GDPR Data Subject Requests Guide

Source:

Published:

Keywords: GDPR Data Subject Requests Guide, General Data Protection Regulation (GDPR), Data Subject Requests (DSRs)

Document ID: https://platform-support.certain.com/hc/en-us/articles/10901759065111-GDPR-Data-Subject-Requests-Guide#split1

Foreword

This document is a guide to responding to Data Subject Requests (DSRs) made under the General Data Protection Regulation (GDPR) where the data is held in your Certain database.

It covers the rights granted to individuals under the GDPR:

The GDPR requires that an individual be able to obtain a copy of their data in a standard format. Certain’s standard reporting tools let you quickly find and export the information held about any registrant or user and email it to them. See “View” Requests below.

Under the GDPR, an individual can ask you to remove their personal data. Certain has an “Anonymize” feature that removes personally identifiable information. See “Delete” (Forget me) Requests below.

Under the GDPR, an individual can ask you to rectify any incorrect personal information held about them. In Certain, you can quickly find and edit an individual’s details. You can email the updated details to the individual as confirmation. See “Edit” Requests below.

Contents

Introduction

There are three types of requests you may receive from individuals who may have Personally-Identifying Information (PII) on file:

The individuals concerned may be any of the following types:

The steps are similar for each request type and individual type. The steps are listed separately below. The steps for Registrants and Speakers are identical.

They all start with logging in to the Certain App and navigating to the relevant account(s). The next section describes the navigation.

Logging In to Certain

1. Log in to Certain with your usual credentials. Your user type must be at least “Registration and Support”. The higher levels include “Event Planner” and “Administrator”.

2. You are automatically logged in to your account.

3. Follow the steps listed below in that account and its active sub-accounts (if any) used for managing events.

4. To change accounts, click the account selector icon below the account name in the upper left corner and select a sub-account.

Registrants’ and Speakers’ Information

A “Registrant” is usually an “attendee” at one or more events. A Registrant may also be an exhibitor, staff member, or other person registered for an event.

A “Speaker” is a speaker at an event where the Speaker and Session management module is used.

The following steps assume you have logged into the relevant account. The previous section describes logging in.

“View” Requests

To View a Registrant’s or Speaker’s Information

1. Search for the registrant’s or speaker’s profile record.

a. Click the search icon on the global navigation toolbar in the upper right corner of the screen. b. Choose to Profiles. c. The Profiles page opens. d. Search for the registrant using their Email address. e. A list of matching records is displayed. If your account is set to use unique email addresses, only one record is displayed. f. Click the record to view the details.

To Export a Registrant’s Information

A) Create a Profile Report

1. Create an account-level Profile Report and include columns of interest.

Note: You only need to do this once for an account. The same report will then be available for future use.

2. Click the menu icon in the top left corner of the screen.

3. Select Profiles in the list of options.

4. The Profiles page opens. Click Reports, the only menu choice at the top of the page.

5. The Profile Reports page opens. Click Create Report (in the upper right corner of the page).

6. The Report Setup page opens.

7. Give the report a name. Optionally add a description.

8. Recommended: Under the Visibility heading, select the All Accounts option. This makes the report available not only in the current account but also in any sub-accounts below it.

9. Under Report Type, select one of the two options. The default option is “Profiles”. The more detailed option is “Profiles and Registrations”.

Note that you cannot change the report type after you have created the report.

10. Save the report.

11. Select Display in the left navigation panel.

a. Select a Report Format, such as “Export to .CSV” selected in the screenshot. b. Select a Data Format, such as the default “Output data as stored” selected in the screenshot. c. Save the report again.

12. Click Columns in the left navigation panel to select the data to include in the report.

a. Select the appropriate fields in Available Data Fields on the left and click » to move them into Selected Data Fields on the right. b. Save the report again.

B) Run the Report for a Registrant

1. Select Filters in the left navigation panel.

2. At the end of the page, filter on the registrant’s or speaker’s email address.

3. Click Run Report (in the lower left corner of the page) to create the export file.

4. Download the report to share with the requester.

To Email a Registrant or Speaker Their Information

An alternative to using a report is to email their profile details to an individual.

A) Create an Email Template

1. In an event, go to Promote > Communication > Email Templates > Registration.

2. Click Add New to add a new email template.

3. Give the email template a self-explanatory name of your choice.

4. Select the option to make the report “Visible to All events in account”.

5. Add all the relevant Standard Profile Fields and Custom profile fields to the body of the email.

6. Do not include any event-level information.

7. Save the template.

B) Send the Email to the Profile

1. Search for the registrant’s profile record using the same steps described under “View” Request on page 3.

2. Click Email in the left navigation panel.

3. Select the email template, and click Select.

4. At the bottom of the page, click Preview. If satisfied with the result, click Send Email NOW.

5. The sending of the email will be included in the profile’s History. The left navigation panel provides access to the profile’s History.

“Edit” Requests

1. Search for the registrant’s or speaker’s profile record using the steps described under “View” Request above.

2. Confirm the correct record is displayed.

3. Click on the Contact Details header bar, or click Contact in the left navigation panel.

4. Edit relevant information, and click Save.

5. Click Questions in the left navigation panel.

6. Edit relevant answers to profile custom questions, and click Save.

7. The edits will be included in the profile’s History log. The page provides the same History location described above for emails. (Page 9.)

“Delete” (forget me) Requests

Best Practice: Anonymize Profiles

You can “anonymize” Profiles in an account. This removes personally identifiable information so the individual remains anonymous.

Note: An Administrator should follow this procedure. The procedure is not available to Event Builders or other users.

In summary, you first identify the profile fields that hold personally identifiable information (PII). You configure replacement text. Defaults are pre-set for both. You then select profiles and anonymize them by clicking one button.

Detailed Steps

1. Go to User and Account Settings > Account Settings > Implementation > Privacy Compliance > Profile Anonymization.

2. Under Anonymize Profile Fields, select the Standard and Custom Profile fields for this Account that you want to anonymize when you select individual profiles in step 6. Include all fields that could be deemed Personally Identifiable Information (PII).

Many standard profile fields, such as name fields and email, are preselected and will always be anonymized.

3. The default anonymization string that replaces the values in the selected profile fields of an anonymized profile is “”. You can change that to any text of your choice.

4. If you select Make Profile Inactive, then any profiles you anonymize will also be set to “inactive”. Inactive profiles are excluded from reports and searches.

5. Save your selections so that you can use them when anonymizing profiles. The next steps explain anonymizing profiles.

6. Under Profile Anonymization, search for the Profile(s) to anonymize. In the field, type at least 3 characters of their Email or Phone. Alternatively, type the complete Encoded Profile ID beginning with “0x”. (See screenshot.)

7. View the list of matching records. Click to view a profile’s details to confirm you have the right record.

8. Select the check box(es) for the profile(s) you want to anonymize.

9. Click Anonymize to update the selected profile(s). The values of the fields selected in step 5 are set to the Anonymization String. If Make Profile Inactive was selected in step 4, the anonymized records are no longer returned in searches or reports.

10. Under Anonymized Profiles Audit Report, view a list of the anonymized profiles in the account. You can search for one by PkprofileId or Username.

Users’ Information

A “user” is anyone who is set up in CertainAPP with a user record.

To view another user’s details, edit a user record, or delete a user record, you must be logged in to Certain as an Administrator. Your own user account must have a User Type of “Administrator”.

“View” Requests

For a User to View Their Own Information

Any Certain user can view and edit their own information by following these steps.

1. Go to User Information and Account Settings > User Information.

2. Open the “My User Information” page.

3. View or edit the information as required.

For an Administrator to View Another User’s Information

1. As an Administrator, go to Account Settings > Administration > Users.

2. To search for the user, enter their email address in the Login ID field and click Search.

3. Click the user’s row in the results. This opens a page showing their details.

4. The only PII data is likely to be their name, email address (twice: as both Id and Email), and phone number.

“Edit” Requests

For a User to Edit Their Own Information

1. Open the user record as described under “For a User to View Their Own Information” above.

2. Edit fields as required, and click Save.

For an Administrator to Edit Another User’s Information

1. Open the user’s record as described above under “For an Administrator to View Another User’s Information”.

2. Edit fields as required, and click Save.

“Delete” (forget me) Requests

1. As an Administrator, open the user’s record as described above under “For an Administrator to View Another User’s Information”.

2. Clear the Active check box.

3. Clear out the Phone number. Replace it with anonymization text, such as “” or “anon”.

The other PII fields, Name and Email, are required fields. Instead of clearing them out, enter appropriate anonymization text.

Note: The Email field must be in a valid email address format, such as “anon@certain.com”.

4. Save the changes.

The user will no longer be able to log in to Certain.