project: Moodle
summary: Collection of issues that capture the changes required to the user sign up process to comply with GDPR
description: To be released as a plugin with subsequent integration into core for Moodle 3.5

1.summary: Add a site level privacy settings page
description: Add a site level privacy settings page with some minimal features. Separate privacy policy page (separate to terms of service/site policy) Versioned (every edit makes a new version) Require all users to accept latest version of privacy policy before they can access the site ||User Story||Acceptance Criteria|| |As an Moodle administrator I need all users on my site to read and accept the latest version of my privacy policy before I can collect, store and process that users personal data so that I dont face heavy fines. To do this I need settings to enable and manage policies.| There is a privacy page for site settings containing all privacy related settings There is a site administration setting to enable / disable site privacy policy| |As a Moodle administrator I need a page where I can enter in a privacy policy. This privacy policy should keep the previous versions that I have created that were accepted.|There is privacy policy page where: There is a site administration setting to force all site users to accept the latest version of the privacy policy before they can access the site There is a rich-text field allowing site administrators to write the text of the privacy policy The text of the privacy policy supports multi lang filters Each change to the privacy policy is saved as a separate version and it is possible to see all the previous versions By default all users will have to re-consent for any policy change on their first login following the change. This can be disabled on a case by case basis for minor changes to the policy that do not alter the meaning of its content. If disabled, the users would not have to re-consent on their next login.|
2.summary: Require guardian consent for minors
description: Minors (< 16 years but can vary by EU member state) must have parental / guardian consent to accept a privacy policy. We need a site setting to allow/disallow minors and if allowed we need a process for obtaining parental/guardian consent. ||User Story||Acceptance Criteria|| |As a Moodle administrator, I need a way to prevent access to my site from minors in order to guarantee the protection of their privacy as well as a way to provide access to minors that complies with GDPR requirements of obtaining parental/guardian consent.| A new user signing up for Moodle should be asked for their country of residence, before any user profile data is recorded There should be a separately maintainable list of countries with ages of digital consent, e.g. a listing of all EU countries (and any other relevant countries) If a new user s country is one of those on the list, they will be asked whether their age is over the age of digital consent that is recorded in the list. If the new user is over the age of digital consent the sign-up process continues as normal. If they are below the age of digital consent a page is displayed asking the user to contact the site admin as they are considered a minor and parental consent is required. If the site privacy policy is changed, the minor s account will be frozen until the admin has received renewed consent from the parent / guardian. The record of accepting the privacy policy needs to include the guardian details that accepted the privacy policy, the minor (user) details, the version of the privacy policy and the date/time. Administrators will have to create a parent role (as described in Moodle docs) to be associated with any minor account created. It should be possible for admins to accept the privacy policy on behalf of users, after they have received parental / guardian consent (through means outside of Moodle).| |As a parent/guardian I need to prevent my child from accessing a Moodle site until I give my consent to the terms of service and the privacy policy in order to protect their privacy.| As a parent / guardian, if a new account is created for my child and they are a minor, their account will not be created until the site admin has been alerted and has contacted me through other means to obtain my consent. If the privacy policy is updated, access for my minor children should be frozen until the site admin has obtained my consent for the updated policy.| |As a Moodle administrator I need a way to allow everyone access to my site regardless of age.| A Moodle administrator should be able to not set the minimum age for accessing the site. This should make the age and country field optional for each user|
3.summary: Add data protection officer to privacy policy
description: Add fields to record a Moodle site data protection officer and automatically include this information in the sites privacy policy. Any changes to these fields should trigger a new version of the privacy policy that must be re-accepted by all site users. ||User Story||Acceptance Criteria|| |As a Moodle administrator I need to display the data protection officer for my site as part of my privacy policy in order to comply with the GDPR| When these settings have been set, the information is automatically included in the sites privacy policy. Any changes to these settings will generate a new version of the sites privacy policy and require re-consent from all users.| |As a Moodle administrator I need to be able to assign the Data Protection officer role to a user| A new role can be created called Data Protection officer that can be assigned to a user (as a collection of capabilities) This role can create, view and execute subject access requests and requests from subjects invoking their right to be forgotten The activities of this role will be logged to create an audit trail| |As a Moodle administrator I need to be able to assign the Data Privacy officer role to a user| A new role can be created called Data Privacy officer that can be assigned to a user (as a collection of capabilities) This role can: - Create and update entries in the data registry, including defining purpose and retention time for collected data - Update the sites privacy policy and determine whether users need to re-consent The activities of this role will be logged to create an audit trail|
4.summary: Add a listing of data processors
description: A data processor is a third party plugin, integration or tool that Moodle transmits or receives data about an identifiable real person. For each data processor we need fields to record: The personal data that is sent The purpose of sharing this data The data protection officer for the third party Any binding agreements in place to protect the data The privacy policy of the third party These third parties must all be listed in the site privacy policy and changes to any of these fields will require re-acceptance of the new version of the privacy policy by all site users. ||User Stories||Acceptance Criteria|| |As a Moodle administrator, I want to list all the third parties that my Moodle site will share personal data with in order to inform users about how and where their personal data is processed and the protections in place.| In the Moodle site administration privacy settings, I can add a list of third party sites / services with which personal data is shared. For each third party I can list the type of personal data (profile fields, activity data etc). For each third party I can list the purpose of sharing this data For each third party I can list the data protection officer including contact information For each third party I can link to binding agreements that protect the privacy of the data ( data processing agreements ) For each third party I can link to a privacy policy Each of these fields containing free text must support multi-lang filters.| |As a Moodle user, if a new third party plugin, integrated system or other add-on is added to the privacy policy, I need to review and accept the new list of third party tools before Moodle can send my personal data to the third party in respect to my privacy.| Each change to the list of third parties tools should generate a new version of the privacy policy Every time a new version of the privacy policy is created all site users must consent to the new version before they can access the site| |As a Moodle administrator I need the list of 3rd party plugins, integrations or tools to be displayed on the consent page during the onboarding process| The consent record page can display a list of 3rd party tools, with a link to their privacy policy Each tool should have a checkbox next to it to record the user has purposefully consented to their data being shared with this 3rd party The user will need to consent to all 3rd party plugins to be able to use Moodle|
5.summary: Add a privacy page to Moodle
description: Add a privacy page to Moodle, available from each users profile page that links to: The current version of the privacy policy ||User Stories||Acceptance Criteria|| |When I use a site I need to be able to easily access the latest version of the privacy policy.| It should be possible to view any previous version of the privacy policy, to see exactly what a user consented to. The current version of the privacy policy should be available in my user profile page, as well as presented to me when requesting my consent.|
6.summary: Add a report listing the active acceptances of the sites privacy policy (including full link to specific version).
description: A site needs to be able to prove that each user has accepted the current version of the sites privacy policy or it is illegal for that site to store and process personal data. ||User Stories||Acceptance Criteria|| |A Moodle administrator needs to be able to find users that have not accepted the latest version of the privacy policy in order to contact them|There is a filter option for users who have not accepted the current version| |A Moodle administrator needs to see for a specific user, which versions of the privacy policy were accepted and what was in the privacy policy at that version, who accepted it and the date/time| There is a filter option for a specific user Each returned result includes the version information and a link to view the privacy policy at that version The date and time of each acceptance is recorded as well as the person who accepted it.| |A Moodle administrator needs to be able to see all the previous versions of the privacy policy with the exact text for each version and the dates that it was changed.| There is a separate listing of all the previous versions of the privacy policy. There is an option to view the privacy policy with the multi-lang filters disabled.| |A Moodle administrator can download the results of the report|Download as CSV| |A Moodle administrator needs to be able to find minors whose parent/guardians have not accepted the latest version of the privacy policy|There is a filter option for minors which can be combined with the filter for not accepted current version|
7.summary: Add a site policy settings page
description: Add a site policy settings page with some minimal features. Separate site policy page (separate to privacy settings) Versioned (every edit makes a new version) Require all users to accept latest version of site policy before they can access the site ||User Story||Acceptance Criteria|| |As an Moodle administrator I need all users on my site to read and accept the latest version of my site policy| There is a site policy page for site settings containing all site policy related settings There is a site administration setting to enable / disable site site policy There is a site administration setting to force all site users to accept the latest version of the site policy before they can access the site There is a rich-text field allowing site administrators to write the text of the site policy The text of the site policy supports multi lang filters Each change to the site policy is saved as a separate version and it is possible to see all the previous versions By default any policy change will require users to re-consent. Users are notified and must accept the new version of the site policy before they can access the site The requirement for all users to re-consent can be disabled on a case-by-case basis. If there exists both a site policy and a privacy policy, the users must actively consent to both before they can access the site|
8.summary: Update the sign-up process
description: ||User Story||Acceptance Criteria|| |As a user I should be asked to agree to the various policy statements (site, privacy, etc.) before gaining access to the site.| Minors need to be determined and then directed away (to get permission from a guardian and talk with an administrator or privacy officer to create an account) from the site. If above the age of a minor in their region then the privacy policy and any other policy should be accepted. Once all policies are accepted then a profile can be created (directed to the sign up sheet).|
9.summary: Create a consent page (includes simple language and data processors)
description: ||User Story||Acceptance Criteria|| |As a Moodle administrator I need to have a consent form which summarises the privacy policy in simple, easy to understand language.| The consent form should show a summary of the privacy policy. The text of the summary supports multi lang filters The versioning of this content should be linked to the privacy policy page. When the consent page is changed, users are notified and must accept the new version of the site policy before they can access the site.| |As a Moodle administrator I need the consent page to contain a list of third party sections that the user will have to agree to, to use the site.| The administrator and privacy officer should have the ability to make alterations The versioning of this content should be linked to the privacy policy page. When the consent page is changed, users are notified and must accept the new version of the site policy before they can access the site.|
10.summary: A new admin tool allowing to manage policy documents
description: We need a new Moodle plugin allowing the user to define various policy documents - site policy, privacy policy, intellectual property policy, late assignments policy and others as needed. It will keep the history of document revisions, track user agreements with them, and force users to accept them prior to using the site. It should allow for alternative ways of accepting the policy - via a parent-like role with a certain capability, via a token sent by email, or even offline (e.g. signing a printed out policy in the school).
11.summary: A new popup for showing the policy links to guests
description: If enabled, show guest users a popup (similar to the one used for cookie-law notifications commonly), for showing the policy links which affect them.
12.summary: Create digital minor verification page
description: Create digital minor verification page
13.summary: Show report on which users agreed to the policies and their versions
description: Show report on which users agreed to which policy
14.summary: Add the workflow for allowing users to agree to the policies
description: Change the workflow for allowing users to agree to the policies if needed.
15.summary: Create contact administrator page
description: Create a "Contact administrator" page where a digital minor will be redirected upon signup.
16.summary: Update the signup process - add age and location verification
description: Add age and location verification page upon signup in order to restrict access to digital minors without a guardian consent. This should be an optional feature that can be enabled/disabled. Workflow: A new user signing up for Moodle should be asked for their country of residence and age, before any user profile data is recorded. There should be a separately maintainable list containing a default age of digital consent and countries where the age of digital consent is different than the default. The list and the users age and location data will be used to determine if the user is considered to be a minor. If the user is over the age of digital consent the sign-up process continues as normal. If they are below the age of digital consent a page is displayed asking the user to contact the site admin as they are considered a minor and parental consent is required. The administrator gets permission (external from moodle) to create an account for their child. The administrator can then create the user account (including details for how to contact the parent / guardian) using any of the enrolment methods.
17.summary: Allow plugins to overwrite $CFG->sitepolicy and $CFG->sitepolicyguest
description: For GDPR compliance we develop a plugin that will allow to have multiple site policies, version them, require users to agree to new versions, etc. Currently in moodle the configuration settings $CFG->sitepolicy and $CFG->sitepolicyguest allow to specify site policy. Allow plugins to overwrite the core functionality by introducing the callback site_policy_handler and also the admin setting to select which plugin is responsible for handling site policies
18.summary: Add a callback pre_signup_requests executed in the beginning of login/signup.php
description: Advanced site policy handlers will want to display the site policy before displaying the signup form. Add callback pre_signup_requests in the beginning of login/signup.php
19.summary: Implement all actions for the site_policy_handler callback
description: In there has been added the actions parameter to the site_policy_handler callback: So its needed to add all these actions to the tool_policy.
20.summary: Use modal window in acceptances page for displaying the policies
description: In the acceptances page, use the modal window for displaying the policies instead of showing the content in a new page. Some example can be found in prepare_user_acceptances function in policy/classes/output/page_agreedocs.php.
21.summary: Allow bulk accept on behalf
description: In the mockups it is possible to check several people and accept on their behalf in one action
22.summary: Privacy officer follow-up
description: Remove the privacy officer setting. It should be further discussed in the future if a separate setting (or another solution) is needed when defining a Privacy officer.
23.summary: Prepare tool_policy for integration in 3.5
description: Prepare plugin tool_policy for integration in 3.5 Removed files: README.md LICENSE.md .travis.yml version.php changed to look like a standard plugin
24.summary: Adapt tool_policy to avoid travis errors on Github plugin project
description: When was finished, the code for the Moodle 3.3 and 3.4 tool_policy plugin has been updated, to align the versions. As travis on the GitHub project ( is more strict than CiBot, some minor changes should be done in the code for removing these travis errors.
25.summary: Change policy agreements once the policies has been accepted
description: Eva Karall has posted the following comment to Will there be a possibility to opt out (disagree) again from a policy? I cannot find anything about it. Thanks. We should add a link in the profile to for let him/her change the agreements.

Below is an instruction that describes a task, paired with an input that provides an epic with this format: 
"project": "Name of the project" 
"summary": "Summary of the epic user story" 
"description": "Description of the epic user story". Write a response that appropriately completes the request.### Instruction:
Break this epic user story into smaller tasks to help the developers understand the epic better, you can divide this epic into as much as you want depending on the complexity of the epic.
### Input:
project: Moodle
summary: Collection of issues that capture the changes required to the user sign up process to comply with GDPR
description: To be released as a plugin with subsequent integration into core for Moodle 3.5

### Response:
1.summary: Add a site level privacy settings page
description: Add a site level privacy settings page with some minimal features. Separate privacy policy page (separate to terms of service/site policy) Versioned (every edit makes a new version) Require all users to accept latest version of privacy policy before they can access the site ||User Story||Acceptance Criteria|| |As an Moodle administrator I need all users on my site to read and accept the latest version of my privacy policy before I can collect, store and process that users personal data so that I dont face heavy fines. To do this I need settings to enable and manage policies.| There is a privacy page for site settings containing all privacy related settings There is a site administration setting to enable / disable site privacy policy| |As a Moodle administrator I need a page where I can enter in a privacy policy. This privacy policy should keep the previous versions that I have created that were accepted.|There is privacy policy page where: There is a site administration setting to force all site users to accept the latest version of the privacy policy before they can access the site There is a rich-text field allowing site administrators to write the text of the privacy policy The text of the privacy policy supports multi lang filters Each change to the privacy policy is saved as a separate version and it is possible to see all the previous versions By default all users will have to re-consent for any policy change on their first login following the change. This can be disabled on a case by case basis for minor changes to the policy that do not alter the meaning of its content. If disabled, the users would not have to re-consent on their next login.|
2.summary: Require guardian consent for minors
description: Minors (< 16 years but can vary by EU member state) must have parental / guardian consent to accept a privacy policy. We need a site setting to allow/disallow minors and if allowed we need a process for obtaining parental/guardian consent. ||User Story||Acceptance Criteria|| |As a Moodle administrator, I need a way to prevent access to my site from minors in order to guarantee the protection of their privacy as well as a way to provide access to minors that complies with GDPR requirements of obtaining parental/guardian consent.| A new user signing up for Moodle should be asked for their country of residence, before any user profile data is recorded There should be a separately maintainable list of countries with ages of digital consent, e.g. a listing of all EU countries (and any other relevant countries) If a new user s country is one of those on the list, they will be asked whether their age is over the age of digital consent that is recorded in the list. If the new user is over the age of digital consent the sign-up process continues as normal. If they are below the age of digital consent a page is displayed asking the user to contact the site admin as they are considered a minor and parental consent is required. If the site privacy policy is changed, the minor s account will be frozen until the admin has received renewed consent from the parent / guardian. The record of accepting the privacy policy needs to include the guardian details that accepted the privacy policy, the minor (user) details, the version of the privacy policy and the date/time. Administrators will have to create a parent role (as described in Moodle docs) to be associated with any minor account created. It should be possible for admins to accept the privacy policy on behalf of users, after they have received parental / guardian consent (through means outside of Moodle).| |As a parent/guardian I need to prevent my child from accessing a Moodle site until I give my consent to the terms of service and the privacy policy in order to protect their privacy.| As a parent / guardian, if a new account is created for my child and they are a minor, their account will not be created until the site admin has been alerted and has contacted me through other means to obtain my consent. If the privacy policy is updated, access for my minor children should be frozen until the site admin has obtained my consent for the updated policy.| |As a Moodle administrator I need a way to allow everyone access to my site regardless of age.| A Moodle administrator should be able to not set the minimum age for accessing the site. This should make the age and country field optional for each user|
3.summary: Add data protection officer to privacy policy
description: Add fields to record a Moodle site data protection officer and automatically include this information in the sites privacy policy. Any changes to these fields should trigger a new version of the privacy policy that must be re-accepted by all site users. ||User Story||Acceptance Criteria|| |As a Moodle administrator I need to display the data protection officer for my site as part of my privacy policy in order to comply with the GDPR| When these settings have been set, the information is automatically included in the sites privacy policy. Any changes to these settings will generate a new version of the sites privacy policy and require re-consent from all users.| |As a Moodle administrator I need to be able to assign the Data Protection officer role to a user| A new role can be created called Data Protection officer that can be assigned to a user (as a collection of capabilities) This role can create, view and execute subject access requests and requests from subjects invoking their right to be forgotten The activities of this role will be logged to create an audit trail| |As a Moodle administrator I need to be able to assign the Data Privacy officer role to a user| A new role can be created called Data Privacy officer that can be assigned to a user (as a collection of capabilities) This role can: - Create and update entries in the data registry, including defining purpose and retention time for collected data - Update the sites privacy policy and determine whether users need to re-consent The activities of this role will be logged to create an audit trail|
4.summary: Add a listing of data processors
description: A data processor is a third party plugin, integration or tool that Moodle transmits or receives data about an identifiable real person. For each data processor we need fields to record: The personal data that is sent The purpose of sharing this data The data protection officer for the third party Any binding agreements in place to protect the data The privacy policy of the third party These third parties must all be listed in the site privacy policy and changes to any of these fields will require re-acceptance of the new version of the privacy policy by all site users. ||User Stories||Acceptance Criteria|| |As a Moodle administrator, I want to list all the third parties that my Moodle site will share personal data with in order to inform users about how and where their personal data is processed and the protections in place.| In the Moodle site administration privacy settings, I can add a list of third party sites / services with which personal data is shared. For each third party I can list the type of personal data (profile fields, activity data etc). For each third party I can list the purpose of sharing this data For each third party I can list the data protection officer including contact information For each third party I can link to binding agreements that protect the privacy of the data ( data processing agreements ) For each third party I can link to a privacy policy Each of these fields containing free text must support multi-lang filters.| |As a Moodle user, if a new third party plugin, integrated system or other add-on is added to the privacy policy, I need to review and accept the new list of third party tools before Moodle can send my personal data to the third party in respect to my privacy.| Each change to the list of third parties tools should generate a new version of the privacy policy Every time a new version of the privacy policy is created all site users must consent to the new version before they can access the site| |As a Moodle administrator I need the list of 3rd party plugins, integrations or tools to be displayed on the consent page during the onboarding process| The consent record page can display a list of 3rd party tools, with a link to their privacy policy Each tool should have a checkbox next to it to record the user has purposefully consented to their data being shared with this 3rd party The user will need to consent to all 3rd party plugins to be able to use Moodle|
5.summary: Add a privacy page to Moodle
description: Add a privacy page to Moodle, available from each users profile page that links to: The current version of the privacy policy ||User Stories||Acceptance Criteria|| |When I use a site I need to be able to easily access the latest version of the privacy policy.| It should be possible to view any previous version of the privacy policy, to see exactly what a user consented to. The current version of the privacy policy should be available in my user profile page, as well as presented to me when requesting my consent.|
6.summary: Add a report listing the active acceptances of the sites privacy policy (including full link to specific version).
description: A site needs to be able to prove that each user has accepted the current version of the sites privacy policy or it is illegal for that site to store and process personal data. ||User Stories||Acceptance Criteria|| |A Moodle administrator needs to be able to find users that have not accepted the latest version of the privacy policy in order to contact them|There is a filter option for users who have not accepted the current version| |A Moodle administrator needs to see for a specific user, which versions of the privacy policy were accepted and what was in the privacy policy at that version, who accepted it and the date/time| There is a filter option for a specific user Each returned result includes the version information and a link to view the privacy policy at that version The date and time of each acceptance is recorded as well as the person who accepted it.| |A Moodle administrator needs to be able to see all the previous versions of the privacy policy with the exact text for each version and the dates that it was changed.| There is a separate listing of all the previous versions of the privacy policy. There is an option to view the privacy policy with the multi-lang filters disabled.| |A Moodle administrator can download the results of the report|Download as CSV| |A Moodle administrator needs to be able to find minors whose parent/guardians have not accepted the latest version of the privacy policy|There is a filter option for minors which can be combined with the filter for not accepted current version|
7.summary: Add a site policy settings page
description: Add a site policy settings page with some minimal features. Separate site policy page (separate to privacy settings) Versioned (every edit makes a new version) Require all users to accept latest version of site policy before they can access the site ||User Story||Acceptance Criteria|| |As an Moodle administrator I need all users on my site to read and accept the latest version of my site policy| There is a site policy page for site settings containing all site policy related settings There is a site administration setting to enable / disable site site policy There is a site administration setting to force all site users to accept the latest version of the site policy before they can access the site There is a rich-text field allowing site administrators to write the text of the site policy The text of the site policy supports multi lang filters Each change to the site policy is saved as a separate version and it is possible to see all the previous versions By default any policy change will require users to re-consent. Users are notified and must accept the new version of the site policy before they can access the site The requirement for all users to re-consent can be disabled on a case-by-case basis. If there exists both a site policy and a privacy policy, the users must actively consent to both before they can access the site|
8.summary: Update the sign-up process
description: ||User Story||Acceptance Criteria|| |As a user I should be asked to agree to the various policy statements (site, privacy, etc.) before gaining access to the site.| Minors need to be determined and then directed away (to get permission from a guardian and talk with an administrator or privacy officer to create an account) from the site. If above the age of a minor in their region then the privacy policy and any other policy should be accepted. Once all policies are accepted then a profile can be created (directed to the sign up sheet).|
9.summary: Create a consent page (includes simple language and data processors)
description: ||User Story||Acceptance Criteria|| |As a Moodle administrator I need to have a consent form which summarises the privacy policy in simple, easy to understand language.| The consent form should show a summary of the privacy policy. The text of the summary supports multi lang filters The versioning of this content should be linked to the privacy policy page. When the consent page is changed, users are notified and must accept the new version of the site policy before they can access the site.| |As a Moodle administrator I need the consent page to contain a list of third party sections that the user will have to agree to, to use the site.| The administrator and privacy officer should have the ability to make alterations The versioning of this content should be linked to the privacy policy page. When the consent page is changed, users are notified and must accept the new version of the site policy before they can access the site.|
10.summary: A new admin tool allowing to manage policy documents
description: We need a new Moodle plugin allowing the user to define various policy documents - site policy, privacy policy, intellectual property policy, late assignments policy and others as needed. It will keep the history of document revisions, track user agreements with them, and force users to accept them prior to using the site. It should allow for alternative ways of accepting the policy - via a parent-like role with a certain capability, via a token sent by email, or even offline (e.g. signing a printed out policy in the school).
11.summary: A new popup for showing the policy links to guests
description: If enabled, show guest users a popup (similar to the one used for cookie-law notifications commonly), for showing the policy links which affect them.
12.summary: Create digital minor verification page
description: Create digital minor verification page
13.summary: Show report on which users agreed to the policies and their versions
description: Show report on which users agreed to which policy
14.summary: Add the workflow for allowing users to agree to the policies
description: Change the workflow for allowing users to agree to the policies if needed.
15.summary: Create contact administrator page
description: Create a "Contact administrator" page where a digital minor will be redirected upon signup.
16.summary: Update the signup process - add age and location verification
description: Add age and location verification page upon signup in order to restrict access to digital minors without a guardian consent. This should be an optional feature that can be enabled/disabled. Workflow: A new user signing up for Moodle should be asked for their country of residence and age, before any user profile data is recorded. There should be a separately maintainable list containing a default age of digital consent and countries where the age of digital consent is different than the default. The list and the users age and location data will be used to determine if the user is considered to be a minor. If the user is over the age of digital consent the sign-up process continues as normal. If they are below the age of digital consent a page is displayed asking the user to contact the site admin as they are considered a minor and parental consent is required. The administrator gets permission (external from moodle) to create an account for their child. The administrator can then create the user account (including details for how to contact the parent / guardian) using any of the enrolment methods.
17.summary: Allow plugins to overwrite $CFG->sitepolicy and $CFG->sitepolicyguest
description: For GDPR compliance we develop a plugin that will allow to have multiple site policies, version them, require users to agree to new versions, etc. Currently in moodle the configuration settings $CFG->sitepolicy and $CFG->sitepolicyguest allow to specify site policy. Allow plugins to overwrite the core functionality by introducing the callback site_policy_handler and also the admin setting to select which plugin is responsible for handling site policies
18.summary: Add a callback pre_signup_requests executed in the beginning of login/signup.php
description: Advanced site policy handlers will want to display the site policy before displaying the signup form. Add callback pre_signup_requests in the beginning of login/signup.php
19.summary: Implement all actions for the site_policy_handler callback
description: In there has been added the actions parameter to the site_policy_handler callback: So its needed to add all these actions to the tool_policy.
20.summary: Use modal window in acceptances page for displaying the policies
description: In the acceptances page, use the modal window for displaying the policies instead of showing the content in a new page. Some example can be found in prepare_user_acceptances function in policy/classes/output/page_agreedocs.php.
21.summary: Allow bulk accept on behalf
description: In the mockups it is possible to check several people and accept on their behalf in one action
22.summary: Privacy officer follow-up
description: Remove the privacy officer setting. It should be further discussed in the future if a separate setting (or another solution) is needed when defining a Privacy officer.
23.summary: Prepare tool_policy for integration in 3.5
description: Prepare plugin tool_policy for integration in 3.5 Removed files: README.md LICENSE.md .travis.yml version.php changed to look like a standard plugin
24.summary: Adapt tool_policy to avoid travis errors on Github plugin project
description: When was finished, the code for the Moodle 3.3 and 3.4 tool_policy plugin has been updated, to align the versions. As travis on the GitHub project ( is more strict than CiBot, some minor changes should be done in the code for removing these travis errors.
25.summary: Change policy agreements once the policies has been accepted
description: Eva Karall has posted the following comment to Will there be a possibility to opt out (disagree) again from a policy? I cannot find anything about it. Thanks. We should add a link in the profile to for let him/her change the agreements.
