Sitecore, personal data and General Data Protection Regulation (GDPR)

Question

Across Europe new privacy legislation has been introduced; GDPR.

In a nutshell it says that the following are the responsibility of not only the customer but also the supplier:

• Seeking consent from data subjects where personal data is stored on their behalf
• Providing robust processes and tools to enable the “right to be forgotten” (i.e. data about an individual must be able to be completely deleted, and evidence produced that this has been done)
• Setting out clear, unambiguous retention periods for the data we store, and a defined business need for retaining specific types of data
• Reporting breaches if and when they occur

The legislation is in force now but will be enforced from May 2018 with significant fines applied in cases of non-compliance or breach.

Indeed in the sectors the company I work for (mostly Government and Charities) we're seeing this crop up more and more in RFP documents.

This has a potentially large impact on Sitecore's personalisation and the xDB going forward.

So finally to my question(s):

Does anyone have an idea of what Sitecore road-map is for GDPR? So I can explain back to customers how Sitecore will deal with this.

Are any partners looking at this at the moment? Both in terms of how Sitecore can be compliment now (perhaps purging users from xDB) or thinking about using pseudonymisation?

Finally is anyone aware of a detailed guide of what Personally Identifiable Information Sitecore stores in XDB out of the box

Big broad sweeping question, but one our InfoSec crew are increasingly curious about.

---

Update for Sitecore 9

The right to be forgotten - fulfilled by Sitecore 9 by allowing anonymisation of a contact - it will delete all personal identifiers for the user but keep an anonymous record.

Opt-outs - There is a solution to remove a contact from all email lists now (without removing them from service emails - password resets etc.)

Personal information - You can add an attribute for PII contact details now which stops it being indexed and searchable.

Reference

https://www.codehousegroup.com/insight-and-inspiration/biz-stream/how-upgrading-to-sitecore-9-can-help-compliance-with-gdpr

https://www.sitecore.net/resources/index/white-papers/siteco‌​re-and-gdpr

Update for Sitecore 6, 7, 8

Reference

https://www.sitecore.com/resources/index/white-papers/gdpr-compliance-with-your-sitecore-implementation

Answer 1

A big question, so I will answer just a slice of it, what Personally Identifiable Information IPII) does xDB store out of the box. I'm tempted to say nothing: as an implementer, you have the option to identify a contact, and to tag that contact with information via the contact facet mechanism. xDB ships with predefined facets for personal information such as name and email, and this is extensible so you can add facets to record whatever information you like. But this requires customization. Sitecore provides the data storage and API.

What Sitecore xDB will do out of the box is create a visitor cookie to track that device over time (SC_ANALYTICS_GLOBAL_COOKIE). The API provides a mechanism to "identify" the visitor, by tagging it with an arbitrary string value, such as an email address. Identifying a visitor allows XDB to link this cookie to other visitor cookies with the same identification, which in turn enables sharing personalization, analytics, and session state. Again, this requires an API call.

Without developer setup, Sitecore xDB records each page visit associated with the visitor cookie. Since Sitecore 8.1, IP addresses are hashed, and there is a configuration option to suppress retention altogether, or to select the hashing mechanism. See Sitecore's documentation on IP hashing.

Answer 2

There are several areas which you need to cover if you want your Sitecore solution to be GDPR compliant. The list below is prepared for typical Sitecore XP implementation with common modules like WFFM and EXM.

1. Secure personal data in rest and in motion

This covers database encryption and securing the communication. You will find a lot of useful information, how to secure your production environment in Sitecore 9 installation guide.

Sitecore stores personal data in:

• Core database, if you use membership tables to store users profiles.
• SQL Forms/WFFM db (if you use WFFM with SQL provider). Sitecore saves every submitted form to db, but you can disable this behaviour in forms settings, if you don't want to save personal data from the form fields.
• xDB in Collections:
  • Identifiers, for example if you use email address as an identifier.
  • Contacts. For identified contacts it contains facets like: Personal, Emails, Addresses, etc, but also IDs from List Manager in Tags.Entries.ContactLists (for example EXM opt-in and opt-out list).
  • Interactions, for example EXM events (open email, open landing page, etc) contain data used for placeholders like first name, last name and email address. Also you should check if personal data is not used in url (in query string parameters) cause it may all be tracked by Sitecore and stored in the collection.
  • AutomationStates, for campaings triggered by EXM, Sitecore stores recipient email addres here in CustomValues.ScExm.Email.
  • FormData (if you use WFFM with MongoDb provider) Sitecore will store submitted forms data in this collection.
• Sitecore Analytics index: Sitecore keeps copy of xDB data in Sitecore analytics index. Analytics index is used in list manager, list of contacts in experience profile, or reports in EXM.
• Reporting database, Contacts table contains Identifiers (in ExternalUser column) and IDs of lists from List Manager (in ContactTags column).

Sitecore 9 note: You can mark data as sensitive by using [PIISensitive] attribute on facets and facet's properties. Such data will be removed if you call ExecuteRightToBeForgotten method for a contact, but also it will prevent Sitecore from indexing the data.

2. User rights

• Right to be forgotten

  Sitecore 8 prior 8.2 Update 7: Sitecore doesn't have documented API to remove data from MongoDB, but you can rather easily delete the data using standard MongoDB .Net provider shipped with the platform.
  For updating Analytics Index you can use https://github.com/vhil/helpfulcore-analytics-index-builder, or use Sitecore.ContentSearch API to search and remove documents from the index.
  If you removed user from list manager (there's no point to keep anonymous users without email address in the list), you will also need to update recipients count in list item using ListManager<TContactList, TContactData> class to keep your data consistent.
  Additionally you need to update Contacts table in SQL Reporting database for ContactId equals _id from Contacts collection.
  
  Sitecore 8.2 Update 7: You can execute new pipeline introduced in this version:

  var args = new Sitecore.Analytics.Pipelines.RemoveContactPiiSensitiveData.RemoveContactPiiSensitiveDataArgs(contactId);
  Sitecore.Pipelines.CorePipeline.Run("removeContactPiiSensitiveData", args);
  

  You can also look at RemovePiiSensitiveFacets processor in Sitecore.Analytics.config if you want to remove your custom facets.
  
  Sitecore 9: you can call ExecuteRightToBeForgotten method from XConnectClient class: https://doc.sitecore.net/developers/xp/xconnect/xconnect-client-api/contacts/right-to-be-forgotten.html

• Right to data rectification

  You should allow the user to change personal facets in Tracker.Current.Contact.
  Alternatively in Sitecore 8 you will need to directly call ContactManager and ContactRepository to lock and update contact.
  
  In Sitecore 9 you can use xConnect API to modify contact data: https://doc.sitecore.net/developers/xp/xconnect/xconnect-client-api/contacts/set-contact-facet.html

• Right to be informed

  For every version you need to implement custom message box where you inform the users about their rights and your privacy policy.
  
  Sitecore 8 prior 8.2 Update 7: you need to implement custom facet to store audit trail of when the contact acknowledged the organization's privacy policy.
  
  Sitecore 8.2 Update 7: you can use built-in GdprStatus facet to store privacy policy acknowledged info.
  
  Sitecore 9: ConsentInformation facet will be the good place to store privacy policy acknowledged info.

• Right to data portability

  Sitecore 8 prior 8.2 Update 7: You can extract all the data form xDB Contacts and Interactions collections using Mongo .Net driver and export it to Json.
  
  Sitecore 8.2 Update 7: You can call new method in ContactRepositoryBase to export visits:

  var contactRepository = Sitecore.Configuration.Factory.CreateObject("contactRepository", true) as Sitecore.Analytics.Data.ContactRepositoryBase;
  var history = contactRepository.GetInteractionCursor(contactId, visitToLoadPerBatch, maximumSaveDate);
  

  
  Sitecore 9: You can use xConnect API to export contact data: https://doc.sitecore.net/developers/xp/xconnect/xconnect-client-api/contacts/export-all-contact-data.html

3. Limit access to user personal data in Sitecore back-office

Personal data in Sitecore can be accessed in:

• Experience Profile (list of contacts and contact details)
• User Manager (if you use membership db to store user profiles)
• Forms/WFFM (submitted form reports and data export)
• List Manager (list of contacts and data export)
• Email Experience Manager (email preview and recipient activity report)
• Marketing Automation (view contacts for active campaigns)

To restrict access you can simply change security settings for those applications in Core db under:

/sitecore/client/Applications

and for launchpad buttons under:

/sitecore/client/Applications/Launchpad/PageSettings/Buttons

For WFFM reports, you will need to change security settings for ribbon button as well:

/sitecore/content/Applications/Content Editor/Ribbons/Contextual Ribbons/Forms/Form/Forms/Form Reports

4. Personal data retention

There is not much OOTB. For Sitecore 9 you can only remove sensitive data using right to be forgotten: https://doc.sitecore.net/developers/xp/xconnect/xconnect-client-api/deleting-data.html
For Sitecore 8, you can use ADM module to remove old data from xDB: https://marketplace.sitecore.net/en/Modules/Analytics_Database_Manager.aspx

---

Check out following blog articles for in-depth analysis of:

• GDPR and Sitecore in general
• GDPR and WFFM/Forms
• GDPR and EXM

Answer 3

Just to say I am looking at GDPR legislation as well and Sitecore has some interesting features that aid compliance some of the notable ones are:

• Since version 8.2 IP addresses are already anonymised and are hashed, or there is the option not to save the IP address at all

• With XDB there is a way to find and remove personal data that's been collected

• EXM support double opt in and verification of identify

• Built in configurable audit logs to prove data has been added, updated or deleted

• Data exchange framework for integration with other systems can be a powerful way to synchronise changes