Considerations for GDPR readiness
Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients' business and any actions the clients may need to take to comply with such laws and regulations.
The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. IBM does not provide legal, accounting, or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.
Table of Contents
1. GDPR
2. Product Configuration - Considerations for GDPR Readiness
5. Data Storage
6. Data Access
GDPR
General Data Protection Regulation (GDPR) has been adopted by the European Union ("EU") and applies from May 25, 2018.
Why is GDPR important?
- New and enhanced rights for individuals
- Widened definition of personal data
- New obligations for processors
- Potential for significant financial penalties for non-compliance
- Compulsory data breach notification
Product Configuration - Considerations for GDPR Readiness
Offering Configuration
The following sections provide considerations for configuring Predictive Insights to help your organization with GDPR readiness.
Data Life Cycle
What is the end-to-end process through which personal data go through when using our offering?
- What types of data?
Predictive Insights does not target personal data. Instead it targets performance management metrics that measure performance of some underlying hardware. For example telecommunications machinery, application infrastructure.
The product has a set of agents (called mediation packs) that target popular 3rd party and IBM performance management solutions. None of these target personal data.
IBM Tivoli Netcool/OMNIbus provides authentication and handling of system users.
Netcool/OMNIbus processes the Types of Personal Data listed below:
- Authentication Credentials (such as user names and passwords)
- Basic Personal Information (such as contact names to record event assignment to an owner)
- Technically Identifiable Personal Information (such as device IDs, usage based identifiers, IP address, etc. - when linked to an individual)
This offering is not designed to process any Special Categories of Personal Data.
Personal data used for online contact with IBM
Predictive Insights clients can submit online comments/feedback/requests to contact IBM about Predictive Insights subjects in a variety of ways, primarily:
- Public comments area on pages in the Predictive Insights community on IBM developerWorks
- Public comments area on pages of Predictive Insights documentation in IBM Knowledge Center
- Public comments in the Predictive Insights space of dWAnswers
- Feedback forms in the Predictive Insights community
Typically, only the client name and email address are used, to enable personal replies for the subject of the contact, and the use of personal data conforms to the IBM Online Privacy Statement.
Data Collection
Predictive Insights utilizes Netcool/OMNIbus to collect the types of personal data listed below:
- Authentication credentials (such as username and password)
- Contact name (only when using ObjectServer or file-based repository for authentication - note: best practice is to use an external repository, such as LDAP, for user management)
Data Storage
Predictive Insights leverages capabilities in Netcool/OMNIbus to store personal data. A Db2 instance is used to store performance management data, which does not contain any personal data.
Storage of account data
Usernames and passwords can be managed in a number of ways with Netcool/OMNIbus. Users can be authenticated against an ObjectServer, an external repository such as an LDAP directory, or a file-based repository (maintained by Websphere Application Server). For ease of user administration, it is recommended that users are centrally managed using the organizations central directory service. For more information about how to configure Netcool/OMNIbus to use an external directory service as an authentication source, see: Configuring user authentication.
Storage of client Data
The primary data processed by Netcool/OMNIbus relates to event data which, depending on the deployment environment, could be data that belongs to you or originates from your end client's environment. Netcool/OMNIbus provides role and group based access controls as well as restriction filters for controlling access to the live event data. For more information, see: Managing authorization with users, groups, roles, and restriction filters.
Storage in backups
The ObjectServer supports data persistence by using checkpoints and logs to copy the data in memory to disk. You can use this feature to recover the data after a planned or unexpected shutdown occurs. These files are written to the local filesystem and maintained automatically by Netcool/OMNIbus.
In addition, the ObjectServer is provided with a set of default triggers to automatically backup the ObjectServer to a defined location on a user defined period and to maintain a user specified number of backups before overwriting. These can be configured using the automatic_backup_system trigger group. For more information, see: ALTER SYSTEM.
As the backups are writing to a filesystem (either local or network mounted) access control to the backed up data iscontrolled by the permissions configured on the filesystem.
Storage in archives
Events that have been cleared may be configured to be sent to a historical event archive. For this data, access controls will depend on the RDBMS to which the data is archived and to any reporting solution connected to the database for later processing of the historical event data.
Data Access
Roles and access rights
Predictive Insights leverages Netcool/Omnibus for data access of personal data.
Netcool/OMNIbus provides a number of roles for controlling access to the application and its data. The roles enable differentiation between normal users and those with extra privileges. For more information about how the ObjectServer stores data, see: Default Tivoli Netcool/OMNIbus roles .
For more information about user access and roles for the Web GUI component, see: Supplied roles.
Logging is maintained for diagnostic and support purposes.
For more information about how to configure logs in Predictive Insights, see: Log files created.
Data Processing
Encryption in motion
Netcool/OMNIbus can be configured to use SSL communications for data transferred between components. For more information, see: Using SSL for client and server communications.
The Web GUI component uses the https protocol for browser requests by default. For more information about how you can configure the Web GUI component, see: Securing the Web GUI environment.
Encryption at rest
The system passwords that are used for inter-process authentication can be encrypted. More information is available in the following documentation:
For more information about how to encrypt the Web GUI password, see: Encrypting Web GUI passwords.
For more information about running the ObjectServer in secure mode, see: Running the ObjectServer in secure mode.
For more information about encrypting passwords in UNIX nco_sql scripts, see: Encrypting passwords in scripts.
The ObjectServer database checkpoint and rollback logs are not encrypted. If this is required, you should consider filesystem level encryption.
The optional backups of the ObjectServer database that are created with the automatic_backup_system trigger group are not encrypted. If this is required, you should consider filesystem level encryption for the filesystem that the backup is written to.
Data Deletion
Predictive Insights depends on Netcool/OMNIbus for client deletion.
Client Data deletion
Removal of users from either the ObjectServer, file-based repository or external directory service will prevent the user from logging into Netcool/OMNIbus. It will not remove the users' data (e.g. name) from active or historical events as there is an ongoing need from an operational/audit perspective to maintain this data. However, as part of your deployment, you should review the period for which data is archived, backups are stored, and logs are maintained. This helps you to ensure that they are reasonable and meet your operational needs.
Account Data deletion
Where Netcool/OMNIbus is being used in a managed service environment and a single deployment is being used to manage events from multiple end customers (tenants), you need to consider the processes for onboarding and offboarding and what mechanisms need to be in place to remove a tenant's data, e.g. use of distinct event archive databases per tenant.
Data Monitoring
Predictive Insights using Netcool/Omnibus to monitor personal Information. Personal data in Netcool/OMNIbus is limited to:
- Basic Personal Information (e.g. user names for authentication)
- Technical Personal Information (e.g. IP addresses/hostnames from systems used by the user to access the solution and potentially captured in debug/trace logs).
Where events are assigned between users this will typically be recorded in the journal record for the event. Netcool/OMNIbus can be configured to audit access to specific objects or actions performed by specific groups of users in audit logs, as previously mentioned.
Log files are not encrypted. If log files need to be archived for operational/audit requirements then consideration should be given to encrypting any archived logs.
Responding to Data Subject Rights
The Personal Data stored and processed by Netcool/OMNIbus falls under the following categories:
- Basic Personal Data (e.g.user names and passwords that are used for authentication and Name/ID to show ownership of an event)
- Technically Identifiable Personal Information (such as IP addresses and host names to which user activity could potentially be linked).