Automatic order anonymization for COVID-19 tracking

[loelkes]

COVID-19 regulations (e.g. State of Baden-Württemberg) require that hosts store the contact data for visitors over the period of four weeks and delete them afterwards. I have an event with multiple dates (50-100) over a period of (probably) several months.

1. Could it be possible to anonymize visitors orders for each date instead of the entire event only?
2. Could it be possible to automatically run this anonymization after a defined time (e.g. four weeks)?

Related to #1712 by topic (COVID-19)

[loelkes]

Additional question: is there a possibility to change the minimum time until the event can be anonymised? As mentioned previously, current regulations set the deletion time to 4 weeks (28 days) after data collection, pretix enforces 60 days.

Die Veranstaltung muss mindestens 60 Tage vorüber sein, damit diese Funktion bereitsteht.

[raphaelm]

This timeframe has already been reduced to 30 days in d0c6f0f, I suppose we could also do 21 days or something like that.

Doing this per-subevent and automatically would be nice, but probably requires quite some work. We have an internal plugin that does part of this in a quick-and-dirty way (and with less configuration options) that we use with some customers currently, and we haven't yet decided whether to publish it (if we do, we'll post it here).

[loelkes]

Doing this per-subevent and automatically would be nice, but probably requires quite some work.

If pretix can expose the anonymize event-feature through the API some situations could be solved with a quick-and-dirty external script. Could be a first step?