The post-GDPR post

The latest update from Kim on Umbraco and GDPR

Written by Kim Sneum Madsen

Presumably like you, GDPR has now become part of our routine. Before its initiation, we had announced a series of initiatives in regard to Umbraco and GDPR - so what’s the status? Have these initiatives been put into action? And what have we learned from them? Kim has got a GDPR aftermath update for you:

Remember this: the last day before GDPR came into effect. Many a person had announced that the world would go under and we all would die. Death by GDPR. But we did not die. Perhaps it was because of the modern dancer performing the GDPR text at the Codegarden 2018 bingo, or more likely; it did not happen because we all were pretty well prepared and had given the topic attention.

And here we are, six months after, allowing me to make some comments on our experience with GDPR:

If you are using cloud then you know that we have a DPA. Most customers have accepted that. Other customers, typical governmental or large corporations, would like us to use their own DPA. I think that it should not be the order of the day that the customer dictates how the supplier handle their legal obligations. I do understand that a customer prefers to have one DPA across all suppliers. That is perfectly legitimate. However, we, the supplier, have the same preference (alone from scaling reasons). And since it is the supplier’s prerogative to determine how they want to sell, we find that it is up to the supplier to determine how the DPA is constructed. Therefore we have given a friendly push back to customers wanting us to make separate DPAs. But all in all, a positive experience without much drama.
We have introduced GDPR in our onboarding program for new employees ensuring that basic knowledge is acquired and that procedures and principles are internalised.
Brexit is very much up in the air. Where it ends is still unclear. What we know is that the British Government have announced how they see the world with regards to Data security aka GDPR. This regardless of “deal or no deal”. In either case, UK companies should be fine by storing data in EU. With regards to Umbraco Cloud, we store data in EU outside of UK. So both UK and the 27 remainers are fine with present set-up on Umbraco Cloud. We will continue to follow this issue closely.
We have had four people asking for deletion of hers/his data. Our procedure was initiated and we had data deleted in good time within the stipulated time frame (see our Right to be Forgotten policy). Remember that a request for deletions needs an answer within 30 days and data has to be deleted in back-ups as well.
We have introduced a biannual GDPR revision policy. We have just finished the first after the introduction of GDPR. The revision included:

Checking that we still have all relevant data mapped
Remove systems and delete data that are not in use anymore
Adjusting our MO to new rulings by the data authorities.

The overall conclusion after six months with GDPR is that it has improved the thinking around privacy. Further, I conclude that GDPR is here to stay :-), meaning that we as others continuously need to work with this as rulings and processes around this is not at a standstill.

For all our GDPR related initiatives, please visit our dedicated page on this topic.

And if you missed the Codegarden GDPR dance performance (or just want to re-watch it) here it is:

Written by Kim Sneum Madsen

Umbraco and GDPR I

Why the focus on GDPR

Because it’s necessary. As I’m sure you all know, the deadline for GDPR is coming up in 4 months’ time (25th of May 2018). GDPR have had many faces, it has been seen as unnecessary, been feared, perhaps even detested and many other not so nice things. And admittedly, it sounded like a big scary beast – initially.

But as with so many other things, once we dive into it, it’s not all that bad. It requires work - perhaps quite a lot. But it will also generate a better culture around data security. There are still many uncertainties. This is somewhat unchartered territory and law is not an exact science. Things are still not 100% clarified and how some things end up are still to be determined.

So please continue reading with this disclaimer in mind.

Umbraco and GDPR

As discussed in great length on O ur, it is as much a processual question as a technical question. The rules GDPR replaces/supports obviously vary from country to country, but for Umbraco, residing in Denmark, the rules don’t change that much as they are more or less the same as the current Danish ones.

During our work with Umbraco and GDPR we found that the big difference from the old rules, is that now, companies have to document that they have data security/protection under control.

So, to put things into a relatable context, the GDPR change resembles the case when lorries and busses were fitted with tachographs thus, documenting the vehicle’s speed, distance and the driver’s working hours. The rules of rest/driving were the same as before the change. The new thing was that the driver now had to document that he was complying within the law. It’s the same story with Umbraco and GDPR.

GDPR at Umbraco falls into 4 categories:

1. The products – CMS and Forms

As described in the discussion on our, it is already possible to use Umbraco CMS and Forms and be compliant with GDPR. However, that doesn’t mean it can’t be made simpler. Thus, we are working on making it simpler to use the CMS and Forms and comply.

These are the areas we are working with:

General API for "logging of consent" which can provide a simple way of registering that a person has given consent of any given action. This will allow for reporting and querying of an audit trail for consent for a person/action.
More detailed logging of user actions in the back office since as part of GDPR it should be possible to find out who has done what. For instance: "User X has given User Y permission to section Z"
The ability to mark Members and Form properties as 'sensitive'. If these are marked as sensitive, the values will not be displayed in the back office to any user unless they are part of a User Group that has been flagged to be able to read sensitive data.
Forms will have an option to not store values at all in its default data store which will allow developers to use the Form’s workflows to store the form data in their own custom data store.
You will have the ability to export a member's saved data as a file.

We will release these improvements successively. All of them will be available in updates expected no later than end February, allowing you time to implement the upgrades.

2. Umbraco Cloud

Because the Umbraco CMS and Forms are part of Umbraco Cloud, the above goes for Umbraco Cloud as well.

We are a data processor; we are data processing your data, but we don’t know what data you are storing or whether this is protected data. Therefore, we treat all data as if they were protected. Hence, we have made a so called Data Processor Agreement (DPA) assuring that we as a data processor comply to the rules and regulations (this DPA will be available end January 2018).

Many lawyers have given their version of how such a DPA should look like and whether it should be physically signed by each and every individual customer/user one has. The consensus seems to be that it satisfies the rules if the company issues a general DPA allowing the customers/users in return to document that their supplier is complying thus, themselves are complying. Further, the agreement has to reflect that how to implement Umbraco Cloud is entirely in our customers’ hands. Finally, as Umbraco Cloud is a standard product there are limited, if any, room for variations in how we treat the data. In other words, it has to be a standard DPA otherwise it doesn’t scale for us.

At Umbraco we have made this DPA and it will be linked to our general Terms and Conditions hence, clients can download it and document that they are compliant. We expect to have it finalised by our legal counsel within a few weeks.

3. Getting DPA from our own suppliers

As we are using suppliers for many things we need to document that our suppliers have their data processing in place. We started out by mapping what data we hold, what systems we have (ERP, Mail system, salary system etc.) and whether we were data controller and/or data processor.

Once in place we appointed a person responsible for each system. He/she is responsible for collecting relevant DPA’s ensuring that the storing of data is with a relevant purpose, that it is revised/deleted on a regular basis etc.

For the analog systems (yes we receive physical letters/applications from time to time) we also need to have the data security in place - including a paper shredder 😊

Umbraco CEO shredding paper

4. Applying best practice and improving the data security culture

The fourth area we’re working on is to constantly improve our methods, standards, process etc. so we at any point in time are applying best practice. This includes, but is not limited to; making sure we have two factor authentication, relevant purpose for having any given data access, encryptions where relevant, pseudonymization/anonymization, signed confidentiality agreement by all staff etc.

We, as others, need to establish and follow not only best practice but also actively work for a culture that ensures that data are looked after and handled as it should be. We have a history of transparency on this field as far as goes for our products and services. We will continue this work.

Keep yourself updated on the latest initiatives by Umbraco on GDPR on this page.