[Koha] GDPR - Statistics and anonymization

[Jonathan Druart]

Hello everybody,

I have been contracted by KohaLa to work on some GDPR requirements.
The main idea is to "anonymize" patron's data but letting the library
access the transactions' statistics.

I am going to present you what I am planning to implement, in order to
collect ideas and answers.

There are the following steps I have in mind:
1. Pseudonymization [1] of patron's data
2. Improve deletion of patron related date (tables statistics,
old_reserves, deletedborrowers)
3. Add the ability to remove data that have been pseudonymized

I see 2 ways to achieve point 1:
* We create 2 tables, 1 for the patrons, 1 for the transactions.
- borrowers_anonymized will contain: hash_id, has_cardnumber,
branchcode, creation_date, categorycode, bsort1, bsort2,
[borrower_attributes]
- transaction_anonymized will contain: hash_id, transaction_type,
branchcode, itemnumber, holdingbranch, location, itemcallnumber,
itemtype, timestamp

hash_id will be generated using the borrowernumber and a key (that
will be stored on the server, path in koha-conf)

Pros: Easier to understand and manipulate as it follows existing structure.
We track patron's modifications (this is the most important part)
Cons: tech part: new config, a new path have to be created (minor)

* We create only 1 table, (nosql-like). It will contain the same data
as previously, without the hash_id

Pros: No new config. Data are never updated and we have the values
when the transactions has been processed.
Cons: Data are not updated :)

About borrower_attributes, the initial specification asks for 2
attributes defined in a syspref. I think it should be configurable,
with a join table (Pro: more flexible, Con: SQL requests more complex)

I think we should have the 2 tables and keep a link between the
anonymized_patrons and anonymized_transactions tables.

What do you think?
I am going to start the implementation very soon in order to plan an
integration early in the 20.05 dev cycle.

Regards,
Jonathan

[1] https://en.wikipedia.org/wiki/Pseudonymization