General Data Protection Regulations for WSO2 Data Analytics Server

WSO2 Data Analytics Server is evaluated for the General Data Protection Regulation(GDPR) requirement - Right to be forgotten. The primary focus is to implement the right to be forgotten concept without affecting the core logic of the system.

Right to be forgotten

In WSO2 DAS, event streams specify the schema for events to be selected into the DAS event flow to be processed. This schema can include user IDs and other information that you want to be hidden when DAS persists events for batch analytics.  This can be done via the Forget-me Tool.

To demonstrate this, consider an example where there are two streams as given below.

In the above streams, the user name, email and the date of birth are considered PII (Personally Identifiable Information) that need to be hidden. To do this, follow the steps given below.

Step 1: Configure the streams.json file

In order to identify the streams and the stream attributes with PII, you need to create this file with definitions of the relevant streams and each attribute that contains PII (Personally Identifiable Information). This file must be placed in the <DAS_HOME>/repository/components/tools/identity-anonymization-tool-x.x.x/conf/streams directory. 

The following is the sample streams.json file for this scenario.

{
    "streams": [
        {
            "streamName": "org.wso2.gdpr.students",
            "attributes": ["username", "email", "dateOfBirth"],
            "id": "username"
        },
        {
            "streamName": "org.wso2.gdpr.students.marks",
            "attributes": ["username"],
            "id": "username"
        }
    ]
}

This file must include the following information as shown in the sample above:

The above configuration includes the following:

• Stream Name: The name of the stream.
• Attributes: The list of attributes that contain PII.
• id: The ID attribute that needs to be replaced with the value of pseudonym argument when executing the tool.

Step 2: Configure the config.json file

In order to identify the streams and the stream attributes with PII, you need to create this file with definitions of the relevant streams and each attribute that contains PII (Personally Identifiable Information). This file must be placed in the <DAS_HOME>/repository/components/tools/identity-anonymization-tool-x.x.x/conf directory. 

The analytics-streams processor needs to be added to the configuration file of the Forget-Me tool as shown on the sample below.

{
    "processors": [
        "analytics-streams"
    ],
    "directories": [
        {
            "dir": "analytics-streams",
            "type": "analytics-streams",
            "processor": "analytics-streams"
        }
    ]
}

Step 3: Execute the Forget-me tool

To execute the Forget-me tool, issue the following command pointing to the <DAS_HOME> directory.

forget-me -U <USERNAME> -d <CONF_DIR> -carbon <DAS_HOME>