Privacy Policy

Introduction

• The General Data Protection Regulation (GDPR) introduced stricter rules for the storage of personal data.
• Transparent processing
  • Why,
  • for what purpose
  • How long is information processed?
  • What paths do the data take?
  • How is data stored and protected?
• Basic data protection principles

The right to be forgotten

• Describes that personal data must be deleted immediately if the purposes for processing no longer exist (Art. 17 para. 1 GDPR).
• The obligation to delete data exists, for example, upon termination of an employment relationship.

Exceptions to the obligation to delete data and retention periods

• Existing exceptions are regulated by the GDPR (Art. 17 para. 3 GDPR).
• Retention period for evidence of potential claims for damages
• Tax-relevant data
• For determining the profit of businesses
• Regarding pension commitments

Principles of data minimization and data migration

• The principles of data economy and data minimization must be applied when storing personal data.
• Different retention periods for different data

Directory of processing activities

• A data deletion concept must always be in place for data processing (Art. 30 para. 1 f) GDPR)
• Example of health data (sick notes)

Special exceptions

• Permanent storage due to possible prior employment

Introduction

When using mobile devices in a business context, we believe three aspects should be given particular consideration:

1. The end device: What types of end devices are there, who uses them, who pays for them, and what connectivity does the device have?
2. Management and Support: Who controls the device (Mobile Device Management / MDM or Enterprise Mobility Management / EMM) and who is responsible for support (policies)?
3. Integration and apps: How closely is the device integrated with the company (network / collaboration, audio-video applications / file sharing) and how important is it for carrying out daily tasks (catalog of business / personal applications and their limitations)?

Even before the rise of mobile work and home office arrangements, companies faced the challenge of securely integrating a multitude of devices into their daily operations. Adhering to data protection requirements presents a particular challenge in this context.

Terminology

Low level of control

• BYOD (Bring Your Own Device
• CYOD (Choose Your Own Device)

High level of control

• COPE (Company Owned / Personally Enabled)
• COBO (Company Owned / Business Only)

Why separate private and business data?

• Mobile operating systems require an account with the manufacturer (Apple, Google or Microsoft).
• User-installed apps cannot be controlled.
• Personal data from the company becomes accessible (manufacturers and apps)
• Data separation via container or mobile device management

Data in US clouds

• Example WhatsApp (data protection-compliant use requires the consent of all contacts before use and a data processing agreement with the provider and all third parties). Use in a professional context is usually not possible.

Restrict app permissions

• Restrictions on data access to mail, calendar, tasks, addresses and notes
• The user is responsible; there is no control.

Solutions for individual users

• Container/sandbox, e.g. HCL Verse App
• Updates and settings are the responsibility of the user; no control is provided.

Separate apps

• Container solutions (e.g., Samsung MyKnox)
• Multiple user accounts (Google accounts required)

Solutions for companies

• MDM (Mobile Device Management)
• EMM (Enterprise Mobility Management)
• Unified Endpoint Management Tools (August 2021, Gartner) https://www.microsoft.com/security/blog/2021/08/31/microsoft-a-leader-in-2021-gartner-magic-quadrant-for-unified-endpoint-management-tools/
• Jamf (Apple) https://www.jamf.com/de

Data protection in application development under HCL Notes/Domino

HCL Notes/Domino, as a collaboration tool, provides an environment in which extensive data – including personal data – is stored and processed. Therefore, the Notes/Domino work environment is necessarily subject to data protection compliance measures within the company.

A key feature of HCL Notes/Domino, besides its out-of-the-box functionality such as email, is the option to develop and implement custom applications on the platform. Its design as a collaboration environment particularly facilitates the creation of workflow scenarios that document individual activities. Consequently, application development using HCL Notes/Domino falls within the purview of data protection officers.

A particular characteristic of developing or customizing company-specific applications is that data protection compliance must be considered on two levels. Firstly, how is the necessary data security ensured in the intended end product, which is to be used productively? Secondly, how is the use of necessary data secured within the development process itself?

To achieve the desired development goal, the Notes/Domino platform offers a comprehensive set of tools for regulating data access. These include, but are not limited to:

• Server-level security setting
• Application-level access control (ACL) including role management
• Control of author and reader permissions at the entry level
• Digital signatures

Furthermore, automation can be used to control the time-limited provision of data.

It is advisable to specify security-relevant aspects and the intended solutions as early as the planning phase. Which data will be available to whom and when? How will legal and compliance aspects be implemented? If the company has a data protection management system, new requirements can be incorporated early on. Typically, the initial concept is fine-tuned as the project progresses agilely, culminating in the pilot phase.

The developer, who often acts as a service provider to implement the requirements, plays a special role. Therefore, they are not a company member involved in internal compliance. Nevertheless, they need comprehensive access to the data to implement the requirements, which are specified, for example, in a requirements specification.

Data protection is therefore a pervasive issue throughout all phases of application development. Even in the planning phase, it is necessary to define terms according to GDPR Article 4, such as "controller," "processor," "processing," or "pseudonymization": How does the commissioning "controller" provide the "processing" developer with existing data for the purpose of analyzing the requirements: anonymized, pseudonymized, or as raw data?

During the actual development and testing phase on a test system, dummy data can be used, ensuring GDPR compliance. Nevertheless, those involved have structural insights into the accessibility of the data in later production operation. This necessitates considering the security of the test system in the security design.

With the transition to productive implementation and piloting, real-world data is processed within the application. It is crucial to audit whether the previously defined security features are in place. This applies not only to application users but also, and especially, to administrative and support staff. It must be ensured that the necessary tasks are technically feasible and that compliance with the framework established by the GDPR, the German Federal Data Protection Act (BDSG), and company-specific regulations is maintained.