ES-CQRS and GDPR: When Immutability Meets Reality

ES-CQRS and GDPR: When Immutability Meets Reality

The last couple of years has seen a surge of interest in Event Sourcing in the PHP community. This has coincided with the introduction of GDPR, the new data privacy regulations rolled out across all EU28 nations.

In this talk, Stuart will introduce you to the core principles of GDPR and the Data Protection Act 2018. He’ll look at what capabilities you need to add to your application/service to allow your business to comply with this landmark legislation. And then he’ll look at how these requirements do—or don’t—map into the Event Sourcing world.

Presented at PHP North East User Group on 19th March 2019.

2c1dc90ff7bf69097a151677624777d2?s=128

Stuart Herbert

March 19, 2019
Tweet

Transcript

  1. 2.

    Industry veteran: architect, engineer, leader, manager, mentor F/OSS contributor since

    1994 Talking and writing about PHP since 2004 Chief Software Archaeologist Building Quality @GanbaroDigital About Stuart
  2. 7.

    @GanbaroDigital In This Talk 1. Event Sourcing 2. GDPR 3.

    How GDPR Impacts Event Sourcing 4. Summary
  3. 14.

    @GanbaroDigital Some Example Events • User added item to basket

    • User completed basket checkout • User paid for order • Order shipped
  4. 25.

    @GanbaroDigital Event Source systems store events in the database ...

    ... not the current state (and not the operations either).
  5. 36.

    @GanbaroDigital An Event Store is, ultimately, a database. It may

    be a general purpose RDBMS, a NoSQL datastore, or a specialist ESDB.
  6. 37.
  7. 38.
  8. 39.
  9. 40.
  10. 41.
  11. 64.

    @GanbaroDigital If the Projection Cache is lost, it can be

    rebuilt by playing back the events from the Event Store.
  12. 71.

    @GanbaroDigital To rebuild state for any moment in time, you

    need to know which version of the code was applied to each event.
  13. 78.
  14. 89.
  15. 91.

    @GanbaroDigital For many developers, GDPR will be the first time

    they have worked in a regulated environment.
  16. 92.

    @GanbaroDigital “ GDPR is the beginning of the end of

    the wild, wild west of unregulated software development.
  17. 93.

    @GanbaroDigital GDPR applies to free / open-source software too. You

    can't get around that in your LICENSE.md file.
  18. 95.

    @GanbaroDigital Here are just some* of the requirements that GDPR

    and DPA 2018 place on data processing. * IANAL etc etc
  19. 113.

    @GanbaroDigital Inform all third-parties that you have deleted personal data

    that you have passed to them. And tell the individual about those third-parties.
  20. 117.

    @GanbaroDigital • Right to be informed • Right of access

    • Right to rectification • Right to erasure • Right to restrict processing • Right to data portability • Right to object • Rights related to automated processing Individual Rights
  21. 119.

    @GanbaroDigital If you obtain personal data from third-party sources, you

    must* provide individuals with your privacy information within 1 month.
  22. 123.
  23. 125.

    @GanbaroDigital Do not use personal data that is subject to

    a processing restriction request. But you can still store it.
  24. 127.

    @GanbaroDigital *but only when lawful basis is consent or by

    contract, and only when personal data is processed by automated means.
  25. 156.

    @GanbaroDigital Requirement: You must be able to trace all personal

    data back to a lawful purpose for each processing use.
  26. 157.

    @GanbaroDigital Implies: You may need to track which items of

    personal data have been used for each piece of processing.
  27. 160.

    @GanbaroDigital Requirement: You must be able to drop any piece

    of personal data. ... as if you never held it in the first place.
  28. 161.

    @GanbaroDigital Requirement: You must be able to remove personal data

    from everywhere (inc backups and archives).
  29. 164.

    @GanbaroDigital Implies: You may need to track which items of

    personal data have been used for each piece of processing.
  30. 175.
  31. 182.
  32. 183.

    @GanbaroDigital Requirement: You must be able to drop any piece

    of personal data. ... as if you never held it in the first place.
  33. 185.

    @GanbaroDigital ?? ?? Can you purge any piece of personal

    data from the Projection Cache and any snapshots?
  34. 186.

    @GanbaroDigital ?? ?? If you do so by rebuilding the

    Projection Cache, are you sure you won't change anyone else's personal data?
  35. 188.

    @GanbaroDigital ?? ?? If you still have the data, but

    cannot read it today, does that prevent it being read in the future?
  36. 190.

    @GanbaroDigital Requirement: You must be able to remove personal data

    from everywhere (inc backups and archives).
  37. 192.

    @GanbaroDigital ?? ?? If you rebuild state for an earlier

    time, how do you honour processing restrictions?
  38. 193.

    @GanbaroDigital ?? ?? How do you ensure processing restrictions do

    not change anyone else's personal data after a projection rebuild?
  39. 194.

    @GanbaroDigital Implies: You may need to track which items of

    personal data have been used for each piece of processing.
  40. 195.

    @GanbaroDigital ?? ?? Can you reproduce the state used at

    any point in time? With 100% accuracy?
  41. 197.

    @GanbaroDigital ?? ?? Can you have the benefits of Event

    Sourcing and be GDPR-compliant? And is it worth it?
  42. 201.

    @GanbaroDigital We're in the early stage of GDPR enforcement. Enforcement

    actions (or inaction!) will shape future advice.
  43. 203.

    @GanbaroDigital As a CTO, I would not adopt any framework

    / approach that relies on immutability if it will store personal data.
  44. 205.

    @GanbaroDigital When evaluating an ES framework, ask the question: where

    are the docs on how to achieve GDPR compliance?
  45. 206.

    @GanbaroDigital When evaluating an ES framework, ask the question: where

    is the legal advice that it is GDPR compliant?
  46. 207.

    @GanbaroDigital In an ES workshop, ask the question: how do

    you achieve GDPR compliance using what is being taught?
  47. 208.

    @GanbaroDigital In an ES workshop, ask the question: where is

    the legal advice that the approach being taught achieves GDPR compliance?
  48. 211.

    Thank You How Can We Help You? A presentation by

    @stuherbert
 for @GanbaroDigital