GDPR and technology - details matter, Kalle Varisvirta, Exove Exove and Bird & Bird seminar on Nov 23rd 2016: "GDPR - Practical Effects on Digital Business - juridical, technical, and customer point of view"

1. GDPR and technology -
details matter
Kalle Varisvirta
@kvirta

2. Me
Kalle Varisvirta
Technology Director
Not a lawyer

3. Documentation
vs.
reality

6. Documentation
vs. reality
Privacy policies (as well as PIAs) are usually written by
interviewing Developers and Systems Engineers, but
unfortunately by non-technical people
Technical people simplify things when asked about
details by non-technical people - that’s what we’re told
to do

7. Cloud &
SaaS services

11. Residual data
&
removing data

12. Residual data &
removing data
Data leaves a trace when going through a system
Mapping your data exactly is very difficult, as is
removing it

14. Varnish or CDN in the front
Web server logs
Local caches
Uploaded binary files
Backups of the servers

15. MySQL logs
Binary logs on all
servers
Backups of
binary logs
Database dumps
made by
developers
Production
dumps to staging
environment

16. Integration platform logs and local caches
Integration platform document DB oplogs
SaaS messaging platform logs and internal database

17. All the SaaS services

18. Finally the actual data
master, its logs,
backups and
development
environment

19. Residual data
Data flows are complicated
Residual data is easily overlooked and forgotten
Removal of data becomes very problematic in the real
world
Removing from backups

20. Electronic format &
data aggregation

21. Electronic format
There are a lot of requirements for providing data in an
electronic format
Most systems have the data spread out optimized for
the system, not aggregation
Gathering data to a “single” electronic format would be
a complicated and slow manual task for most
environments

23. What to do?

24. What to do?
Take the regulation seriously
Map out your systems, in full detail
Consider data flow through the system
Consider the cloud / SaaS services you might be
using
Consider residual data

25. What to do?
For compliance, make sure technical personnel (either
internal or from your vendors) are involved
To understand the regulation, not just to provide
answers

26. Thanks.
Questions?