GDPR Compliance for Your Datastore

* What is the GDPR and what does it actually mean for your business?
* What are your options for storing data — including not storing information and securing it?
* What are some of the hands-on steps to take for example with logs that your applications are collecting?

The General Data Protection Regulation (GDPR) is changing how you can handle data in Europe. But what does this actually mean? The first part of this talk gives an overview of the implications of GDPR, which affects every software project with a European relation. That includes users' right to see, edit, and export their data, the right to be forgotten,... The second part takes a look at what this means for actual software projects with the specific use-case of logging. The main focus here is how to stay GDPR compliant while still being able to use the data for security and operation aspects.

Disclaimer: This talk does not replace legal advice or a deeper examination of the topic. It is just a general overview.

Transcript

4. Who likes GDPR? @xeraa
5. Who is afraid of GDPR? @xeraa
6. “Can you recommend a GDPR expert? Yes! Great, can you give me their email address so I can contact them? No.” https://twitter.com/wardrox/status/988363811479572483 @xeraa
7. Questions: https://sli.do/xeraa Answers: https://twitter.com/xeraa @xeraa
8. General Data Protection Regulation Adopted 2016/04/14 Enforceable 2018/05/25 @xeraa
9. Datenschutz- Grundverordnung Fines up to 4% of global revenues or €20m @xeraa
10. Where & Who? EU organizations Services or goods for / monitoring of EU citizens @xeraa
11. What? Personal Data Any information relating to an identified or identifiable natural person @xeraa
12. Rights? to be informed access rectification @xeraa
13. Rights? erasure (to be forgotten) restrict processing data portability @xeraa
14. Rights? object automatic decision making @xeraa
15. PS: Personal data in a blockchain is an issue @xeraa
16. Lawful use of data? Informed consent Contractual obligation Legitimate interest @xeraa
17. Lawful use of data? Legal obligation Vital interests Public task @xeraa
18. Proof Required Right to collect and legally use @xeraa
19. Disclosure Within 72 hours to a member state’s "supervisory body" @xeraa
20. Legacy Data Stop, Check, Delete @xeraa
22. What if no legal grounds? @xeraa
23. “More GDPR bizarro world logic. Log nothing, but also make sure to have a complete understanding of all your security breaches, track them down, patch them up…. with no logs.” https://twitter.com/ianlandsman/status/997561351009599488 @xeraa
24. 1. Stop Your Service @xeraa
27. @xeraa
28. @xeraa
29. @xeraa
30. @xeraa
31. 2. Drown them in forms @xeraa
32. https://twitter.com/rianjohnson/status/999730569641525248
33. 3. Pseudonymization @xeraa
34. Anonymous No information that could potentially identify an individual Not considered Personal Data by GDPR @xeraa
35. Pseudonymous Re-identification possible if combined with additional information Without this information, re- identification practically impossible @xeraa
36. When? Ingestion time Search time @xeraa
37. Developer @xeraa
39. @xeraa
40. @xeraa
42. fingerprint { method => "SHA256" source => ["ip"] key => "${FINGERPRINT_KEY}" } mutate { add_field => { '[identities][0][key]' => "%{fingerprint}" '[identities][0][value]' => "%{ip}" } } mutate { replace => { "ip" => "%{fingerprint}" } } @xeraa
43. How Secure Are Hashes? Without salting @xeraa
44. “You might think it would take a long time to run through all of the possible SSNs, but computers are very fast — there are "only" one billion possible SSNs, so your laptop can hash all of them in less time than it takes you to get a cup of coffee.” https://www.ftc.gov/news-events/blogs/techftc/2012/04/does-hashing-make-data- anonymous @xeraa
45. “Datafinder – Reverse email hashes for $0.04 per email” https://freedom-to-tinker.com/2018/04/09/four- cents-to-deanonymize-companies-reverse-hashed- email-addresses/ @xeraa
47. Access Control & Encryption @xeraa
49. Deletion @xeraa
50. “Interesting #GDPR solution for the "right to erasure" : Encrypt all user's data and when you have to delete it you just get rid of the private key. Will this become the norm?” https://twitter.com/Stephan007/status/985103374118014976 @xeraa
51. “[...] personal data of our users can only be persisted when it is encrypted. Each user has their own set of keys [...] it reduces the impact of leaking a dataset, since the dataset by itself is useless — attackers also need the decryption keys. [...] it allows us to control the lifecycle of data for individual users centrally.” https://labs.spotify.com/2018/09/18/scalable-user-privacy/ @xeraa
52. Conclusion @xeraa
53. Data Protection The new standard and norm of approaching personal data @xeraa
55. I am not a lawyer @xeraa
56. ❤ GDPR and carry on @xeraa
57. @xeraa
58. Questions? Philipp Krenn̴̴̴̴̴̴@xeraa @xeraa