Solution needed for GDPR Compliance

[camikazegreen]

Motivation

Arizona International has suspended all paid advertising in the European market until we (as a university) have a solution in place for GDPR Compliance.

Proposed Resolution

Describe the solution you'd like

I would like a solution in place that:

• meets the compliance requirements of the GDPR
• has the approval of the Privacy Office
• has the approval of the Office of the General Council (OGC)
• ideally is non-disruptive outside of the markets where it is required (example: not causing annoying pop-ups or consent banners in the US)
• works correctly with our GTM consent mode implementation

Describe alternatives you've considered

1. The Privacy Office has worked with Meredith Aaronson to explore a fully comprehensive solution using onetrust. This would have been a more enterprise wide data privacy solution that included provisions for the right to be forgotten (and more) and would have been implemented across all of the university's data systems (Trellis, UAccess Student, etc.). Onetrust also has a Drupal module available that would connect into this greater solution, but doesn't seem to function without that larger contract. The implementation of this broader solution seems to be off the table for now.

2. There are open source solutions available like the Cookies Consent Manager Module that are designed more specifically as a solution to providing consent for tracking cookies for anonymous users to our websites. This solution integrates with Google Tag Manager's consent mode, but does not assume any liability for compliance with GDPR. If this solution is selected, the liability for compliance will need to be assumed by the privacy office and OGC.

Roles and Permissions considerations

A clear and concise description of how each of the following roles would be impacted by this change:

• Anonymous user
  Should be offered consent options in relevant markets
• Authenticated user
  Likely doesn't need to be offered consent options, but this is probably worth discussion since there are use cases for authenticated users that don't have any other roles on the site.
• Content editor
  No change
• Content administrator
  Should be able to administer Cookie management
• Administrator
  Should be able to enable/disable any relevant modules

Additional context

Ryan Dool in Marketing & Brand Development and Cameron Green in Campus Web Services will work with the Privacy office to gain the necessary approvals for our solution.