<< Click to Display Table of Contents >> Navigation:  General Functions > Contacts (People) > General Data Protection Regulation (GDPR) Right to be Forgotten

General Data Protection Regulation (GDPR) Right to be Forgotten

 

The MIE supports the GDPR concept of an individual’s right to be forgotten.  Each individual whose request has been approved is entered into the MIE via the GDPR Assignees to forget screen.  This is available as a submenu to the Assignees left menu option in the Asset Management tab.

 

To cause an assignee to be “forgotten”, you must select the person from the drop-down list, check the Active box, AND the Date request was accepted must be filled in.  Once this has been filled in the next HouseKeeping job will obfuscate the pieces of information in the assignee’s record that could be used to uniquely identify the individual.  Namely, the following columns will be targeted for obfuscation:

 

In the assignees table:  first name, last name, email address, global login ID, cell phone number

In the user’s table:  User’s name

 

In the Company Info screen there is a setting Allow recovery of GDPR/obfuscated data.  This setting is off by default.  If it is set on, the obfuscated data will be preserved, in AES 256 encrypted format, in an archive area, inaccessible to the general MIE.  The primary purpose of this setting is to preserve the original data in the event of future legal discovery requirements. 

 

Once data is obfuscated, it is not recoverable within the MIE.  The assignee record will still be there, the user’s account will still work (for the most part), however the information about the assignee that could be used to uniquely identify that person will be replaced with placeholders.

 

Since the email address is one of the data elements obfuscated, assignees that have invoked the GDPR’s right to be forgotten will no longer be able to participate in MIE workflows or any notification the MIE would normally send to them via email.