GDPR

It gives individuals the right to access, edit and delete personal information stored by organisations. Individuals also have the right to be informed about the purpose of the data collection, how long the information will be stored, who has access to the data, and when it was last edited. Organisations that store personal data should also be able to export the data in a machine readable format.

In order to support this Litium has introduced new functionality in version 4.8 and higher. In addition to the new features listed below, the functionality can be extended by changing the business logic for finding, filtering and exporting personal data. In Litium, this type of information is primarily stored in the Sales and Customers areas.

Delete old orders

For maintenance purposes historical orders can be deleted automatically based on the age and state of the order. This is done through a scheduled task that you set up in web.config in the solution. The orders that should be deleted can be specified in back office via Settings > Sales > Delete old orders. The following line in the taskSettings section in web.config will delete the specified orders once every day.

<scheduledTask type="Litium.Foundation.Modules.ECommerce.Orders.OrderCleanupScheduler, Litium.Studio" startTime="00:40" interval="1d" />

The orders defined in the scheduled task will not be deleted through the GDPR features in the Sales and Customers areas. The personal information related to the orders will not be deleted when the scheduled task is run. Only the orders will be deleted. This is because the customer might have placed newer orders than the ones that are deleted through the scheduled task. If you want to extend the functionality to also delete customers that do not have any registered orders you can do one of the following:

• Create another scheduled task that regularly deletes all customers that do not have any orders.
• Add a listener to the event ModuleECommerce.Instance.EventManager.OrderDeleted and if the deleted order is the only one the customer has placed, then also delete the customer.

Delete personal data

A person and all orders related to that person can be deleted. The function can be extended by the project to also be able to delete personal information in third party systems.

Deletion of personal data will store information outside the database to be able to trigger deletion of the same person and orders in case a database restore occurs.

Export personal data

Personal data can be exported from back office in JSON format. The export includes the personal data of the person object and any orders placed by the person. The function can be extended by the project to also be able to include personal information in third party systems.

Audit information

Extra audit information is added for all logins that are executed where the person has administration access to customers or orders. To view the audit information you can run the following SQL statement on the database:

SELECT AT.TransactionDateTimeUtc, AT.IdentityName 
FROM Auditing.AuditTransactionItem ATI
INNER JOIN Auditing.AuditTransaction AT ON AT.SystemId = ATI.AuditTransactionSystemId
WHERE ATI.EntityType = 'Litium.Security.AuthenticationService, Litium.Abstractions'
ORDER BY AT.TransactionDateTimeUtc

Deleting and exporting data in back office

There are two ways to delete a person and all orders related to that person manually in back office. You can't delete several people at the same time in back office:

1. Click on Customers and either search for or browse to a person.
2. Double-click on the person and select the Settings tab.
3. Click GDPR and then Delete to delete the person and all orders related to that person, or click Export to export all personal data to a JSON file.

or

1. Click on Sales and double-click on an order under Order management. If you can’t find the order you are looking for, adjust the filter, or use one of the predefined filters.
2. Click on GDPR in the menu bar.
3. Click Delete to delete the person and all orders related to that person, or click Export to export all personal data to a JSON file.

Note that the deletion feature can be customised in the project and hence work differently in different projects.

More information

Below you can find the regulation in its entirety. The features above relate to articles 15, 16, 17 and 20 in particular.

http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679