GDPR.au3 UDF - Support Topic

[mLipok]

This UDF was created for give any kind of support for GDPR solutions in AutoIt.

Quote

WARNING !!!

BECAUSE THIS PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THIS PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS'' WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

 

#include "GDPR.au3"

#AutoIt3Wrapper_Run_AU3Check=Y
#AutoIt3Wrapper_Au3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6 -w 7
#Tidy_Parameters=/sort_funcs /reel
; #AutoIt3Wrapper_Run_Debug_Mode=Y

_Example()

Func _Example()
    _GDPR_Crypter_Wrapper(_Example_Crypter)
    Local $sText = 'AutoIt v3 is a freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting.'
    MsgBox(0, @ScriptLineNumber, _GDPR_Anonymize_String($sText))
    Local $dCrypted = _GDPR_Crypt_String($sText)
    MsgBox(0, @ScriptLineNumber, $dCrypted & @CRLF & @error & @CRLF & @extended)
    Local $sDecrypted = _GDPR_DeCrypt_AsString($dCrypted)
    MsgBox(0, @ScriptLineNumber, $sDecrypted & @CRLF & @error & @CRLF & @extended)

    _GDPR_Crypt_File(@ScriptFullPath, @ScriptFullPath & '.CRYPTED')
    If @error Then ConsoleWrite('! ---> @error=' & @error & '  @extended=' & @extended & ' : _GDPR_Crypt_File' & @CRLF)
    _GDPR_DeCrypt_File(@ScriptFullPath & '.CRYPTED', @ScriptFullPath & '.DECRYPTED.au3')
    If @error Then ConsoleWrite('! ---> @error=' & @error & '  @extended=' & @extended & ' : _GDPR_DeCrypt_File' & @CRLF)

EndFunc   ;==>_Example

Func _Example_Crypter($dBinaryData, $bDataAlreadyEncrypted)
    _Crypt_Startup()     ; Start the Crypt library.
    Local $dResult
    If $bDataAlreadyEncrypted Then
        $dResult = _Crypt_DecryptData($dBinaryData, 'securepassword', $CALG_3DES) ; Decrypt the data using the generic password string. The return value is a binary string.
    Else
        $dResult = _Crypt_EncryptData($dBinaryData, 'securepassword', $CALG_3DES) ; Encrypt the text with the new cryptographic key.
    EndIf
    _Crypt_Shutdown()     ; Shutdown the Crypt library.
    Return $dResult
EndFunc   ;==>_Example_Crypter

 

Download link:

 

WIKI:
This UDF was added here:  https://www.autoitscript.com/wiki/User_Defined_Functions

 

 

Edited October 1, 2020 by mLipok
added Download link, WIKI remark

[TheDcoder]

Interesting, I thought GDPR only applies to service providers (who store customer data in their own servers), not to software running on personal computers. Kind of pointless if it is required by law for personal computers if there is no data being transmitted.

[mLipok]

GDPR is about data procesing not only transmiting.

 

For example if you have small business and you have e-mail system, invoce program, employers private data, then GDPR perfectly fit to you.

Edited September 29, 2020 by mLipok

[mLipok]

BTW. Why after reading my post and udf you start to think diferrently.. what change comes to you after reading my post ?

My UDF is especially for commercial usage. 

 

[TheDcoder]

@mLipok Thanks for clarification, I was curious and thought your UDF was to make the script/program itself GDPR compliant, but now I realize that it is just an helper UDF to make customer data processing GDPR compliant

Edited September 29, 2020 by TheDcoder

[mLipok]

9 minutes ago, TheDcoder said:

it is just an helper UDF to make customer data processing GDPR compliant

Yes..... More or less. 

It depends on your considerations.

It is to your own responsibility to choose how strong security rules you want to use.

So my UDF is providing any/some kind of support.... Is it fit enought to you?

It is your choose,  your responsibility.

 

 

Edited September 29, 2020 by mLipok

[mLipok]

28 minutes ago, TheDcoder said:

thought your UDF was to make the script/program itself GDPR compliant

Developer must have in the back of head,  that any part of code should be GDPR compilant by default/design.

In this meaning my UDF is set of helper funtions.

But I do not think that any program, which process data is GDPR compliant by itselfs.

.... maybe... Hello World.

All other programs could be GDPR compliant by hard work, tests, dev rules, tools, etc...

Edited September 29, 2020 by mLipok

[TheDcoder]

10 hours ago, mLipok said:

It is to your own responsibility to choose how strong security rules you want to use.

Got it.

10 hours ago, mLipok said:

Developer must have in the back of head,  that any part of code should be GDPR compilant by default/design.

Is this true if the code is not processing any customer data on the developer's computer? I mean, does something like Microsoft Excel fall under GDPR even if it does not process any data on their computers? (file is local to customer's computer)

[mLipok]

For Excel, Access, there are features to use password, so there is security option included.
User have ability to set password.
It is the end user choices to use password ... or not.

Btw.
Even if you have personal computer, with data used in private live, even the fact that entire data (private fotos, email, contacts) are for your private usage, you should encrypt your data !

Why ?
Because if a the thief will steal your computer, then the data no longer are on your pirvate usage !
So you are responsible for data leak !

And do not say but this was my private data.
This was "data for your private usage" but "not your private data", because you have there data which belongs to other people (their data, i.e. photos containing their faces, contacts to friends = their private phone number, their private email adress).

It is like making a VIDEO for Youtube.
You make a movie and you anonymize strangers' faces.

But if you are making a vacation/holiday movie for private use, you will not anonymize these faces with the thought that it will only be on your computer / phone.
But is this computer / phone secured enough to prevent anyone from sharing this content ?

Did you ever wonder/care about that ?

 

[TheDcoder]

@mLipok Not sure if I understood what you are trying to say... personal data protect is good, but I was not discussing it, I was only discussing the legal requirements for GDPR

5 hours ago, mLipok said:

Did you ever wonder/care about that ?

I did wonder, but I am too lazy to use full system encryption on my devices 😪

[mLipok]

1 hour ago, TheDcoder said:

legal requirements to be fine with GDPR

Do you thought this ?

[TheDcoder]

@mLipok Sorry, I don't understand, did you modify my quote? I don't remember saying that.

Maybe I am missing something

[mLipok]

Yes, I was wondering what you mean ?

Here:

6 hours ago, TheDcoder said:

legal requirements for GDPR

do you mean:

Quote

legal requirements to be fine with GDPR

?

[TheDcoder]

@mLipok Ah yes, I was asking about that. Is software like Excel breaking GDPR laws by not encrypting local file content?

[mLipok]

Do you have in Excel any feature to secure this document by using password ?
Do you have brand new version of Excel ?
Do you read entire documentation for Excel in relation to finding GDPR remarks ?

I do not use Excel so I do not know the answer to this question.

If software not use any encryption in process of storing data, then software developer should add remark about this in documentation and send their recomendation to customers.

End user, as a DATA PROCESSOR use many tools, he should know what tools he is using and how secure they are. If they are not secure as he want he must to take action on this.
On of possible action in relation to the Excel question you gave is to store each files on secure for example encrypted drive.

 

Edited September 30, 2020 by mLipok

[TheDcoder]

9 hours ago, mLipok said:

If software not use any encryption in process of storing data, then software developer should add remark about this in documentation and send their recomendation to customers.

9 hours ago, mLipok said:

End user, as a DATA PROCESSOR use many tools, he should know what tools he is using and how secure they are. If they are not secure as he want he must to take action on this.

Are these actual legal requirements of GDPR or are these just guidelines?

9 hours ago, mLipok said:

On of possible action in relation to the Excel question you gave is to store each files on secure for example encrypted drive.

Yes, but this is not related to the software... this is an action performed by the user.

[mLipok]

1 hour ago, TheDcoder said:

Are these actual legal requirements of GDPR or are these just guidelines?

In my personal opinion, GDPR is basically a kind of guidelines.

1 hour ago, TheDcoder said:

Yes, but this is not related to the software... this is an action performed by the user.

As I said:

Quote

In my personal opinion, GDPR is basically a kind of guidelines.

If software developer in relation to GDPR give you a clear signal,
"You are on your own with protecticng files (data store) "

Then it is your own responsibility what you do.
What's more, the GDPR makes it clear that the responsibility rests with the end user (the customer buying a software solution for the company's needs). It is the end user who must check and ensure that the data to be processed are processed in a proper way (at every stage of processing).
f the software vendor does not meet the company's security levels (company requirements), the company must adapt, e.g. by changing the software vendor or changing its own data security procedures and techniques.

But in this regard, it is possible that other members of this forum with corporate experience could say more, or even verify my statements.

Maybe @water or @TheXman will be tempted to verify my last statement.

 

[water]

I'm responsible to implement the GDPR in my company.

The GDPR is a legal regulation of the EU to be implemented directly. This means that no implementation in national law is necessary.
The GDPR is not a recommendation, but a law that you have to comply with since May 2018.

The first question you have to ask yourself is not a technical question (do I use Excel ...), but the question of whether the GDPR is applicable at all. I.e. if you only process technical data, then the GDPR does not apply.

[mLipok]

4 minutes ago, water said:

if you only process technical data, then the GDPR does not apply.

But if you process live person data, even if this is email like jon.smith@company.com , then the GPDR aplly the this kind of data processing.

Correct?

 

Edited October 1, 2020 by mLipok

[mLipok]

6 minutes ago, water said:

The GDPR is not a recommendation, but a law that you have to comply with since May 2018.

Yes, I agree, but does this legal regulation force the user to apply specific technical solutions in specific situations / cases ?