WordPress.org

Make WordPress Core

Opened 10 months ago

Closed 3 months ago

#44239 closed enhancement (maybelater)

Personal data reports do not include image attachment metadata

Reported by: joanne123 Owned by:
Milestone: Priority: normal
Severity: normal Version: 4.9.6
Component: Privacy Keywords:
Focuses: Cc:

Description

Image attachments may sometimes have associated data containing quite a lot of personal information.
The personal data report shows a link only to the image itself. Would it not be more useful to show a link to the attachment page?

Change History (6)

#1 @allendav
10 months ago

@joanne123 - can you give an example of personal data core saves in attachment meta? or are you thinking of particular plugins?

#2 @joanne123
10 months ago

I'm thinking that if the image itself is to be recorded as being possibly personal data (and the new personal data export function does seem to do this), then so should any title, caption or description associated with it.

This ticket was mentioned in Slack in #core-privacy by desrosj. View the logs.


7 months ago

#4 @desrosj
7 months ago

  • Keywords needs-patch added
  • Milestone changed from Awaiting Review to 5.0

Thanks for the ticket, @joanne123. And welcome to Trac!

This falls under the same discussion as posts. There is no way to judge which post content or post title contain personal data. Same is true for attachment descriptions and captions. I am not sure that including all metadata is appropriate (camera details, for example), but including titles, descriptions and captions is reasonable.

#5 @pento
5 months ago

  • Milestone changed from 5.0 to 5.1

#6 @desrosj
3 months ago

  • Keywords needs-patch removed
  • Milestone 5.1 deleted
  • Resolution set to maybelater
  • Status changed from new to closed

Looking at this again, I think I actually misspoke in ticket#44239:comment#4. User post data is not included in data exports by default currently in core.

I am going to close this out as maybelater. I think that until personal data stored in attachment metadata can be identified, this can be solved with a plugin.

Note: See TracTickets for help on using tickets.