GDPR Considerations for IBM Connections

Philadelphia, April 26-27 2018
13
GDPR Considerations
for IBM Connections
Jan Valdman, Whitesoft
@jan_valdman

PLATINUM SPONSOR
GOLD SPONSORS
BRONZE SPONSORS
GOLD PLUS SPONSOR
SILVER SPONSORS
SPEEDSPONSORING BEER SPONSOR

Social Connections 13 Philadelphia, April 26-27 2018
13
GDPR – What the hell it is?

EU regulation 2016/679
• Effective on May 28, 2018
• Regulates cross-border processing and
limit recipients of personal information
• Huge administrative fines
• 2M Euro or 4 % or global annual turnover

Does GDPR Apply to Me?
• Doing business in EU?
• Having an office in EU?
• Processing data of EU citizens?
YES

Main GDPR terms
• Data subject
• Personal data
• Controller
• Processor
• Consent
• Lawfulness of processing
• Safe processing

New duties for controllers and processors
• Allow only lawful personal data processing
• Inform data subjects about processing
• Data protection by design and by default
• Keep records of processing activities
• Ensure security of processing
• Notify data subject on defined occasions
• Contract between controller and processor

New rights for subjects (articles 12-22)
• Transparency
• Right of access by the data subject
• Right of rectification
• Right to erasure (to be forgotten)
• Right to restriction of processing
• Right of data portability
• Right to object
• Automated individual decision making incl. profiling

13
GDPR vs. Privacy Shield

Privacy Shield
• Successor of Safe Harbor, an agreement
between EU and USA since August 2016
• US companies can do self-assessment and
register at Federal Trade Commission
• EU-approved “codex” which allows US
companies to process data of EU citizens
according to EU implementing decision
2016/1250

If you are Privacy Shield compliant
• Then you are a safe destination for EU
personal data
• But you have still comply to the rest of
requirements for … and processors
• “Privacy Shield is a jumpstart to GDPR”

13
Running IBM Connections under
GDPR – new duties

ESN vs Privacy
• Not the best setup ever 
• What personal data you process?
• Profiles
• The rest (user generated data) is equal to any
shared drive
• Which lawful reasons do you reference to?
• Minimalize personal data processing (!!)

Identify what personal data you collect
• Check attributes in Profiles
• Coming from LDAP via VMM
• Self entered by users
• Automatic profiling: Social Network Graph
• Add “technical” data
• From IHS logs (IP addresses, mobile OS, …)
• From WAS logs

Identify reasons for lawfulness of processing
1. Legitimate interest of the controller
2. Consent of the data subject
• Onboarding manager (logon page)
• Create records of processing activities

Identify processors or other recipients
• Your IT suppliers (IBM business partner)
• IBM support (for PMRs)
• Your daughter/sister/mother companies
• Work with your lawyers or DPO
• Update your contracts according article 28

Inform subjects
• Display required info somewhere
• Log-on screen
• Page header/footer

13
Security of Processing

What does it mean?

Secure the infrastructure
• OS (passwords, firewall, updates, etc.)
• WAS (encryption everywhere, roles, certs)
• IC (role mappings, reverse proxy, APIs)
• HIS (https configuration)
• TDI (LDAP connection)
• The pink stuff

Backup & restore
• You do backups, right?
• Now you must have DRP and regularly
test it

Security audits
• You are required to check your “secure
processing” regularly

Problematic areas
• Encryption of files on IC server (data at
rest) is not possible
• Consider also NFS sharing between IC, Docs,
Search, Viewer
• My drive – replication of files to desktops is
not manageable
• No insight who replicates what content to what
computers

13
Coping with the rights of subject

Transparency
• Usually no problem in B2E

Right of access
• Users can easily access all their data in
IBM Connections (people centric system)

Right to rectification
• Potential issues in data pulled from
enterprise databases via TDI
• Not our problem 

Right to erasure - to be forgotten
• We can delete/deactivate/rename users
easily
• @mentions can cause trouble
• Check you IP arrangements with
employees or other kinds of users

Right to restrict processing
• This may be a potential issue how the
organization uses and leverages content
including personal data
• Check well your Connections T&C for
users

Right to data portability
• Often referenced as “data takeout”
• Does it make sense for ESN?
• Export all personal data in a “common”
format

Right to object
• Not specifically related to any tool or
technology

13
Audit tools
(for Connections on premises)

Why we need them
• Controllers (and processors) are required
to keep records of processing activities
and to be able to proof secure
processing
• Provide useful insight also in GDPR-
unrelated situations
• Demanded by our customer

What is available
• Almost nothing
• Vantage for IBM Connections by Actiance
(discontinued?)
• Customizable WAS logs + IHS logs
• WAS auditing
• IC databases

Related tools
• panagenda Connections Expert (CE) +
DataMiner
• Infoware DPS and GDPR scanner?

Connections Audit Tools
• We decided to build our own tool
• It reads data from DB2 database
• Provides information up to 12 months old
• Supports Connections V5 - V6

Audit questions
What is an
overall
system
activity?

Audit questions
What did an user do recently in Connections?

Audit questions
Who accessed a given piece content?

Audit questions
Is there any specific content?

Thank You!
Jan Valdman
jan.valdman@whitesoft.eu
+420 603 590 152
Contact me if you want to learn more
about WhiteCAT
Many thanks to people who helped me to discuss and validate my findings and ideas.

GDPR Considerations for IBM Connections

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to GDPR Considerations for IBM Connections

Similar to GDPR Considerations for IBM Connections (20)

More from LetsConnect

More from LetsConnect (20)

Recently uploaded

Recently uploaded (20)

GDPR Considerations for IBM Connections