Dealing with user email at the end of submission
After numerous talks, here is a status about dealing with the user email at the end of a submission (by a citizen).
Context
Once a citizen has reported the location of the issue, its nature, and possibly a photo, the last step is to say "thank you". Within this thank-you-screen (or thank-you-step), we wondered whether we should collect (or not) the user email. The following describes what is expected.
Default behaviour
- The email is optional: "if you'd like to be informed of the treatment of your submission, you can provide your email"
- If the email is provided, the local government must comply with GDPR (right for the citizen to know about, modify or wipe its own personal data)
Note: as per GDPR article 11, there is no obligation to gather an email for a submission. But if an email is transmitted by the user, the purpose of the treatment must be clearly defined and understandable, and the rest of GDPR applies.
Behaviour "email is mandatory"
- A local government may decide to ask an email on a mandatory basis. We (Adullact) will inform the local government that:
- this adds a step in the submission process that may be seen as intrusive, and the user may abort the submission ("I just want to help you, don't bother me with email")
- GDPR applies and must be complied with
- So in that case the email is a mandatory field in that new step, that appears just before the thank-you-screen
Architecture consequence
Applying the behaviour "email is mandatory" should be a setting (unchecked checkbox) when creating a local government.