Roadmap v2 v3 v4 etc

[allendav]

Let's restructure the roadmap into what we landed in 4.9.6 and what didn't.

Let's also start penciling in buckets for future collections of features, including

• front-side consent capture / cookie + consent prompt
• consent editing (wp-admin?)
• consent logs viewable by admin
• right-to-object / changing consent

[allendav]

Moar:

• front side / DIY export
• front side / DIY erasure

[iandunn]

Before adding new features, I think it'd be good to clean up the existing code. Specifically, adding unit test coverage before 4.9.7, and organizing everything into logical files for 5.0.

[iandunn]

Also, applying the coding standards for 4.9.7.

I'm keen to look at the plugin guidelines, possibly as part of a wider project to establish a best practice standard for open source in privacy and data protection, as a complement to the coding work: without clear guidance on how to develop for best practice, our coding work is a lot of retroactive fixes.

[allendav]

• Code moving to more appropriate locations

(oops - jinx @iandunn already mentioned this above)

[allendav]

• Have a way for plugins to indicate whether or not they implement the eraser and exporter tools - so we can alert the admin what plugins do NOT contribute to the export report (or implement personal data erasure) so they are aware of what additional actions might need to be taken beyond using the core flows to do a comprehensive export or erasure.

The ideal implementation will also make it easy for a plugin to say they don't do anything with personal data at all.

[pandjarov]

Gravatars should not be enabled by default since gravatar rendering happens after email exchange.

[danieltj27]

As per my comment in the GDPR Slack channel: https://wordpress.slack.com/archives/C9695RJBW/p1525948145000062

Is anonymising comment data on the road map?

Being able to remove the Name, Email and IP address at the very least seems like a must for comments on sites. The actual comment content I feel should be left as is as nines time out of ten I wouldn;t include personal information. Or have an option to optionally remove comment content too.

[allendav]

• also allow for finding personal data using things other than the user's email address (e.g. phone number)