Antti Heimola's presentation about test data challenges and GDPR

1. © Qentinel Group 2017 PUBLIC 1
GDPR and Test Data Challenge
Antti Heimola (Kalle Huttunen) 4.5.2017, Test Automation Clinic

2. © Qentinel Group 2017 PUBLIC 2
Purpose
of the presentation is to highlight some things to be done, before May-
25, 2018, because General Data Protection Regulation (GDPR) will
replace Data Protection Directive (1995). Test data management is
one of the topic to be taken care of.
“The primary objectives of the GDPR are to give citizens and residents
back control of their personal data and to simplify the regulatory
environment for international business by unifying the regulation within
the EU.”
https://en.wikipedia.org/wiki/General_Data_Protection_Regulation

3. © Qentinel Group 2017 PUBLIC 3
Main Differences 1995  2018
1. Personal Data Redefined
• Broader definition: mobile device identifiers, social identity, economic status, etc.
2. Individual Rights
• Right to access
• Right to be forgotten
• Terms of agreements (may) need to updated
3. Data Controllers vs. Data Processors
• DPD - only data controllers were held accountable
• Data Protection Officer (DPO) may need to be appointed
• Data protection policy and data processing activity record (>250)
• Impact assessments in case of high risk of data breach
https://britishlegalitforum.com/wp-content/uploads/2017/02/GDPR-Whitepaper-British-Legal-Technology-Forum-2017-Sponsor.pdf

4. © Qentinel Group 2017 PUBLIC 4
Main Differences 1995  2018
4. Information Governance and Security - Privacy by design
• Privacy of data collected is taken into account at all steps of business processes
• Impact assessments for automated data processing activities
5. Data Breach Notification and Penalties
• Notification of a personal data breach within 72 hours
• Penalties 4% of the global turnover, or 20M€
• lacking consent to process data or violating privacy by design
• Penalties 2% of the global turnover
• records not in order or not notifying the supervisory authority
6. Global Impact
• Company that markets goods/services to EU residents can be subject to GDPR
https://britishlegalitforum.com/wp-content/uploads/2017/02/GDPR-Whitepaper-British-Legal-Technology-Forum-2017-Sponsor.pdf

5. © Qentinel Group 2017 PUBLIC 5
Common Test Data Management Problems
• Production data is too big to copy, slow, and expensive
• Test data is not available at the speed needed in agile
development and DevOps
• Data in test environments are shared and that makes test results
unreliable
• Production data is sensitive and cannot be used

6. © Qentinel Group 2017 PUBLIC 6
Used solution
Production data is too big to copy, slow, and expensive
• Use subsets of production data
 Finding and selecting subsets is time consuming
 Test coverage is not as good as with full data

7. © Qentinel Group 2017 PUBLIC 7
Used solution
Data in test environments are shared and that makes test results
unreliable
• Follow process where certain data is reserved for certain people/project
 If process is not followed, it is easy to mess up test results
 Refresh not possible when wanted
• Follow process where whole environment is reserved people/project
 If process not followed it is easy to mess up test results
 Limits people/projects that can test in parallel
 Refresh not possible when wanted

8. © Qentinel Group 2017 PUBLIC 8
Used solution
Production data contains sensitive information
• Limit access to certain persons that have hard NDAs
 Only these persons can perform testing
• Use synthetic test data (subset of anonymized data)
 Synthetic test data is not as good as real data
• Masking production data
Data integrity can suffer if design not done properly

9. © Qentinel Group 2017 PUBLIC 9
Solutions used today are not optimal
• Expensive
• Limiting speed of testing
• Limiting volume of testing
• Limiting test coverage
• Limiting use of effective use of test automation and CI/CD
• Affecting reliability of test results
• Generating additional manual work
• GDPR non-compliance

10. © Qentinel Group 2017 PUBLIC 10
Penalties
Data
portability
Right to be
forgotten
Items for the Discussion Session
Privacy
by design
Plan for data
security
breaches
Obligations
as a Data
Processor
How to manage test data
Readable and
understandable
user agreements
Right to
access
Data
Controller
obligations
Impact
assessment
Need for
DPO
Rights of data
subjects – how to
deal with difficult
individuals

11. © Qentinel Group 2017 PUBLIC 11
ContactQentinel Group
www.qentinel.com kalle.huttunen@qentinel.com