ACLs - privacy settings - GDPR issues
By Supporter on Sunday, 17 March 2019
Posted in General Issues
Replies 10
Likes 0
Views 423
Votes 0
Hi,

Why is that some items are still visible to guests when a user's privacy is all set to a "minimum" privacy setting to registered users?

From Page views:
- Stream items from any user
- Followers are all listed and linked
- Comments are visible to anyone
- ... and more ...

From Group views:
- Stream items from any user is visible for guests
- Members list, all are listed and linked
- Comments are visible to anyone
- ... and more ...

Same is true for Events ...

A conflict happens with "Public" setting of Groups, Pages, Events, ...
These should also follow the correct privacy settings from both user's own settings and user profile settings.

Shouldn't there be a Viewing Permission Setting in the category creation for all these (Pages, Groups, Events, ...)
- ONLY display owner/administrator activities for guests
- FULLY respect users privacy settings
- Follow Profile Type privacy settings

Plus ...

When moving the mouse over a user name in stream it displays: Access to this profile has been restricted for privacy reasons, no image is displayed in mini header
( - But because of privacy settings user activity should just not be displayed at first ! )
Why then can we also click on the username and access his profile, display his picture and profile banner when they are hidden by restrictions in the hovered mini header ? Where is the logic?
Is the full privacy really respected?
- Should there be a more restrictive Viewing Permission for user to not be displayed/visible at all ?

I am looking forward to reading your explanations and understand your logic about these...
I was trying to restrict the views and noticed it was possible to adjust some parameters ONLY if you create a new workflow...
This help somehow to create a partial workaround but doesn't provide a real fix...

Still, can you give me your point of view about my first questionings?
How can we have public Pages like for businesses to be visible but still respect other users privacy settings...

Also an other useful setting would be to copy the settings from Group Types / Field to Pages, Events, ... ?
(see screenshot)
Supporter
·
Sunday, 17 March 2019 23:54
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi Supporter,
Why is that some items are still visible to guests when a user's privacy is all set to a "minimum" privacy setting to registered users?
Shouldn't there be a Viewing Permission Setting in the category creation for all these (Pages, Groups, Events, ...)
The privacy and stream items of clusters are determined by the cluster type(public/private/invite-only) and will disregard the privacy set by users.

This is why you do not see privacy selection in the story form when creating posts in clusters. I do not recall a specific reason for this behavior. All I know is that Facebook have this behavior as well where cluster stream items disregards user's own privacy.

I think the behavior(cluster timeline uses cluster privacy) makes sense because if users can have their own privacy inside clusters, one scenario is they can even say bad things about the cluster, and set the privacy to friends so only their friends can see them. This means the group admins will not be able to see the posts.

Also, if all users can set privacy for their activity in clusters, it may even appear to the public that the cluster itself is not active due to all the hidden items.
Why then can we also click on the username and access his profile, display his picture and profile banner when they are hidden by restrictions in the hovered mini header ?
The restrictions in the mini header is just to suggest that the profile is restricted, not to hide the avatar/cover specifically.

In the profile page, you can prevent the header from showing by template overriding the restricted profile theme file(https://take.ms/kDZEb).
Raymond
·
Monday, 18 March 2019 16:31
·
0 Likes
·
0 Votes
·
0 Comments
·
Thank you Raymond,

This clarified why questioning.

Can you please give give me your thoughts about:
Also an other useful setting would be to copy the settings from Group Types / Field to Pages, Events, ... ?
(see screenshot)
Supporter
·
Monday, 18 March 2019 19:46
·
0 Likes
·
0 Votes
·
0 Comments
·
Hey Supporter,

We will see what we can do to add that setting in the future into page and event type custom fields.
Raymond
·
Tuesday, 19 March 2019 13:14
·
0 Likes
·
0 Votes
·
0 Comments
·
View Full Post