Delete Personally Identifiable Information About a User from Sitefinity CMS

Transcription

1 Delete Personally Identifiable Information About a User from Sitefinity CMS WHITEPAPER You can use the following articles as a guidance about deleting personally identifiable information (PII) about a user from Sitefinity CMS. You may want to do this, if a user requests that you erase all of the information that can personally identify her or him from your website. The user may request this via or other means. You can apply this procedure both to frontend and backend users. In order to achieve this, you need to delete certain data from the database either entire records from a table, or particular columns only. Afterwards, you delete the user. IMPORTANT: The instructions below are applicable for out-of-the-box functionality for this product. Due to the product s customizable nature, you may have PII stored in other fields or tables that are not included in these instructions. It is your obligation to identify all places where PII may be stored and delete the data as necessary. IMPORTANT: This procedure is not valid for the Ecommerce modules. Features and Modules Containing PII Frontend Users Backend Users The following features contain frontend user data: Comments Dynamic Module Campaigns Notification Service Forms Forums Authentication (IdentityServer) Media Content User (user, profile, activity) The following features contain backend user data: Events News Packaging Publishing Workflow 1

2 Delete PII You erase the PII of a user directly from the database. You do this by logging to the management tool of your database and then delete the information using database queries. The database has tables that directly contain PII for the user and tables that contain references to PII. RECOMMENDATION: We recommend clearing tables with references first, because, although on a database level there is no requirement for such information integrity - no Foreign Key Constraint, Sitefinity CMS may require this information for some of its functionalities. To erase PII of a user, use the following procedure: 1. Clear Information from the tables that contain references to PII. For more information, see Reference: Data that contain references to PII. 2. Clear information from the tables that directly contain PII. For more information, see Reference: Data that contains PII. 3. Delete the user. For more information, see Reference: Delete the user. IMPORTANT: You must delete the user after you have cleared all the other tables, otherwise, you will lose the connection between the user _ id and its PII. Reference: Data that contain references to PII The following database tables and columns contain an indirect relation that can be used to identify the user for example, owner unique identifier. You can erase them after you have cleared the initial object for example, the or the. However, we recommend to clear them first, because, although on a database level there is no requirement for such information integrity - no Foreign Key Constraint, Sitefinity CMS may require it for some of its functionalities. 2

3 Database table sf_blog_posts sf_blogs sf_bounce_stat sf_calendars sf_approval_tracking_record sf_content_items sf_dashboard_log sf_dashboard_watchlist sf_delivery_entry sf_draft_pages sf_dynamic_content sf_form_description sf_<form_name> This is a dynamic table. Substitute <FormName> with the name of the form that you want to clear sf_forum_posts sf_libraries sf_list_items sf_lists mb_dynamic_module sf_object data sf_page_data sf_page_node sf_page_templates sf_pckgng_pckgs sf_presentation_data sf_publishing_point sf_rbin_item sf_sites sf_taxonomies sf_tr_prjcts sf_tr_trnsltns sf_user_action sf_user_link sf_user_profile sf_user_profile_link sf_version_chnges sf_workflow_definition Columns to be cleared sf_subscriber_id, last_modified_by, author subscriber_id, last_modified_by _last_modified_by, locked_by Response columns These are responses to each question. _last_modified_by _last_modified_by, profile_id 3

4 Reference: Data that contains PII The following database tables and columns directly contain PII. You must either delete the entire record or clear a particular column: Database table sf_commnt sf_cs_comments sf_cs_groups sf_cs_threads sf_dynamic list sf_events sf_failed_deliveries sf_form_entry sf_forum_threads sf_forums sf_idsrv_claims sf_lic_user_activity sf_media_content sf_news_items sf_notif_subscribers sf_pckgng_addns sf_publishing_pipe_settings sf_sitefinity_profile sf_subscriber sf_workflow_permission sf_addresses Columns to be cleared, last_modified_by, , author_name_ last_modified_by_name, last_modified_by_ , last_modified_by, author_name, author_ ip_address, author_id, author_ author_name, author_id, author_ author_name, author_id, author_ last_name_mapped_field, first_name_mapped_ field, _mapped_field contact_web, contact_phone_, contact_name_, contact_ , contact_cell_ subscriber_resolve_key, subscriber_id, delivery_ address,, ip_address, last_post_, last_post_user_name last_post_, last_post_user_name login_ip author_, author_, author user_name_reference, user_name_reference2 nickname, last_name, first_name, about last_name, first_name, principal_name The whole record Delete the user IMPORTANT: You must perform this procedure after you have cleared all the other tables, otherwise, you will lose the connection between the and its PII. To delete the user, delete the whole user record from table sf_users You can alternatively delete the user from Sitefinity CMS backend. 4

5 Example: Delete PII from a form EXAMPLE (MS SQL Server): The following SQL database query demonstrates how to delete the PII of a user with username FrontEndUser from a particular form MyForm DELETE MyForm FROM sf_users U INNER JOIN sf_form_entry FE ON U.id = FE. INNER JOIN sf_myform MyForm ON FE.id = MyForm.id WHERE user_name = 'FrontEndUser' NOTE: To ensure all PII is erased, you will have to run this SQL database query on all the forms that you have created on your site. About Progress Progress (NASDAQ: PRGS) offers the leading platform for developing and deploying missioncritical business applications. Progress empowers enterprises and ISVs to build and deliver cognitive-first applications that harness big data to derive business insights and competitive advantage. Progress offers leading technologies for easily building powerful user interfaces across any type of device, a reliable, scalable and secure backend platform to deploy modern applications, leading data connectivity to all sources, and award-winning predictive analytics that brings the power of machine learning to any organization. Over 1,700 independent software vendors, 100,000 enterprise customers, and two million developers rely on Progress to power their applications. Learn about Progress at or Worldwide Headquarters Progress. Progress. All All Rights Rights Reserved. Reserved. Progress, 14 Oak Park, Bedford, MA USA Tel: Fax: On the Web at: Find us on facebook.com/progresssw twitter.com/progresssw youtube.com/progresssw For regional international office locations and contact information, please go to Progress and Sitefinity are trademarks or registered trademarks of Progress Software Corporation and/or one of its subsidiaries or affiliates in the U.S. and/or other countries. Any other trademarks contained herein are the property of their respective owners Progress Software Corporation. All rights reserved. Progress and Sitefinity TM are trademarks of Progress Software Corporation in the U.S. and other countries. This document may not, in whole or in part, be photocopied, reproduced, translated, or reduced to any electronic medium or machine readable form without prior consent, in writing, from Progress. Information in this document is subject to change without notice and does not represent a commitment or contract on the part of Progress. 5Rev 52018/03 REQ