Salesforce & GDPR: What happens next?

FORCEWEST BREAKFAST
18 JULY 2018
SALESFORCE & GDPR
WHAT HAPPENS NEXT?

Introduction
Stephan Chandler-Garcia
Salesforce Practice Lead & Architect - Methods
Founder - GDPR Superheroes
@SGarcia421
@GDPRSuperheroes
/in/stephanwgarcia
UK Public Sector
User Group

GDPR & Personal Data
Data
Processor
Data
Controller
Data
Subject

Personal Data
any information relating to an identified or identifiable natural person;
Online Identifiers
IP Address
Cookies
RFID Tags
Direct Identifiers
Name
Contact Details
ID Number
Location Data
Indirect Identifiers
Physical
Physiological
Genetic
Mental
Economic
Cultural
Social Identity

Processing
Any operation or set of operations which is performed on personal data or
on sets of personal data, whether or not by automated means, such as
collection, recording, organisation, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination,
restriction, erasure or destruction.

Profiling
Any structured set of personal data which are accessible according to specific
criteria, whether centralised, decentralised or dispersed on a functional or
geographical basis.

The Right
to
Rectification
The Right
of
Access The Right
to
Erasure
The Right
to be
Informed
The Right
to Restrict
Processing
The Right
to
Object
The Right
to Data
Portability
The Rights
In relation to
Automated
Decision
Making and
Processing

Article 6
Lawfulness of
Processing

Requirements
1. Consent
2. A Contract
3. Vital Interests
4. Legal Obligation
5. A Public Task
6. Legitimate Interest
Article 6
Lawfulness of
Processing

Principles
1. Purpose Limitations
2. Storage Limitations
3. Data Minimisation
4. Accuracy
5. Right to Erasure

The Right to Erasure
Individuals have a right to have personal data
erased in specific circumstances:
1. It is no longer necessary in relation to the purpose for which it was
originally collected/processed;
2. when the individual withdraws consent;
3. when the individual objects to the processing and there is no overriding
legitimate interest for continuing the processing;
4. when the personal data was unlawfully processed;
5. when the personal data has to be erased in order to comply with a legal
obligation; or
6. when the personal data is processed in relation to the offer of information
society services to a child.

How has this played out?
The calm before the storm
1. The media ‘frenzy’ was very short lived
2. Enhanced awareness
3. Temporary Solutions

Results
Companies spent months scrambling to prepare for this, what
has been the result?
1. Some acted on bad legal advice
2. Lots of lost data
3. Wait and see

Lawsuits
There have been a few big-name lawsuits filed already. What do
they actually mean?
1. The are mostly PR
2. Individuals do not have the right to press charges

Salesforce Changes
Platform Changes
Salesforce have made changes to their platform to aid compliance
1. The Individual Object… more on that shortly!
2. Internal Logging
3. Apex Method for User Deletion & more to come

Salesforce Changes
The Individual Object
A New Standard Object!
1. Must be Enabled
2. No Storage Limits
3. Related to Contact, Lead, Person Account, &
User by Default

Post-GDPR
Whats Next?
1. Emerging Regulations
a. E Privacy Regulation
b. California Consumer Privacy Act
2. the GDPR ‘rebrand'

Resources
Where can I find more information?
GDPR Superheroes - GDPRSuperheroes.com
Information Commissioner's Office - ico.org.uk
Data Privacy Manager - elements.cloud/dpm

Salesforce & GDPR: What happens next?

More Related Content

What's hot (15)

Similar to Salesforce & GDPR: What happens next? (20)

More from Desynit (8)

Recently uploaded (20)

Salesforce & GDPR: What happens next?