GDPR.au3 UDF - Support Topic

[water]

35 minutes ago, mLipok said:

But if you process live person data, even if this is email like jon.smith@company.com , then the GPDR aplly the this kind of data processing.

Correct. Even your IP-address is covered by the GDPR. The term "personal data" is broadly defined.

 

32 minutes ago, mLipok said:

Yes, I agree, but does this legal regulation force the user to apply specific technical solutions in specific situations / cases ?

The GDPR obliges processors to take technical and organizational measures to protect the data. These measures must correspond to the state of the art. This means that e.g. certain encryption techniques no longer offer adequate protection and therefore do not meet the requirements of the GDPR.

Edited October 1, 2020 by water

[mLipok]

15 minutes ago, water said:

DSGV.

?

[water]

Typo and wrong language: GDPR = DSGVO (german: Datenschutzgrundverordnung)

[mLipok]

Hah... .we have GDPR==RODO (polish: Rozporządzenie o Ochronie Danych Osobowych)

 

[TheDcoder]

@water Thanks for clearing up the muddy legal waters (sic), does this mean GDPR only applies to a company/entity which stores and/or processes customer data and not to software which processes the user's data on their behalf on their local computer?

6 hours ago, water said:

These measures must correspond to the state of the art. This means that e.g. certain encryption techniques no longer offer adequate protection and therefore do not meet the requirements of the GDPR.

Very interesting, this is good because it prevents companies implementing easy-to-use but basically useless encryption. By the way, do you think mLipok's UDF meets the "state of the art" requirement?

@mLipok I understand your opinion, but GDPR also allows users to ask companies for their data, so this is more than just a guideline even if we disregard what water said...

Correct me if I am wrong

[water]

5 hours ago, TheDcoder said:

does this mean GDPR only applies to a company/entity which stores and/or processes customer data and not to software which processes the user's data on their behalf on their local computer?

The GDPR applies to companies processing (collecting, storing, computing, transmitting ...) of personal data. It is unimportant whether you process the data digitally or analogue.
So the GDPR is about data not about software.
Details can be found here.

Or you post your questions in this thread

[mLipok]

6 hours ago, TheDcoder said:

I understand your opinion, but GDPR also allows users to ask companies for their data, so this is more than just a guideline even if we disregard what water said..

In the meaining what companies should do ... I think GDPR is a guidelines.
In the meaining what user could do ... it is a law rules.
In the meaining what gov could/should do ... it is a law rules.
 

Edited October 1, 2020 by mLipok

[TheDcoder]

@water That makes sense, thanks for clearing up the doubts

@mLipok Indeed, they can be thought of as guidelines... strict ones at that

12 hours ago, water said:

Or you post your questions in this thread

I think I have done enough to derail the topic, so I will stop .

[mLipok]

11 hours ago, mLipok said:

In the meaining what companies should do ... I think GDPR is a guidelines.
In the meaining what user could do ... it is a law rules.
In the meaining what gov could/should do ... it is a law rules.

39 minutes ago, TheDcoder said:

Indeed, they can be thought of as guidelines... strict ones at that

What I mean here is that for companies there are no exact rules of what and how they have to do to be sure that everything is OK.

@water do you agree ?
 

[water]

The GDPR is always a law. It makes no difference who is affected (processor or data subject).
Guidelines on how to implemwent the GDPR are released by the EDPB (European Data Protection Board) on this site.

To get an overview of the GDPR I suggest wikipedia and a Google search for "GDPR in a nutshell"

[water]

On 10/1/2020 at 5:12 PM, TheDcoder said:

By the way, do you think mLipok's UDF meets the "state of the art" requirement?

I have just downloaded the UDF and had a look at the provided functions. You can encrypt/decrypt strings/files. I know near to nothing about encryption so I can't say anything about the quality of the implementation.
But I'm not really sure how it is different from other encryption/decryption functions you can find on the forum.
And I do not fully understand why this UDF should be more related to the GDPR than other encryption UDFs.

[mLipok]

16 minutes ago, water said:

quality of the implementation.

I do not use specyfic encryption in UDF.

This following function is in Example

Func _Example_Crypter($dBinaryData, $bDataAlreadyEncrypted)

You can wrap your own encryption function and use them with using 
_GDPR_Encrypt_* 
and
_GDPR_DeCrypt_*

functions.

The only one real function is _GDPR_Anonymize_String() and as for now all other functions are WRAPPERS.
So the GPDR.au3 UDF is very flexible.

 

The concept was to give an easy way to do GDRP stuff with function which  will are named/called "GDPR"
In such way you can easily find where "you use compliance measures with GDPR"

Currently in SciTE i just strat typing _GDPR_ and I have menu to choose correct function, reading the code is also easier.

 

Edited October 2, 2020 by mLipok

[water]

But again, what can I do with your UDF that I can't do with other encryption tools?
The GDPR does not mention encryption at all. So I do not see the relation between the GDPR and your UDF.
I could use your UDF to encrypt all kind of data, not just personal data. So I think the name of your UDF is a bit misleading.

[mLipok]

So I should state it like this:
 

Quote

This UDF was created for give any/some kind of support for GDPR solutions in AutoIt.

The only one true "GDPR" function is _GDPR_Anonymize_String() 
I use this in few project to have possibility to create log file which show some of restricted data in anonymized version.

The log file should be anynmous for strangers, but for authorized persons, after reading the source and resulting data, the log must be recognizable.

Otherwise, any anonymised information would be useless.

btw.
Do you think any additional functions can be done in relation to GDPR?

[water]

If you can deanonymize "anonymized" data then it's no full anonymization as meant by the GDPR.
To anonymize data means you replace all data of a person (name, date of birth ...) or all data that can lead to a persion (employee record number, IP-address ...) with other data and this replacement can't be reversed (random numbers etc.).

According to wikipedia: "Data anonymization has been defined as a 'process by which personal data is irreversibly altered in such a way that a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party.'"

 

[mLipok]

So in fact we should delete all data which should be anonymized. In all other cases this has no sens.

If some body say

That xxxxx person who wrote GDPR.au3 UDF.

Then any body who has internet access

could check that this xxxxx person is @mLipok.

 

Or there could not be said anything. 

 

 

Remark:

This is only an example. 

 

Edited October 2, 2020 by mLipok

[mLipok]

Other problem question could I write in log that now currently program is processing data From person identified in DB by index #123674 ?

Could I writer to log That I process pdf file which have GUID in name which is fact related some how, to specific case, and to specific single person ?

 

Edited October 2, 2020 by mLipok

[water]

A legal basis is required for any processing of personal data. This can be a law, a contract, the consent of the person concerned or a legitimate interest of the person responsible.

Personal data in log files are necessary for safe operation. The legal basis for this is legitimate interest.
However, you must ensure that only authorized persons have access to this data and that a process is defined for the evaluation of this data.

 

[water]

13 hours ago, mLipok said:

Other problem question could I write in log that now currently program is processing data From person identified in DB by index #123674 ?

That's pseudonymization and can be a valid measure too. But it is weaker than anonymization.
It depends on the kind of data you process (personal data as described in article 9 or article 10 GDPR) and the legal basis for your processing.

[TheDcoder]

I agree with @water, I don't really see why this UDF is limited to GDPR, it looks like a good general-purpose encryption UDF... maybe @mLipok can turn it into such a thing if he agrees with our view. Renaming everything at this point could be tedious, so maybe we can just stick to the "GDPR" acronym while changing the expansion to "General Data Protection Resource"