How SMW can be used to fulfill documentation requirements posed on organizations by the General Data Protection Regulation

1. www.kdz.or.at
Data Cockpit:
SMW as GDPR
compliance tool
Bernhard Krabina

2. www.kdz.or.at
Talks at SMWCon 17 and EMWCon 18
 https://www.semantic-
mediawiki.org/wiki/SMWCon_Fall_2017/Data_Management_in_
Organizations_with_SMW_-_fulfilling_GDPR_requirements
 https://www.mediawiki.org/wiki/EMWCon_Spring_2018/Media
Wiki_and_the_European_GDPR

3. www.kdz.or.at
GDPR:
General Data Protection Regulation
12. Dezember 2018 · Seite 3
 Effective from May 25, 2018
 No need for legal implementation in Member states
 Article 30 Records of Processing Activities
 records shall be in writing, including in electronic form
 shall make the record available to the supervisory authority on request
 Privacy Impact Assessments, Data Breach Notification

4. www.kdz.or.at
Your options?
 Use office tools to
create paper
 Create tons of
documents and
throw a DMS at
them
 Buy an oversized
GDPR tool
 Use a smart
SMW
installation
12. Dezember 2018 · Seite 4

5. www.kdz.or.at
The solution: Data Cockpit
 www.datencockpit.at = project web site
and the solution itself (example content)
 to be used inside your organisation (PC,
internal network, cloud service)
 Users: Controller, Data Protection Officer,
employees…
 Open source thanks to a grant by netidee.at

6. www.kdz.or.at
Features
 Information/Communication
 overview of the legal texts, using of MW version history for
version changes in legal texts
 management of „practical questions“
 news, events, current information regarding data protection
 discussions
 glossary
 GDPR documentation requirements
 Records of Processing Activities
 Privacy Impact Assessment
 Right of Access
 Right to Rectification/to Erasure
 Data Breach Notification

7. www.kdz.or.at
Content

8. www.kdz.or.at
Checklist for
usage of the data cockpit

9. www.kdz.or.at
Legal texts

10. www.kdz.or.at
GDPR article 30: records of processing activities

11. www.kdz.or.at
Practical questions
regarding article 30
Discussion

12. www.kdz.or.at
List of practical questions and their status

13. www.kdz.or.at
Details of a practical question

14. www.kdz.or.at
Record of a processing activity

15. www.kdz.or.at
Data breach documentation

16. www.kdz.or.at
Simple form based input

17. www.kdz.or.at
Overview per user:
tasks, comments, records…

18. www.kdz.or.at
First results
 to our knowledge only open source solution
for the GDPR
 400+ downloads
 small, but nice community
 docker version
 German legal text instead of Austrian
 hosting option (Sabine, Karsten)
https://www.wikiahoi.at/dsgvo/
 VirtualBox version (Alexander)
 still looking for partners (legal
experts, GDPR consultants) …

19. www.kdz.or.at
Why is it the perfect use case?
 EVERY organisation in the EU is affected!
 Strengths of SMW in full action
 Structured data alongside textual information
 Import and export of data
 Collaborative editing, seamless information and communication
 GDPR example shows the potential for other
legal/organisational knowledge domains
 It‘s not too late: many organisations have still not implemented
GDPR
 Outlook
 Upgrade from MW 1.27 to MW 1.31 LTS, SMW 3.x
 Replace SemanticComments with CommentStreams
 Some small improvements

20. www.kdz.or.at
Contact
krabina@kdz.or.at ahoi@wikiahoi.at