Voice of the DBA

Tag: data privacy

  • Privacy Problems in Apps

    Software is a great equalizer, in that almost anyone can build an application and make it available for others. The app stores from Apple, Google, and others are great examples of where individuals or small teams have made some incredible applications that people all over the world use on a regular basis.

    This year, a pandemic changed the world. One of the main things that many scientists and governments have desired to help control the spread of disease is contact tracing. One would think this is a great situation where technology can help.

    It can, but many apps built for contact tracing aren’t respecting privacy. Researchers examined a number of apps in use around the world and found many aren’t using the privacy friendly notification systems that Google and Apple have built. There are a variety of permissions and practices in use, which is a little disconcerting. How can someone really understand the implications of choosing one over the other?

    As with any situation, it’s likely that some developers have good reasons to request additional permissions and collect more data. Lots of governments and universities built apps because they didn’t feel the Google/Apple frameworks collect enough data. It’s also likely some malicious actors built apps to collect data, and certainly a few have been built with advertising or some other money making scheme integrated with the app.

    If you choose to use some sort of app, you might spend a bit of time understand how it works, what data it collects, and if there are any policies or ability to control this. While we want to control and eradicate this pandemic, many of us don’t want lasting control of some data about us to be in the hands of others.

    Steve Jones

  • A Data Request Form

    This week I’m in the PASS Virtual Summit, watching some sessions around other work. Unlike a regular conference, I have more distractions, and I have other commitments. So while I have to be around to deliver or chat during a few sessions, and I am at the Redgate Booth, I also still have other work to get done. Being ill for most of last week put me way behind.

    As I was wandering around the Virtual Summit site, I’ve been experimenting and clicking, looking for how things work. After a little discussion on Twitter about the privacy policy, I was looking for what the platform offers. The vendor being used is Cadmium CD, and at the bottom of the Summit pages, there is a link that says “My Data”. Clicking it takes me here: Data Request Form.

    This is what is says. You can request all your data from the vendor, which is a provision of the GDPR, allowing you access to what data is being stored about you. You can also ask to be removed, forgotten, or transferred. I wonder if that last one will become a service item. Would you subscribe to somewhere that gets copies of and cleanses, analyzes, etc. your data, letting you know what mistakes or inconsistencies are out there? Or what is being tracked, with some privacy surface area or areas of concern?

    I don’t know if I would, but I do like the idea of being able to request my data. I’ve done this from some places, getting a look into how I have used services more than what people are tracking, but knowing what’s being captured and held is a concept I might embrace.

    Steve Jones

  • SQL Server Phone Home

    A few versions ago Microsoft added the Customer Experience Improvement Service to the SQL Server platform. This is the CEIP service, and it comes with SQL Server. It is designed to get telemetry from your operation of a SQL Server instance on your premises. If you have Standard or Enterprise, you can turn this off, but if you use Developer or Eval, you cannot. Brent wrote a short description of this service recently, which is a good summary.

    When this first came out, there was a lot of concern with regards to data privacy, but I suspect most of this is overblown. Microsoft is bound by the GDPR, and my conversations with employees over the years have convinced me they take this seriously. Not just the legal staff, but many of the developers were surprised by the detail and documentation that they had to provide in order to gather data.

    Microsoft documents about what they collect, as well as the access restrictions at Microsoft and the data retention. I don’t see anything here that I am too concerned about, but I do think this is a great template that many organizations could use to document what data they capture from customers, how it is used, and how long they keep it. Whether you are required to do this or not now, I suspect more of us will be required to do this over time. You could start doing this now and be prepared early.

    This isn’t a fun task, and it’s very tedious, but if you capture this data and adjust it as you evolve and alter your schema, it’s not too bad. If you also include a place to document this, you can then work on this over time, not as one big, long, really annoying project. As data documentation has become more important to many of the customers I deal with at Redgate, having the ability to work on this over time is helpful in any size organization.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • Aiming for Better Data Governance

    At Redgate, we have customers all over the world. I’m lucky that I get to work with, and sometimes meet, people dealing with all sorts of situations, environments, and even regional challenges. As a dev and DBA, I’ve never worried about anything other than varchar(). Now I have customers that have lots of languages and other issues that need to be accounted for in their designs.

    One of the areas that has become more important in the last few years is Data Privacy and Protection. Between the GDPR and other legislation, and growing concern from customers, many organizations are starting to pay more attention to this area. Less so in the US, where we seem to be behind most of the rest of the world.

    I saw a piece recently on the reasons why we might need more data governance in companies. Actually, the piece talks about needing more money for the Chief Data Officer’s budget, though I’m not sure most organizations have anyone in that role. A few do, and certainly I’ve seen some growth in companies worried about this, but it’s still a minority.

    While regulations might change, and there could be a quick need to improve our processes in this area, I think the bigger issue is competition. More consumers are fickle, easily changing services whenever they are unhappy. More companies are building competitive services, and if you cannot satisfy your customers, they’ll go elsewhere. Increasingly consumers are considering data security and data privacy to be more important than in the past.

    I’d urge you to think about these issues inside your organization, and try to be better in new projects. Ensure you could comply with the CCPA or the GDPR if necessary. That need could come quicker than you expect.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.