Saturday, July 1, 2017

Need For Compliance With GDPR Is Beyond Any Organization's Control

When non-European organizations first heard of the General Data Protection Regulation (GDPR), they may have understood it as a European regulation only - and therefore considered it not to be applicable to their business. However, looking closer, it became clear that GDPR applies to all organizations worldwide doing business with European residents.

Again, many organizations who do not offer their goods and services to European residents concluded they will not be affected. Wrong!

Let's assume the following scenario: It's 2018, and a local bank in Vermont (USA) offers, beside other banking services, mortgages to home owners in the region. Tim S. recently bought a new home which the said bank financed. As it happens in real life, Tim today accepted an attractive professional assignment in Europe for one year. Since he will work abroad only for a limited period of time, he decided to keep his house in Vermont. Tim accordingly continues to pay his mortgage, has a neighbor to take care of his house during his absence and looks forward to enjoying his home after his return.

Impact on Tim's bank in Vermont: During the time of his assignment in Europe, Tim will be a European resident and therefore be protected by the GDPR, or - in other words - the GDPR is applicable to Tim's bank in Vermont.

Conclusion: The above scenario demonstrates that the need to comply with the GDPR is beyond (almost) any organization's control and that it solely depends on where their clients decide to reside - the customer is king.

[Legal disclaimer: This blog post is not intended to be legal advice, but to raise awareness that consulting a lawyer is recommended.]

Sunday, June 4, 2017

GDPR Necessitates a Professional Data Modeling Tool

In his recent article Data governance initiatives get more reliant on data lineage info, David Loshin pointed out that "data lineage management offers a compelling scenario for improving the data governance process". Loshin distinguishes two aspects to Data Lineage, one structural and the other related to data flows which I characterize as follows:
  • Structural Data Lineage - mapping and tracking semantic data objects (and their synonyms) throughout the organization from elements of conceptual and logical schemas to their physical occurrences in databases
  • Dynamic Data Lineage - mapping and tracking the flow of semantic data objects (and their synonyms) from their sources, through the processes and data stores of the organization to downstream consumers.

In my post How The GDPR Can Propel An Organization's Informational Infrastructure I mentioned that recording Data Lineage is implicitly required by multiple regulations, most prominently the General Data Protection Regulation (GDPR).

Let's bring this to life using an example scenario of the not so distant future:

Thomas, an EU resident, is client of the online retailer xyzAnywhere Corp. which communicates with Thomas usually by email, but occasionally chooses to send him promotional letters by post mail. Thomas receives some of xyzAnywhere's promotional mail at his current residential address (as shown in his online profile), but also still some of their letters via mail forwarder as they are sent to his previous home. Thomas exercises his right granted by the GDPR to request a copy of the entire personal data that xyzAnywhere Corp. holds about him.

Upon receipt of that copy, Thomas realizes that the information provided to him does not include his previous residential address at all.

Regardless of how the communication between the customer and the organization may continue and leaving aside whether and how regulatory authorities will consider the case and penalize the organization, we can conclude that the organization failed to comply with GDPR (Art. 15), as it did not make the complete set of the customer's "personal data undergoing processing" available.

How could the organization have avoided to fail?

By employing a professional data modeling tool that especially
  • Features the creation of a business data dictionary where all semantic data objects can be uniquely named and well-defined for the entire organization
  • Supports to map and trace all synonym occurrences that may exist throughout the organization related to a data dictionary entry
  • Serves to represent a model of Master Entities and their physical distribution.

The data modeling tool SILVERRUN fully supports the above criteria and helps you to build a solid foundation for Data Model Management, Master Data Management and Data Governance.
 
Below please see how SILVERRUN reports Structural Data Lineage which would have helped in the above example scenario to identify all database columns that constitute synonyms e.g. of the data dictionary item "person last-name" and thus define the data model needed to systematically extract all personal data related to a particular customer.
 
Click to enlarge
















To be clear:  Links between a data dictionary item (glossary entry) and its synonyms can only be created by "brainware", not by software (alone) since the semantics behind any data object has to be understood first. However, with human guidance, SILVERRUN can integrate the puzzle pieces that may be available through reverse engineering of databases, importing spreadsheets, reusing existing models and accessing other sources of documentation. 

Once integrated, the resulting data model constitutes the solid ground to build a future-proof Master Data Management system and to flexibly respond to regulatory requirements as e.g. stipulated by the GDPR.

[In the spirit of full disclosure: I represent Grandite, the supplier of the SILVERRUN tools for data and process modeling.]

Thursday, April 6, 2017

How The GDPR Can Propel An Organization's Informational Infrastructure

I concluded my recent post "GDPR - More Than Just Another Regulation" stating that the GDPR (General Data Protection Regulation) forces organizations to prioritize a long-due overhaul of their informational infrastructure. 

In my understanding, a contemporary informational infrastructure is a system of people, processes and tools that covers the five business disciplines represented in the image below whereas each level builds on the lower one.

Due to my observations, a vast number of organizations find themselves in the status where upper management hopes to advance level 4 and 5 to get the edge over the competition while business departments still struggle with the quality of level 3 due to a lack of foundation in level 1 and 2.

How does that relate to an organization's capability to comply with the GDPR? 

The sole purpose of the GDPR is the protection of an individual's rights as the owner of their personal data. However, since personal data are at the core of almost any business and even any business transaction, the GDPR's provisions imply a certain informational infrastructure. 

For example, GDPR grants any individual ("data subject") residing in the EU a far-reaching control over its personal data records throughout the complete data life cycle with an organization, i.e. control over Create, Read, Update and Delete of its personal data. 
  • Create: The creation of records requires the data subject's explicit consent [Art. 6 et al.]. 
  • Read: The data subject has the right at any time to know the total scope of captured and stored metadata and values related to its personal data [Art. 15 et al.] and to object to processing of its data for certain purposes [Art. 21 et al.].
  • Update: The data subject has the right to rectify its personal data [Art. 16].
  • Delete: The data subject has the right "to be forgotten", i.e. its personal data to be deleted upon demand [Art. 17]. (Note: The data subject can only exercise this right, if there is no other legal obligation for the controller to retain the data subject's personal data, e.g. the obligation to document (recent) commercial transactions with the data subject.

Although the provisions of the GDPR do not explicitly mention any infrastructural measures as of level 1 and 2, it is obvious that the controller can only comply with the rights of the data subject, if the whereabouts of the data subject's personal data are completely transparent at any time, i.e. if the controller employs
  • a data model of the personal data (that shows all the references and physical storages of personal data throughout the organization) [prerequisite for rectification and deletion] 
  • a map that shows all the information flows of personal data (data flow diagram, process model) through the organization [prerequisite for information about the usage purposes and potential objection] 
  • a functioning Master Data Management system that maintains "golden" records of personal data (or at least keeps possibly multiple records in sync) [prerequisite for rectification and deletion] 
  • a functioning Data Governance system [prerequisite to comply with the GDPR in general] 

Organizations should welcome the GDPR as they will profit from these measures far beyond the purpose of complying with this regulation...

Monday, April 3, 2017

GDPR - More Than Just Another Regulation

It has become all too common that business initiatives targeting infrastructural improvements such as Enterprise Architecture & Business Modeling, Data Governance & Master Data Management, Privacy & Data Protection are put on the back-burner or are totally suppressed in favor of endeavors that promise monetary benefits in the short term.

Accordingly, few organizations are really prepared for a timely response to requirements imposed by law or by industry-specific regulatory authorities. Considering the usually moderate fines for non-compliance and potentially little other consequences, delayed reaction and acceptance of the risk to eventually be hit by the proverbial stick have become an element of business calculation.

When conceiving the General Data Protection Regulation (GDPR), the European Union (EU) obviously anticipated that a non-negligible number of organizations would be reluctant to comply rather than making reasonable efforts. EU lawmakers have therefore replaced the penalty stick with a sledgehammer right out of the gate (May 2018). In plain English, the EU's powerful message says: 

"If you, the organizations of the world, process personal data of our people, you have to respect the provisions of the GDPR, otherwise we will hold you accountable with fines of EUR 20 million in minimum, while in return we apply the same rules to our organizations when it comes to the treatment of the personal data of your people."

Not emphasizing nations or ideologies, but simply putting people first, is not only a strong political statement, but a directive that will change the way how business will be done in the foreseeable future. It is a contemporary way of saying "the customer is king" while forcing organizations to prioritize the long-due overhaul of their informational infrastructure. 

Too bad that we need lawmakers to remind us of what should have been common sense in the first place.