# User stories minors [GDPR 08-16]

### Sprint AM4 - 26/09
w 39, 40, 41, 42

GDPR08 Habilitar l’opció de tenir comptes per menors d’edat
GDPR09 Compte associat de menors
GDPR10 Iniciar sessió com a menor
GDPR12 Millorar flux de creació de compte
GDPR13 Registre d’activitat de menors
GDPR15 Gestionar compte d’usuària de menor

decidim-module-minor_participants

## Configure the minors and adults minimum age

Reference: GDPR08

**Is your feature request related to a problem? Please describe.**
As an implementer, a person that administers a Decidim application as a sysadmin, I want to be able to enable and configure the creation of minor accounts.

**Describe the solution you'd like**
As an implementer of Decidim, I would like to have an option in the system panel, that is, for each of the instances, where I can enable the creation of accounts by minors participants and other new functionalities related to this EPIC.

I should also be able to configure:

- from what age it is allowed to create these accounts (`minimum_minor_age`). The default would be 12 years.
- from what age parental consent should no longer be requested. The default would be 16 years. (`minimum_adult_age`)

These two values (minimum age to create a minor account and age without parental consent), will be independently selectable when allowing access to a space. [ref: GDPR16].

Since the access of minors depends on the context of each organization, this development should be a module.

**Describe alternatives you've considered**

To have it configurable through the initializer/secrets.yml/environment variables as other Decidim's settings, but these could depend on an Organization (aka Tenant), so it's better to have this kind of granularity.

**Does this issue could impact on users private data?**
Yes as it afects to minors data, it is particulary sensitive.

**Acceptance criteria:**
- [ ] As an implementer I can enable the creation of minor accounts in a given Organization through /system panel
- [ ] As an implementer I can specify the minimum age to create a minor account in a given Organization through /system panel
- [ ] As an implementer I can specify the legal age of consent to create a minor account without parental permission in a given Organization through /system panel

---

## Minor associated account

Reference: GDPR09

**Is your feature request related to a problem? Please describe.**

As a minor participant I can't create an account to participate in the platform. For legal reasons we need the legal guardian consent.

Futhermore as a legal guardian for a minor, I can't create an account for my son in a safer environment that I can control.

**Describe the solution you'd like**
As a confirmed participant by email account, I want to be able to create an account for my daughter or minor dependant. I will need to

- add my ID number
- fill the registration form for the minor account
- add my child's date of birth. This date is important in order to be able to later "Promote minor account to adult account" (Ref: GDPR11)
- verify the minor identity through the municipal census
- accept the self-responsible declaration (or terms of use)

After creating the account, I will be able to change all user profile data of the minor account (name, email, photo, etc.).

I will be able to have several minors' accounts associated with the same profile.

The guardians's account must not be verified in the municipal census.

Since the access of minors depends on the context of each organisation, this development should be a module.

**Describe alternatives you've considered**
An other solution could be to have a separate sign-up for minors.

**Does this issue could impact on users private data?**
Yes as it afects to minors data, it is particulary sensitive.

**Accpetance criteria**
- [ ] As a confirmed user I can be able to create a minor account from "My account">"Minors accounts"
- [ ] As a confirmed user I have to add my ID number
- [ ] As a confirmed user I can fill in the registration form for my son and define a password
- [ ] As a confirmed user I have to verify the identity of the minor through the municipal census. (CP, ID and birthday)
- [ ] As a minor registered participant I receive a "Welcome message" after create my account.
- [ ] As a minor responsable I can have several minors accounts associated to mine
- [ ] As a minor responsable I can change all the data of the user profile from a minor account associated

## **[GDPR10] [Infants] Log in as a minor**
Reference: GDPR10

**Is your feature request related to a problem? Please describe.**
As a minor, once my account has been created for me by my guardian (see "Associated account for minors", ref: GDPR09), I would like to be able to log in.

**Describe the solution you'd like**
As a minor, I would like to log in with my e-mail address and password.

I would like to change my user password. As this user I will have access to minors spaces (see "Spaces with access by minors", ref: GDPR16).

As the access for minors depends on the context of each organisation, this development should be a module

**Describe alternatives you've considered**
Have an exclusive login path for minors.

**Does this issue could impact on users private data?**
Yes as it afects to minors data, it is particulary sensitive.

**Acceptance criteria**
- [ ] As a minor registered I can be able to log in
- [ ] As a minor registered I can be able to change my password
- [ ] As a minor registered I can be able to change my profile data, except for my birthday
- [ ] As a minor registered I can be able to acces to minors spaces

## **[GDPR12] [Infants] Improving the flow of account creation**

Reference: GDPR12

**Is your feature request related to a problem? Please describe.**

In Decidim there will be many types of users that a participant can be, some incompatible with each other. For example:
- one can be a registered and verified participant
- a participant who belongs to a group of users
- a minor participant
- a participant who is the guardian of a minor

**Describe the solution you'd like**
As a visitor who wants to create an account, I would like to be clearer about these possible flows.

In the registration form I would like to have a visible link that says "Are you a minor? We explain how you must do it to have an account". This link would lead to a page in the Help section explaining the steps needed to create a minor account (/pages/minors).

This page would be editable by the administrators of each organization. In order to adapt the text to each particular case.

**Describe alternatives you've considered**
Have an exclusive login path for minors.

Add a check box in the register form wit he following text: "I confirm that I'm an adult"

**Acceptance criteria**
- [ ] As a minor without an account that wants to register, I see that there's an specific path to register as a minor.
- [ ] As a minor without an account that wants to register, I read how can I have an account and I undestand it.

## **[GDPR13] [Infants] Activiy log for minors**
Reference: GDPR13

**Is your feature request related to a problem? Please describe.**
As an implementer of a installation, I would like to have a log file that is separate or with a particular prefix that allows me to more easily access actions related to minors.

**Describe the solution you'd like**
The log file could be for example:
- log/production-minor-consent.log or the prefix MINOR-CONSENT inside of the file log/production.log
- log/production-minor-activity.log or the prefix MINOR-ACTIVITY inside of the file log/production.log

As the access for minors depends on the context of each organisation, this development should be a module

**Describe alternatives you've considered**

**Does this issue could impact on users private data?**
Yes as it afects to minors data, it is particulary sensitive.

**Acceptance criteria**
- [ ] As an implementer I can have a separate log file for the minors activity

## **[GDPR15] [Infants] Manage a minor's user account**
Reference GDPR15

**Is your feature request related to a problem? Please describe.**
As the guardian of a minor's account, I need a way to audit the actions she has taken.

**Describe the solution you'd like**
I would like to be able to manage this account, i.e. log in with this user's account for a certain period of time.

**Describe alternatives you've considered**
To be able to have a record of the minor's account activity, without the need to access his or her account.

**Does this issue could impact on users private data?**
Yes, as an adult is accessing a minor's account and this data is particularly sensitive.

**Acceptance criteria**
- [ ] As a guardian with a minor account associated, I can log in with the minor account.
- [ ] As a guardian with a minor account associated logged in with the minor account, in a specific period of time the minor session will be automatically closed.

----
## Propers sprints
:::info
No s'han detallat encara quines seran les User Stories dels propers sprints. El calendari proposta per Platoniq pels dos propers sprints és:

**Sprint AM5 - 24/10**
w 43, 44, 45, 46

**Sprint AM6 - 21/11**
w 47, 48, 49

User stories infants pendents:
GDPR11 Promoure compte de menor a compte d’adult
GDPR14 Registre d’activitat de compte de menor al meu perfil
GDPR16 Espais amb accés per menors d’edat
GDPR17 Accés com a professor per espais amb accés per menors d’edat
GDPR18 Verificació amb padró per espais amb accés per menors d’edat
:::

## **[GDPR11] [Infants] Promote minor account to adult account**
**Is your feature request related to a problem? Please describe.**
As a registered user with a minor account, I want to be able to promote my account when I have reached the legal age of consent for data protection purposes, to have an adult (regular) account.

**Describe the solution you'd like**
When the minor reaches the age of majority, an email will be sent to the minor and the guardian to let them know that their accounts are now independent.

This task will be executed automatically when the minor exceeds the age from which the guardian's authorisation is no longer required (ref: GDPR09).

**Describe alternatives you've considered**
Another possibility would be that the minor is the one who directly promotes his or her account to the adult.

This implies thinking about what happens if the minor does not do this promotion. This would require us to perform an automatic task once a year to automatically promote the accounts of minors who are over the maximum age.

As the access for minors depends on the context of each organisation, this development should be a module.

**Does this issue could impact on users private data?**
Yes as it afects to minors data, it is particulary sensitive.

**Acceptance criteria**

- [ ] As a registered minor when I reach the legal age of consent my account is automatically promoted to adult.
- [ ] As a registered minor when I reach the legal age of consent I receive an email stating that my account has been promoted to adult.

## **[GDPR14] [Infants] Minor activity log in my profile**

**Is your feature request related to a problem? Please describe.**
As the guardian of a minor's account, I need a way to audit the actions he/she has taken.

**Describe the solution you'd like**
It is "My activity" but for the child's user.

Therefore, I would like to be able to see the child's activity log in my profile (/profiles/USER/activity).

Activity done in spaces exclusively for minors should be visible only to guardians and the minor him/herself.

**Describe alternatives you've considered**
Ideas are welcome

**Does this issue could impact on users private data?**
Yes as it afects to minors data, it is particulary sensitive.

**Acceptance criteria**

- [ ] As a guardian with a minor account associated, I can see the activity log of the minor from my account.
- [ ] As a guardian with a minor account associated, I can see the activity done by the minor in a spaces exclusively for minors.

## **[GDPR16] Space with access for minors**

**Is your feature request related to a problem? Please describe.**
In some processes, children of different ages may coexist. For example, in a class group, children of 13 and 14 years of age can coexist. Therefore, as an administrator, you should be able to define that an exclusive space for minors can also include minors who are above the legal age of consent established in the system.

As well as teachers or adults with special permissions

**Describe the solution you'd like**
As an administrator I would like to be able to set various degrees of access depending on the type of process to be carried out and the age of the participants:
- Space for all. All participants will have access regardless of the age of the participants.
- Exclusive space for minors:
- For minors with guardianship, who are participants below the legal age of consent `minimum_minor_age`. According to what has been configured in the system "Enable the option to have accounts for minors" - ref: [GDPR08]).
- Have the option to limit that minors without guardianship can participate. I.e. who are above the `minimum_adult_age`, but below the age of majority (Ref: GDPR 18).

- They will also be able to access:
- facilitators of the participation space (with existing profiles of administrators, collaborators, moderators).
- tutors associated with minors, with read-only access.
- new read-only role without access to the administration panel, by educators or similar figures. See ref: [GDPR17].
- those participants who have been verified with the municipal register in case this option is activated. See ref: [GDPR18]

- Visitors and other participants who do not comply with the rules will not have access, but will be able to view the space. When they click on it, they will see an error message "you cannot access this space because you do not meet the requirements".
- The space will be accessible but its contents will not be visible by transversal functionalities (e.g. the search engine, profile follow sections, GraphQL API, etc).

**Describe alternatives you've considered**
Ideas are welcome

**Does this issue could impact on users private data?**
Yes as it afects to minors data, it is particulary sensitive.

**Acceptance criteria**

- [ ] As an admin, I can create a participatory space (process or assembly) exclusive for minors in guardianship.
- [ ] As an admin, I can define if I allow minors without guardianship to participate in a participatory space exclusive for minors.
- [ ] As a minor in guardianship, I can acces to a participatory space exclusive for minors.
- [ ] As a minor without guardianship, I can participate in a participatory space exclusive for minors, when it's able to me.
- [ ] As a visitor or participant I can see the participatory space but I can not access to it. I see an error message when I click on it.
- [ ] As a visitor or a participant, I am not able to find the content generated in a participatory space exclusive for minors in any of the transversl funcionalities (the search engine, profile follow sections, GraphQL API, etc).

## **[GDPR17] [Infants] Accés com a responsable per espais amb accés per menors d’edat** (No es fa)

**Is your feature request related to a problem? Please describe.**
Minor's spaces will often be facilitated or supervised by an adult figure, such as a teacher. As the person in charge of a children's space I need to be able to follow what is going on in the space.

**Describe the solution you'd like**
As a teacher or lecturer of a junior space, for example a class in a school, I would like to have access to that space with read-only permissions.

This role would be very similar to Collaborators, with the only difference being that they would not have access to the administration panel.

**Describe alternatives you've considered**
Ideas are welcome

**Does this issue could impact on users private data?**
Yes as it afects to minors data, it is particulary sensitive.

**Acceptance criteria**
- [ ] As an admin, I can give "Responsible for a minor's space" permissions to a participant.
- [ ] As a responsible for a minor's space, I can access to a participatory space exclusive for minors.
- [ ] As a responsible for a minor's space, I can participate in a participatory space exclusive for minors.

## **[GDPR18] [Infants] Verificació amb padró per espais amb accés per menors d’edat**
**Is your feature request related to a problem? Please describe.**

For some of the bodies that Barcelona City Council currently has, it is also necessary to allow access by minors under 16 years of age. At the legal level, it is no longer necessary to ask for parental consent for these participants.

**Describe the solution you'd like**
That is why it should:

- Logic of access to the space:
- Add a checkbox within the configuration of a "Space exclusive for minors" that says "I want to check the age with the municipal census" and where you can put the maximum age of the users. This option will be available when the verification method supports this logic.
- When a participant accesses this space, and is not a minor's account (ref GDPR10), they should be asked to verify their age.
- When the participant does not have an age associated with their user account, access will not be allowed.

- Verification logic with the AJBCN Register:
- When the register verifies that I am under 16 years of age, it will store my age encrypted in the database.

We need to discuss the naming of theese configurations.The alternatives could be something like:

Option a)

Option b)

**Acceptance criteria**
- [ ] As an admin, I can configure a participatory space as a "Space exclusive for minors"
- [ ] As an admin, I can enable the participation of minors without guardianship in a "Space exclusive for minors"
- [ ] As an admin, I can define the maximum age to access the minors space.
- [ ] As a participant, when I try to access a space for minors, I am required to verify my age using the municipal census. If I don't meet the requierments I won't be allowed to access.
- [ ] As a minor participant, I can access to a minors space.
- [ ] As a minor without guardianship participant, I can access to a minors space when it's enabled.

Ja que l'accés de menors depèn del context de cada organització, aquest desenvolupament hauria de ser un mòdul.