Technical guidance for GDPR (including EXM and Sitecore Commerce)

This section describes how you can configure your Sitecore implementation to enable the right to erasure, also known as the right to be forgotten, as described in article 17 of the GDPR.

Your Sitecore xDB implementation stores the interaction history of contacts in the database. You can customize your Sitecore xDB implementation to find and remove an individual’s data from the database.

You use the removeContactPiiSensitiveDataæ pipeline to enable this right. It is up to you, as a developer, to decide where, when, and how to call this pipeline. You can use the pipeline as a background worker process, or in many other ways.

Because it is not possible to remove all personal data from the system if a contact has an active session, once configured by you the pipeline locks the contact before it removes data to make sure that there are no active sessions for the contact.

How the pipeline works

Once configured by you, the pipeline goes through these steps when it runs:

Once configured by you, the Engagement Automation component extends this pipeline to remove all automation states.

A contact becomes read-only after the pipeline has run. If you try to save a contact that has ExecutedRightToBeForgotten set to true, your Sitecore implementation will throw an exception.

Once configured by you, the Contact Segmentation Index component extends the contact and interaction indexing pipelines for live processing to remove data you identify as sensitive data from the search indexes.

The pipeline can also iterate over historical interactions to remove personal and sensitive data if you enable this in the pipeline arguments. The Sitecore.Analytics.Pipelines.RemoveContactPiiSensitiveData.RemoveHistoricalInteractionsPiiSensitiveDataProcessor class iterates over historical interactions, calls the removeHistoricalInteractionPiiSensitiveData pipeline (empty by default) for each of them, and stores interaction to your xDB implementation and schedules them for indexing.

You can extend this pipeline to remove personal and sensitive data. The following example shows a processor you can choose to add to the pipeline to remove personal data stored in the CustomValues collection:

public class DemoHistoricalInteractionPiiSensitiveDataProcessor : RemoveHistoricalInteractionPiiSensitiveDataProcessorBase
{
  public override void Process(RemoveHistoricalInteractionPiiSensitiveDataPipelineArgs args)
  {
    if(args.Interaction.CustomValues.ContainsKey("PersonalData"))
    {
      args.Interaction.CustomValues["PersonalData"] = null;
    }
  }
}

Code example

This example shows how you use the pipeline:

var args = new Sitecore.Analytics.Pipelines.RemoveContactPiiSensitiveData.RemoveContactPiiSensitiveDataArgs(contactId)
{
  RemoveInteractionPiiSensitiveData = //true if there is personal/sensitive data on interaction to remove
};
Sitecore.Pipelines.CorePipeline.Run("removeContactPiiSensitiveData", args); 

Or, alternatively:

corePipelineManager.RunRemoveContactPiiSensitiveDataPipeline(args); //where corePipelineManager is an instance of Sitecore.Abstractions.BaseCorePipelineManager class.

This section describes how your Sitecore implementation can be configured to enable the right to be informed, which may help you meet the requirement that you are transparent about what you collect and how you use it, as described in article 12 and 13, and in article 4, number 11, of the GDPR.

As a developer you can configure your Sitecore implementation to track your efforts to inform end-users about data you collect through your privacy policy.

xDB can be configured to include a collection facet called Privacy Policy Acknowledgement. This collection has an audit trail of if and when a contact has acknowledged your privacy policy. The collection contains this:

The details are:

Namespace: Sitecore.Analytics.Model.Entities

Assembly: Sitecore.Analytics.Model (in Sitecore.Analytics.Model.dll)

Syntax:

/// <summary>
  ///   Allows a class to implement a facet that indicates information about this contact and GDPR.
  /// </summary>
  public interface IGdprStatus : IFacet
  {
    /// <summary>
    ///   Gets or sets a value indicating whether right to be forgotten was executed.
    /// </summary>
    /// <value>
    ///   <c>true</c> if right to be forgotten was executed; otherwise, <c>false</c>.
    /// </value>
    bool ExecutedRightToBeForgotten { get; set; }
    /// <summary>
    ///   Gets a <see cref="IPrivacyPolicyAcknowledgement" /> that indicates an audit trail of when this contact has
    ///   acknowledged the brand's privacy policy.
    /// </summary>
    /// <value>
    ///   The privacy policy acknowledgement.
    /// </value>
    [NotNull]
    IPrivacyPolicyAcknowledgement PrivacyPolicyAcknowledgement { get; }
  }

Code example

This example shows how you use the facet:

Sitecore.Analytics.Model.Entities.IContact contact = // Get Contact
Sitecore.Analytics.Model.Entities.IGdprStatus gdprStatus = contact.GetFacet< Sitecore.Analytics.Model.Entities.IGdprStatus>("GdprStatus");
gdprStatus.ExecutedRightToBeForgotten = true;
Sitecore.Analytics.Model.Entities.IPrivacyPolicyAcknowledgementElement privacyPolicyAcknowledgementElement = gdprStatus.PrivacyPolicyAcknowledgement.Values.Create();
privacyPolicyAcknowledgementElement.AgreementDate = System.DateTime.UtcNow;
privacyPolicyAcknowledgementElement.PolicyIdentifier = "1.0.0";

This section describes how your Sitecore implementation can be configured to enable the right of access, or allowing individuals to see what personal data you’re processing and storing, as described in article 15 of the GDPR requirements, as well as the right to data portability, providing data subjects with a copy of the personal data you have about them, as described in article 20 of the GDPR.

As a developer, you can choose to use the contact repository API to retrieve the full interaction history for the given contact:

Namespace: Sitecore.Analytics.Data

Assembly: Sitecore.Analytics (in Sitecore.Analytics.dll)

Syntax:

public virtual Sitecore.Analytics.DataAccess.HistoricalInteractionsCursorBase GetInteractionCursor(
     System.Guid contactId,
     int visitsToLoadPerBatch,
     System.DateTime maximumSaveDate)

Parameters:

Code examples

This example shows how you use the API:

var cursor = _repository.GetInteractionCursor(contactId, visitsToLoadPerBatch, maximumSaveDate);
var interactions = new System.Collections.Generic .List<Sitecore.Analytics.Model.VisitData>();
while (cursor.HasNextBatch)
{
  interactions.AddRange(cursor.GetNextBatch());
}

This section describes what you must be aware of in the Email Experience Manager (EXM) concerning GDPR.

Pipelines

The removeContactPiiSensitiveData pipeline has a RemovePiiSensitiveExmData pipeline processor. This processor does the following:

The RemoveHistoricalInteractionsPiiSensitiveExmData pipeline processor of the removeHistoricalInteractionPiiSensitiveData pipeline removes any personal data created by EXM for interactions. It changes the email address of the custom values to PII data removed, and changes custom data on page events (first name, last name, and email address) to PII data removed.

Reporting data

The Click and Unsubscribe events are the only events EXM tracks for contacts that have triggered the right to be forgotten. This means that the reporting data for an email campaign appears non-aligned.

For example, if a contact triggers the right to be forgotten in an email message and later clicks a link in the same email message, EXM records the Click event and adds it to the reporting data for the email campaign. However, because the contact has triggered the right to be forgotten, EXM does not track the Open event. Therefore, it is possible that the number of contacts that have opened an email campaign is lower than the number of links clicked for the same email campaign in the reporting data.

Scaled environments

When you configure your EXM implementation to call the removeContactPiiSensitiveData pipeline for the content delivery (CD) role in a scaled environment, the EXM.MASTER database is not cleaned. The same is true for the EXM:WEB database if the removeContactPiiSensitiveData pipeline is called on the content management (CM) role in a scaled environment.

Therefore, after the removeContactPiiSensitiveData pipeline has been called either on a CD or CM instance, you must execute the RemoveSensitiveData pipeline on the other role. For example:

Guid contactId; //Id of the contact
string emailAddress; //Email address of the contact. Only necessary if run on the CM and you want to remove data from the Suppressions table
 
var args = new RemoveSensitiveDataPipelineArgs(contactId, emailAddress);
CorePipeline.Run("RemoveSensitiveData", args, "exm.gdpr");

Support for GDPR provided in Sitecore Commerce 8.2.1 Update3 follows the technical guidance for GDPR described above.

For Sitecore Commerce interaction, Personal Data is collected and stored in two contexts: