Timeline for Testing using real data of the customer
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 5, 2020 at 17:26 | vote | accept | Seeker001 | ||
| May 23, 2019 at 11:16 | comment | added | Kevin McKenzie | @NielsvanReijmersdal The vagueness is a large part of the problem; a lot is left up to the interpretation of local authorities. Your lawyers may be willing to take chances; ours weren’t. | |
| May 23, 2019 at 8:40 | comment | added | Niels van Reijmersdal | @Rsf Probably yes. I have an opinion on those questions, but the regulation does not give the answers. It is probably different for each team, company, industry and risk profile of the application itself. It might be a burden, but I strongly think your statement that the GDPR does not allow usage of personal data is false. The intent is you are aware of processing it lawfully in a way that protect people's privacy. Temporary using data for testing purposes is probably not unlawful nor does it increase privacy risks. You do need to implement appropriate measures. Some of which you describe. | |
| May 23, 2019 at 8:15 | comment | added | Rsf | @NielsvanReijmersdal What are you saying- that unanonymized user data can be used for testing without their explicit consent ? what would you do if someone asks for details of the information you hold about them? if someone asks for the information to be deleted ? if you have subsidiaries outside of the EU ? it's a lot of burden on the team and company both operationally and legally | |
| May 23, 2019 at 7:37 | comment | added | Niels van Reijmersdal | @KevinMcKenzie Why does it state legitimate interest in the regulation if it doesnt care about it? AINAL, but when I talk to our lawyers I am often surprised how flexible and pragmatic they interpret the GDPR. Also I am surprised how strict most non lawyer people interpret it and its intent. I am fine with making a copy, test something, destroy the copy, in some cases. The regulation itself does not state you cannot do that, it intents that you take the right measures to protect people in the context you are doing it. It is not a black and white issue, the regulation is pretty vague. | |
| May 23, 2019 at 2:46 | comment | added | Kevin McKenzie | @NielsvanReijmersdal As Bakuriu said, GDPR doesn't care about having a legitimate interest; unless the data owner explicitly allowed the use you can't use it. There's also the issue of having to provide copies of data to the person the data is about, and having to delete said data upon request. Do you really want to have to search test databases every time a request comes in? | |
| May 22, 2019 at 19:42 | comment | added | Bakuriu | @NielsvanReijmersdal I think that you are wrong. GDPR requires privacy by default. I don't think that having a "legitimate interest" means nothing to GDPR. If you search Test Data Management + GDPR you find tons of articles, none suggests that simply adding a checkbox when filling the privacy forms would fix the issue as such I believe that your reasoning is quite naive in this regard. IMHO, from the point of view of an user I don't think that pseunonymization poses an "undue burden" to the company, it's a quite cheap price to pay for a small amount of privacy. | |
| May 21, 2019 at 8:55 | comment | added | Niels van Reijmersdal | Yes, but testing might be a valid need-to-use case, for example for reproduction of defects. Companies probably have a "legitimate interest" to use data for testing purposes, you might have to document a legitimate interest assessment. Also I would have measures like clear and documented (shorter) retentions limits for testing data based on real-data. | |
| May 21, 2019 at 8:49 | comment | added | Rsf | Good point, I guess that an explicit consent to use the data in testing should work, but it will burden the company and testers with paperwork, restrictions and procedures to keep the data private and secure. From the top of my mind I would guess that access to this data will be on a need-to-use only, it will have to be as secure as the production environment even to internal accesses and you will need to remove it if the client asks you to. | |
| May 21, 2019 at 8:26 | comment | added | Niels van Reijmersdal | "In Europe the GDPR does not allow usage of private data" it does with right the consent. So technically you could also ask a sample (or all) of your users to consent to use their data for testing. | |
| May 21, 2019 at 8:25 | comment | added | Niels van Reijmersdal | Why wouldn't the GDPR allow production customer data to be used for testing? They gave consent to use it in production. I can't think of a reason you can't use it for testing, as long you have appropriate measures in place to protect their privacy in the testing environment. What those measures are depends on the context and risks. A bank might take more measures like truly anonymising. datalumen.eu/… While testers of a smaller Content Management System might not anyonmise the email account names of its users. | |
| May 20, 2019 at 8:41 | history | answered | Rsf | CC BY-SA 4.0 |