Dacia - Data Anonymization

General Description of the Feature

The feature focuses on enhancing the system’s data anonymization capabilities, specifically tailored for Dacia’s requirements under GDPR. The feature ensures that sensitive customer data is anonymized efficiently and in compliance with legal standards. This process involves several key updates to the database structure, user interface, and the data processing workflow.

• GDPR Report Generation: Users can now generate a GDPR report that includes all data linked to a specific business partner. This report consolidates information across various entities and file paths. The action is subject to a cooldown period, which is managed by a setup key (AllowGDPRReportHoursAfterIssueDate), ensuring the report can only be regenerated after a specified time frame.

Anonymization Process

Manual Anonymization

A new action allows users to mark a business partner for data anonymization. Once marked, the business partner is processed in a job, which can run monthly, that anonymizes all relevant data fields and entities linked to the BP. This process ensures that data is anonymized according to GDPR standards, protecting sensitive information from unauthorized access.

Automatic Anonymization

1. The system automatically triggers the anonymization of data based on specific business rules. These rules consider various factors such as the age of invoices, offers, or contracts associated with the business partner. The anonymization process is executed by a scheduled job (OneFire) that updates the status of the business partner to “To be Anonymized” once the process is finished.
2. Then, a second scheduled job is triggered (DB Jobs) anonymizing all the configured fields from all the entities of the respective Business Partner and updates the status of the business partner to “DB Anonymization Completed” once the process is finished. Fields that should be anonymized are configured directly in the database from the relevant team.
3. After the database anonymization is complete, the system initiates a final step to delete all associated file paths in DSW, marking the business partner as “Anonymization Completed.” This ensures that no recoverable data remains within the system.

Rules for Automatic Anonymization

The update introduces several hardcoded rules that automatically trigger the anonymization process for business partners. These rules ensure that data is anonymized at the appropriate time, based on the type and age of related documents. The rules include:

• Invoice-Related Rule:

  • If a business partner has an invoice linked to a Retail Lead or Multi-Unit Sales Lead, the system schedules anonymization 86 months after the document's creation date. This extended period allows for the retention of data as needed for business operations while ensuring eventual compliance with GDPR.

• Marketing Opt-In Rule:

  • If a business partner has opted in for marketing communications (Marketing Opt-In = YES), the system identifies the latest Retail Lead or Multi-Unit Sales Lead and schedules anonymization 36 months after the creation date of the most recent document. This rule balances the need for retaining customer engagement data with the requirements for data minimization under GDPR.

• Offer and Test Drive Rule:

  • For business partners with an Offer or Test Drive Contract related to a Retail Lead or Multi-Unit Sales Lead, the system schedules anonymization 3 months after the creation date of the most recent document. This shorter retention period reflects the typically transient nature of these interactions.

• Disinterest and Marketing Opt-Out Rule:

  • If a business partner is marked as not interested (Not Interested) and has opted out of marketing communications (Marketing Opt-In = No), the system identifies the most recent entity (Retail Lead, Multi-Unit Sales Lead, or Inquiry) and schedules anonymization 1 month after the creation date. This rule ensures that disinterested customers' data is promptly anonymized, minimizing unnecessary retention.

Glossary

Logging and Monitoring

The system includes comprehensive logging mechanisms that track which specific rules were applied during the anonymization process. These logs provide transparency and ensure that the anonymization process is fully auditable, allowing quality assurance teams to verify that the correct procedures were followed for each business partner.

Business Benefit 

This update ensures that Dacia’s data handling practices are fully compliant with GDPR, enhancing customer trust and reducing the risk of data breaches. By automating the data anonymization process, the system minimizes manual effort and ensures that sensitive information is anonymized in a timely and consistent manner, thereby improving overall data security and compliance.

Configuration 

Business Cases

• 14010 -     GDPR Report

Setup Keys

• AllowGDPRReportHoursAfterIssueDate: Indicates after how many hours the creation will be available again. The default value is 1 hour.

Services

• OneFire: ~/BusinessPartner/InitializeDataAnonymization

Additional Information