project: MoodleNet
summary: GDPR, DMCA, DPIA, and other four-letter acronyms
description: MoodleNet is being built to be GDPR compliant. It should also comply with DMCA, and we should fill in a DPIA, with help from Carlo.

1.summary: Add link to Moodles Privacy Notice on MoodleNet login page
description: This one:
2.summary: Review GDPR requirements for MoodleNet
description: Assigning this to mayeldeborniol but a discussion for the whole team.
3.summary: Decide whether Moodle HQ is running MoodleNet instance(s)
description: Need to decide whether were running HQ MoodleNet instance(s). Three options being discussed as a result of the DPIA: A) Moodle HQ doesnt run MoodleNet instances at all. In this case, were just offering open source software which other people (including Moodle Partners) can use and configure. B) Moodle HQ runs MoodleNet instance(s) for people/organisations with whom we have a data processing agreement. That may include staff, contractors, and Moodle Partners. C) Moodle HQ runs MoodleNet instance(s) for anyone to sign up to as part of the wider federated network. ----- Right now, were leaning towards Option B in the first instance, with the following notes: Keep HQ-run instance invite-only Allow users to data import/export data Include data processing in new user agreement
4.summary: Create Data Protection Impact Assessment (DPIA)
description: As part of the General Data Protection Regulation (GDPR) we need to provide the Information Commissioners Office (ICO) with a Data Protection Impact Assessment (DPIA): > A DPIA is a process designed to help you systematically analyse, identify and minimise the data protection risks of a project or plan. It is a key part of your accountability obligations under the GDPR, and when done properly helps you assess and demonstrate how you comply with all of your data protection obligations. > It does not have to eradicate all risk, but should help you minimise and determine whether or not the level of risk is acceptable in the circumstances, taking into account the benefits of what you want to achieve. > DPIAs are designed to be a flexible and scalable tool that you can apply to a wide range of sectors and projects. Conducting a DPIA does not have to be complex or time-consuming in every case, but there must be a level of rigour in proportion to the privacy risks arising. There is more detail, including a template to use as a starting point, here: ----- IMPORTANT: see comments at
5.summary: Prepare for DMCA compliance
description: DMCA compliance is something we need to plan for with MoodleNet: > The Digital Millennium Copyright Act (DMCA) is a 1998 United States copyright law that implements two 1996 treaties of the World Intellectual Property Organization (WIPO). It criminalizes production and dissemination of technology, devices, or services intended to circumvent measures that control access to copyrighted works (commonly known as digital rights management or DRM). It also criminalizes the act of circumventing an access control, whether or not there is actual infringement of copyright itself. In addition, the DMCA heightens the penalties for copyright infringement on the Internet.12 Passed on October 12, 1998, by a unanimous vote in the United States Senate and signed into law by President Bill Clinton on October 28, 1998, the DMCA amended Title 17 of the United States Code to extend the reach of copyright, while limiting the liability of the providers of online services for copyright infringement by their users. Theres a good thread on the Fediverse which starts with criticism of PeerTube not having a robust solution to this, but which also includes useful info: ----- IMPORTANT: See thread here:
6.summary: Hard-code user agreement
description: Most MoodleNet instances will be connected to the HQ Mothership via an API key. We want to enforce a particular user agreement, so this should be hard-coded into MoodleNet and checked regularly to ensure compliance. Admins of MoodleNet federated instances connected to the HQ Mothership should have the option of _adding_ to the user agreement, but not modifying or deleting any of it.

Below is an instruction that describes a task, paired with an input that provides an epic with this format: 
"project": "Name of the project" 
"summary": "Summary of the epic user story" 
"description": "Description of the epic user story". Write a response that appropriately completes the request.### Instruction:
Break this epic user story into smaller tasks to help the developers understand the epic better, you can divide this epic into as much as you want depending on the complexity of the epic.
### Input:
project: MoodleNet
summary: GDPR, DMCA, DPIA, and other four-letter acronyms
description: MoodleNet is being built to be GDPR compliant. It should also comply with DMCA, and we should fill in a DPIA, with help from Carlo.

### Response:
1.summary: Add link to Moodles Privacy Notice on MoodleNet login page
description: This one:
2.summary: Review GDPR requirements for MoodleNet
description: Assigning this to mayeldeborniol but a discussion for the whole team.
3.summary: Decide whether Moodle HQ is running MoodleNet instance(s)
description: Need to decide whether were running HQ MoodleNet instance(s). Three options being discussed as a result of the DPIA: A) Moodle HQ doesnt run MoodleNet instances at all. In this case, were just offering open source software which other people (including Moodle Partners) can use and configure. B) Moodle HQ runs MoodleNet instance(s) for people/organisations with whom we have a data processing agreement. That may include staff, contractors, and Moodle Partners. C) Moodle HQ runs MoodleNet instance(s) for anyone to sign up to as part of the wider federated network. ----- Right now, were leaning towards Option B in the first instance, with the following notes: Keep HQ-run instance invite-only Allow users to data import/export data Include data processing in new user agreement
4.summary: Create Data Protection Impact Assessment (DPIA)
description: As part of the General Data Protection Regulation (GDPR) we need to provide the Information Commissioners Office (ICO) with a Data Protection Impact Assessment (DPIA): > A DPIA is a process designed to help you systematically analyse, identify and minimise the data protection risks of a project or plan. It is a key part of your accountability obligations under the GDPR, and when done properly helps you assess and demonstrate how you comply with all of your data protection obligations. > It does not have to eradicate all risk, but should help you minimise and determine whether or not the level of risk is acceptable in the circumstances, taking into account the benefits of what you want to achieve. > DPIAs are designed to be a flexible and scalable tool that you can apply to a wide range of sectors and projects. Conducting a DPIA does not have to be complex or time-consuming in every case, but there must be a level of rigour in proportion to the privacy risks arising. There is more detail, including a template to use as a starting point, here: ----- IMPORTANT: see comments at
5.summary: Prepare for DMCA compliance
description: DMCA compliance is something we need to plan for with MoodleNet: > The Digital Millennium Copyright Act (DMCA) is a 1998 United States copyright law that implements two 1996 treaties of the World Intellectual Property Organization (WIPO). It criminalizes production and dissemination of technology, devices, or services intended to circumvent measures that control access to copyrighted works (commonly known as digital rights management or DRM). It also criminalizes the act of circumventing an access control, whether or not there is actual infringement of copyright itself. In addition, the DMCA heightens the penalties for copyright infringement on the Internet.12 Passed on October 12, 1998, by a unanimous vote in the United States Senate and signed into law by President Bill Clinton on October 28, 1998, the DMCA amended Title 17 of the United States Code to extend the reach of copyright, while limiting the liability of the providers of online services for copyright infringement by their users. Theres a good thread on the Fediverse which starts with criticism of PeerTube not having a robust solution to this, but which also includes useful info: ----- IMPORTANT: See thread here:
6.summary: Hard-code user agreement
description: Most MoodleNet instances will be connected to the HQ Mothership via an API key. We want to enforce a particular user agreement, so this should be hard-coded into MoodleNet and checked regularly to ensure compliance. Admins of MoodleNet federated instances connected to the HQ Mothership should have the option of _adding_ to the user agreement, but not modifying or deleting any of it.
