The new General Data Protection Regulation (GDPR), soon to become law in Europe, presents a couple of challenges for organizations that store customer data with their ECM systems. As proposed, the new EU data protection regime extends the scope of the EU data protection law to all foreign companies processing data of EU residents.
It provides for a harmonization of the data protection regulations throughout the EU, thereby making it easier for non-European companies to comply with these regulations; however, this comes at the cost of a strict data protection compliance regime with severe penalties of up to 4% of worldwide revenue. After dialogue negotiations between the European Parliament, the European Commission and the Council of Ministers, there is general consensus on the wording of the GDPR and also the financial penalties for non-compliance.
The two points to consider are the aforementioned need for organizations outside of Europe to comply with the regulation and the proposed “right to forget”. This provides individuals the right to have all data and references to the data removed from an organization’s files. Although the GDPR is not scheduled to go into effect until May 25, 2018 and may be revised up until then – it’s not too early to start thinking about how it might affect your ECM system.
ECM systems store document files in several ways
- Each document in a separate file
- Multiple documents in a single file, with all the objects needed to render the file in the document sub-object
- Multiple documents in a single file with all the objects required to render the file consolidated into a catalog-like object
The “right to forget” can be translated to erasure of all data, documents and meta-data that contains personally identifiable information. This is significantly different than the laws in North America, where the concern is more about data protection and prevention of release than it is about erasure.
Erasure of meta-data, or indexes to documents in an ECM system, although straight-forward and relatively simple in practice, is not enough to comply with the regulation. Even though it might be argued that once the index to a document is deleted the document can never be found, deleting just the index is not sufficient to comply with the regulation.
Removing documents and indices form a system that store individual files is a simple, straight-forward exercise but, many content system do not store documents as separate files. This is done for a variety of reasons, such as conservation of space, reduction of storage costs and ease of file migration and maintenance.
If the multi-document file method is used, the challenge is that of removing the one document the requires deletion, while maintaining the integrity of the file so the remaining documents can still be reliably accessed.
Fortunately, there are tools and methods available that will enable the ECM system owner to create process and procedure in accomplishing the goal of becoming GDPR compliance. More about that in our next post.
This is part of a series of blog posts on GDPR. Read them all!
