GDPR compliance [closed]

Question

Just found about this new regulation, it will be law in 2018 and affects anybody who stores data about EU citizens, that can be used to identify a person. More detail here.

I have a page that doesn't store names and exact addresses but it stores birth dates and country/city as location and uses these two to provide a service (which is the core service, so I can't just stop collecting these data).

From what I understand I have to take some action to ensure compliance with GDPR, but I haven't found reasonable explanations what that means. There is a dozen articles that rephrase paragraphs of GDPR, that is not helping at all.

I don't mind full deletion, explaing what data I store to the users and simmilar points ... What I am mostly worried about is the part about anonymizing data so in case of a breach they can not be used to identify a person. How am I supposed to do that? If I store an email address used to verify an user account and tie birth date and location data via PK to that verified email, they are no longer anonymous ... and they can't be, right?

Any thought about practical solutions to become GDPR compliant?

Lampion

A way to become compliant is to ignore all users from the EU. I have a sample of doing that in .NET Core here: debugandrelease.blogspot.com/2018/11/… – Schoolteacher

Try the script by cookieyes – Sabol

Answer 1

Ultimately, in the UK, the GDPR will be enforced by the ICO - Information Commissioners Office. Whilst some of the regulation is quite clear cut, the articles relating to anonymisation are open to interpretation and we'll probably only fully understand how the line is drawn once the ICO has enforced a case relating to it. Having said that there is a bunch of good info on their site.

Their is also a group of academics in the UK advising both the ICO and businesses (for free) about anonymisation. They're called the UK Anonymisation Network - UKAN. I've had a web meeting with them - they're awesome.

It is unlikely you will have to anonymise your data if you use standard encryption to store your data at rest. Anonymisation may come in handy if you are sharing any of that data with third parties. In the event of a breach on their system, you can demonstrate you have taken as many steps as possible to mitigate your risk.

Wholly

Great response, thanks. Calmed me a bit. I hope i don't need anonymisation. I agree it's curently quite complicated and encrypton might be the "easier" choice from dev perspective. Well, first I will read through the links you mentioned and then i think again where I am :-) – Lampion

Anonymization is a specific case. You may not need it but you will need to encrypt your DB. Then the other aspect is you will need to gain the consent of the users that owns this data at their next login (cause you already acquired it). And you may have to clean the data for which no connection of the owners for a long time. As you will never have their consent to get it and keep it, you will have to throw it. – Size

"you will have to throw it" - instead of deleting it, you could anonymise it after a certain period of reasonable time. This meets the requirements of the GDPR. – Wholly

How does "encrypted at rest" need to be implemented? Eg is Data Partition Encryption described here enough? "This mechanism prevents unencrypted data from being read from the drives if the drives or the entire computer is stolen. This does not protect against attacks while the file system is mounted, because when mounted, the operating system provides an unencrypted view of the data" – Aretta

I wonder about "encryption at rest" as well as file-system encryption only protects against physical theft of the server, which seems to me a non-risk as my server is in the cloud guarded 24/7. However, It does deteriorate the query performance substantially I saw in some benchmarks. I am considering to just implement pgcrypto for encrypting only personal data columns. – Wintertide

Answer 2

I agree with the above - GDPR is a great thing for privacy rights and data control - I also agree that there are a million sites out there just rephrasing gdpr! In terms of practical steps, more guidance is going to be released by the ICO this month. But it makes sense to begin by mapping out what user data you process, whether the reasons for this are justified and whether there you have asked for EXPLICIT permission to use that data in that way. Further to this you should think about how you can delete data if it's requested.

There are services that will keep independent record of opt ins and alert you to data vulnerabilities. Anonomisation works in some cases, in others, if you have permission, then all you need is process to delete and an audit trail.

Appellation

Looking forawrd to those instructions :-) – Lampion