Compliance of data solutions based on InterSystems technology with GDPR (Europe), CCPA (California) and LGPD (Brazil)
Tags: security, ensemble, database, bpl
Published: 2020-08-07 08:46:00

<h2 style="margin-bottom: 11px;">
  About regulations
</h2>

<p style="margin-bottom:11px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Personal data privacy regulations have become an indispensable requirement for projects dealing with personal data. The compliance with these laws is based on 4 principles:</span></span></span>
</p>
<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Compliance with the rights of the holder of personal data;</span></span></span>
</li>
<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Governance of personal data assets;</span></span></span>
</li>
<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Privacy by Design and by Default;</span></span></span>
</li>
<li style="margin-bottom:11px; margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Data protection.</span></span></span>
</li>
<p style="margin-bottom:11px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>In case of violation in the treatment of personal data, controllers and operators of these data may suffer:</span></span></span>
</p>
<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Fines of up to 4% of revenue or up to €20 million;</span></span></span>
</li>
<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Shutdown of the digital service until the problem is corrected;</span></span></span>
</li>
<li style="margin-bottom:11px; margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Publicity of the incident to the public.</span></span></span>
</li>

<h2 style="margin-bottom: 11px;">
  Take Action
</h2>

<p style="margin-bottom:11px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Administrators, developers and managers of data platforms on InterSystems technology can take the following detailed measures to help comply with personal data protection laws.</span></span></span>
</p>

<h3 style="margin-bottom: 11px;">
  <strong><span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>In compliance with the rights of the holder</span></span></span></strong>
</h3>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Create APIs using Interoperability IRIS ESB for consumption in a Portal for the end user to exercise their rights. The APIs must allow to the holder:</span></span></span> <ul style="list-style-type:disc;">
    <li style="margin-left:8px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Consult the personal data that the controller keeps about the holder. Allow downloading this query in open format (JSON).</span></span></span>
    </li>
    <li style="margin-left:8px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Allow the holder to correct personal data. Use the IRIS ESB to record changes on each system where this personal data exists.</span></span></span>
    </li>
    <li style="margin-left:8px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Implement a consent management service for sharing and processing personal data, especially sensitive data. In the InterSystems Health services the HIPAA is enough.</span></span></span>
    </li>
    <li style="margin-left:8px; margin-bottom:11px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'> Allow the holder to consult with whom their data has been shared.</span></span></span>
    </li>
    <li style="margin-bottom:11px;margin-left:8px;">
      <span style="font-size:11pt;"><span style="line-height:107%;"><span style='font-family:"Calibri",sans-serif;'>Build an interoperability service (ESB) with the internal service system to receive requests from the holder.</span></span></span>
    </li>
  </ul>
</li>

<h3 style="margin-bottom: 11px;">
  <strong><span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>In personal data governance</span></span></span></strong>
</h3>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Catalog persistent classes, productions and BI cubes that store or process personal data. Use XData for this. It is necessary to catalog whether it is personal or sensitive data, purpose of processing, technical and business responsible and for how long the data will be stored.</span></span></span>
</li>
<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Perform good data access management.</span></span></span>
</li>
<li style="margin-bottom:11px; margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Manage the data lifecycle by creating a procedure for disposing of data after the legal custody period.</span></span></span>
</li>
<li style="margin-bottom:11px;margin-left:8px;">
  <span style="font-size:11pt;"><span style="line-height:107%;"><span style='font-family:"Calibri",sans-serif;'>Monitor and audit data flows.</span></span></span>
</li>

<h3 style="margin-bottom: 11px;">
  <strong><span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>In privacy by design and by default</span></span></span></strong>
</h3>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Architect and design persistent objects or namespaces that deal with personal data with:</span></span></span> <ul style="list-style-type:circle;">
    <li style="margin-left:8px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Create a DPIA (Data Protection Impact Assessment) when deals with sensitive data, high volume data, personal profile production and use of new technologies (Machine Learning); </span></span></span>
    </li>
    <li style="margin-left:8px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Use managed key encryption to the sensitive data;</span></span></span>
    </li>
    <li style="margin-left:8px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Use TLS and HTTPS to message channels.</span></span></span>
    </li>
    <li style="margin-left:8px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Add DevSecOps in your DevOps initiative.</span></span></span>
    </li>
    <li style="margin-left:8px; margin-bottom:11px">
      <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Create docker models with security and best practices set by default.</span></span></span>
    </li>
    <li style="margin-bottom:11px;margin-left:8px;">
      <span style="font-size:11pt;"><span style="line-height:107%;"><span style='font-family:"Calibri",sans-serif;'>Include automated tests to security checks.</span></span></span>
    </li>
  </ul>
</li>

<h3 style="margin-bottom: 11px;">
  <strong><span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>In Security Protection</span></span></span></strong>
</h3>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Create an efficient procedure to backup and restore data. The backup must be cryptographed;</span></span></span>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Work your environment in a High Availability;</span></span></span>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Protect your API with IRIS API Management;</span></span></span>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Protect your persistent objects with good authentication and authorization procedures;</span></span></span>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Enable logs and use ESB to log end to end the sensitive operations;</span>

<li style="margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Create Cybersecurity Guide;</span>

<li style="margin-bottom:11px; margin-left:8px">
  <span style="font-size:11pt"><span style="line-height:107%"><span style='font-family:"Calibri",sans-serif'>Create IT Security Guide;</span>

<li style="margin-bottom:11px; margin-left:8px">
  <span style="font-size:11pt;"><span style="line-height:107%;"><span style='font-family:"Calibri",sans-serif;'>Create Data Privacy Guide. </span></span></span>
</li>