically turn their back on that size of customer base.

GDPR is a pain in the ######## for sure.