The Data privacy feature

The data privacy feature involves proper handling of a customer’s personal data concerning duration of storage and the handling of data privacy requests.

The main objective of introducing data privacy guidelines is to ensure that personal information of SCALAR customers is kept confidential and secure thereby protecting individuals’ and customers’ right to privacy.

It involves implementing measures and policies to protect and safeguard data from unauthorized access, data breaches, and misuse while complying with relevant legal and regulatory requirements.

IMPORTANT

The Data Privacy module is accessible to only those users who are assigned the Data Protection Officer role (DPO). To activate the role, Customer can reach out to the user with the Administrator role.

Data Protection Officer

When a customer organization is onboarded to the SCALAR platform, the organization needs to assign the DPO role to a user who is trained on data privacy laws. The DPO is appointed in accordance with GDPR guidelines. In case no DPO needs to be appointed to the customer organization defined by local law, a data privacy contact anyhow is needed who needs to act in the tooling as a DPO.

The organization’s DPO must ensure compliance with GDPR and other data protection laws. They are responsible for implementing data privacy and managing requests specific to their organization. They must review the contractual terms and conditions for the processing of personal data.

IMPORTANT

• The data owner and the DPO of the organization are responsible for compliance to data privacy, managing the data retention period, and upon the first use of the system, setting up or configure the data lifecycle rules.
• The DPO must decide the data retention period for each rule and must be aware of the scope of each rule.
• The DPO has full control over modifying the data retention period duration: at their discretion, they can modify the value within the defined range, which may have commercial implications.
• The data generated by the SCALAR system, including the hardware devices, is linked to the default data retention period defined in the system: generally, for one year. After the data retention period is modified, the new retention period will be applicable only to the newly generated data.
  
  Illustration: When the data retention period for an organization is increased from 366 days to 700 days on 24-Sep-24.
  Implication:
  • Data generated prior to the modification in the retention period will be retained for 366 days 
  • The new data retention period (700 days) will only be applicable for the new data that is generated thereon, which is generated 25-Sep-24 onwards

• Regardless of the default settings, the customer organization (controller) is fully responsible for the legally compliant use of the product including its data management settings and will warrant towards the processor (ZF or reseller as the case may be) to carry out the data processing in compliance with applicable data protection legislation.

SCALAR Data privacy system

SCALAR is a global product that must comply with multiple data privacy laws applicable globally including GDPR (General Data Protection Regulation). The data of the customer organization must be secure and compliant as per regulations and guidelines defined by the jurisdiction.

The SCALAR Data Privacy system addresses the data privacy concerns of all SCALAR users.

Salient features

The Data privacy system has the following main features:

• Data Privacy Request: A DPO can create requests related to data privacy in the system and can manage and track the request to closure.
• Data lifecycle rules: The SCALAR DPO defines the rules for data retention that can be viewed and edited by the customer organization DPO.

ZF-defined data retention policy

ZF collects data from various sources (including hardware devices that are connected) that are stored in different modules. The data is retained for a specified period, which is set as the default duration. The retention period varies based on the type of data, such as workflow, driver, Tachograph, sensors, and audits. The information about the retention period for each type of data is outlined in the compliance guidelines document. Based on these guidelines, the SCALAR DPO creates rules that are applied to all organizations. However, if authorized, a DPO can modify the data retention period for each data lifecycle rule that is aligned with their organization’s data retention policy. 

The available functions are:

• Add Data Privacy Request
  • Right to forget organization request
  • Right to be forgotten request
• View requests
  • View data lifecycle rules
    • Edit data retention duration
    • View edit history
    • Rollback to default duration
• An overview on data lifecycle rules

Add Data Privacy Request #

You can add a new data privacy request using this feature. The following request types can be submitted:

• Right of access
• Right of data portability
• Right to forget organization
• Right of rectification of data
• Right to restrict processing
• Right to be forgotten

Right to forget organization request #

Under certain circumstances such as when the customer organization’s contract with ZF is ending, the DPO can submit the right to forget organization request wherein the organization data is deleted from the ZF platform.

1. In the Data Privacy module > on the Home tab > click the Add Data Privacy Request tile. The Add request page is displayed.
   
2. In the Request details section, from the Request type list, select Right to forget organization.
   
3. In the Comments/remarks box, enter additional information or comments that can be noted by the SCALAR DPO, and then click Submit. The Permanently forget organization? dialog is displayed.
   
4. To confirm the action, click Forget organization. A request is generated and listed
   on the Data privacy requests page.
   
   NOTE
   A notification is sent to the SCALAR DPO, the data owner, and the DPO of the organization. The DPO of the organization can review the request and reject if the request is not valid, by clicking the link included in the notification (should the request be submitted inadvertently).
   
   On the Right to forget organization page, on the Details tab, from the Status list, select Rejected, and then click Save.
   
   After the notification is sent, if there is no response from the DPO of the organization within seven days, it will be considered as approved, and the deletion process is initiated and will be finalized within the month after the notification.
   
   Considering the criticality of the organization data, the SCALAR DPO can also reject the request if required, if the DPO of the organization does not initiate any action.

Right to be forgotten request #

This feature is used when for example a user is leaving the organization, and the DPO of the organization requests ZF to delete PII (personally identifiable information) data of the SCALAR user.

1. In the Data Privacy module > on the Home tab > click the Add Data Privacy Request tile.
   
   The Add request page is displayed.
   
2. In the Request details section, from the Request type list, select Right to be forgotten.
   The Description section is displayed.
   
3. From the Data subject list, select the user whose data needs to be deleted.
4. By default, the Chat message data removal tab is selected as Yes. To retain the chat messages, select No.
5. By default, the Tacho archive data removal tab is selected as No. To delete the Tacho archive data, select Yes. The Tacho archive data removal dialog is displayed.
   
6. To confirm deletion, click Yes. The user information including data recorded by the Tachograph is marked to be deleted.
7. In the Comments/remarks box, enter additional information or comments that can be noted by the SCALAR DPO, and then click Submit. The Permanently forget user? dialog is displayed.
   
8. To confirm the action, click Forget user. A request is generated, and you are directed to the Data privacy requests page.
   
   
NOTE:

A notification is sent to the data owner and the DPO of the organization. The DPO of the organization can review the request and reject if it is not valid, by clicking the link included in the notification, (should the request be inadvertently raised). The request is considered approved if the request for rejection is not received within seven days of sending the notification.


On the Right to be forgotten page, on the Details tab, from the Status list, select Rejected,
and then click Save.


After  seven days of sending the notification, if there is no response from the DPO of the organization, it will be considered as approved, and the data is deleted from the SCALAR platform and will be finalized within the month after the notification.

View requests #

On the Data privacy requests page, you can view and track all the requests that have been submitted.

1. In the Data Privacy module > on the Data Privacy page > click the View requests tile.
   
   The Data privacy requests page is displayed.
   
2. Click the required record. The request details page is displayed.
   
   The following table describes the definition of the Status types.

Status	Description
In progress	By default, after a request is raised, the status is set to In progress.
Resolved	After a waiting period of seven days, module-specific data is deleted based on the life cycle rules defined for each module. After the data is deleted from SCALAR, the status is automatically updated to Resolved.
Suspended	If a status is set to Suspended, the request for deletion of data is suspended or on hold. However, this action does not reverse the deletion process for data that is already removed.
Rejected	If a request is not valid, the DPO of an organization or SCALAR DPO (in case of right to forget an organization type request) can reject the request, thereby cancelling the entire deletion process.

View data lifecycle rules #

On the Settings page, you can view all the data privacy-related rules.

1. In the Data Privacy module > on the Data Privacy page > click Settings.
   
   The Data lifecycle rules page is displayed listing all the rules.
   
2. Click a record to view the details of a rule. In this example, we have clicked the “Track and trace” rule. The rule details page is displayed for the selected rule.
   
   
   Search a data privacy request
   You can search a request on the Data privacy requests page by using the Search feature. In the Search box, enter the name displayed in the Created by or Data Subject columns. The records matching the search criteria are displayed. 

Edit data retention duration  #

The SCALAR organization DPO will define the default value before organizational onboarding and it’s up to the organization DPO to modify the data retention period based on the defined (allowed) range.

IMPORTANT

• The customer DPO cannot create a new rule but, can modify the data retention period within the specified range or roll back to the default duration.
• The DPO of the organization must ensure that the data retention period is aligned with their organizational data retention policy and modify the duration within the range prior to the first usage of the system based on their business requirements.

1. On the Data lifecycle rules page, click the required record. The data lifecycle rule details page is displayed.
   
2. In the Data duration details section, next to the Duration field, click the menu item  icon. The actions that can be executed are displayed.
3. Click Edit duration. The Edit duration dialog is displayed.
   
4. In the Duration box, modify the value, and then click Save. The modified value is saved as custom duration.
   
   NOTE

• The allowed range is displayed below the Duration box.
• After the duration is modified, the options to View edit history and Rollback to default duration are enabled.

View edit history #

You can view the history of the modification made to the data retention period.

1. In the Data duration details section, next to the Duration field, click the menu item  icon. The actions that can be executed are displayed. For more information, see Edit duration details.
2. Click View edit history. The Data duration edit history dialog is displayed.
   

Rollback to default duration #

A customer DPO can roll back the edited duration to the default period.

1. In the Data duration details section, next to the Duration field, click the menu item  icon. The actions that can be executed are displayed. For more information, see Edit duration details.
2. Click Rollback to default duration. The Rollback data duration to default dialog is displayed.
   
   To confirm the action, click RollBack. The information in the Data duration
   details section is reverted to the default value.

An overview on data lifecycle rules #

You can view the data lifecycle rules, edit the data retention period, view edit history, and roll back to the default duration from the Settings tile.

1. In the Data Privacy module > on the Home tab > click the Settings tile.
   
   The Data lifecycle rules page is displayed.
   
2. Click each rule to view details about the business service for which the data lifecycle has to be managed. In this example, we have clicked the “Drivers” rule.
   
   The following table lists the details of the rules displayed.

   Sr. No.	Rule Code	Rule Name	Valid for feature	Type	Contains PII data	Duration in days	Description
   1	ECO	ECO	Eco Coaching	Accessibility duration	Yes	364 days	The data in scope is the data used by the Eco module for Coach and Driver’s driving behavior.
   2	WORKFLOW	Workflow	Workflow Management	Data retention	No	366 days	Data lifecycle for our workflow management.
   3	csr-req-ttl	Certificate Request	Diagnostics Certificate Service Administrator Access	Data retention	Yes	366 days	Data retention time for certificate requests and their resulting certificates.
   4	archives	archives	Tacho Data Archiving	Data retention	Yes	365 days	The data in scope is part of the data used in Tacho data archiving.
   5	TNT	Track and trace	Operations Track and Trace	Data retention	Yes	366 days	The data in scope is the data used by the Map module.
   6	TM-TDA-Archives	Tachograph – Archives	Tacho Data Archiving	Data retention	Yes	1827 days	The data in scope is part of the data used by the Tachograph module. This rule is focused on the archives.
   7	TM-RDD-Sessions	Tachograph – RDD Sessions	Remote Data Download	Data retention	Yes	366 days	The data in scope is part of the data used by the Tachograph module. This rule is focused on the Remote Data Download sessions.
   8	Scheduled-Trips	Scheduling	Trip Follow-Up	Data retention	Yes	366 days	Retention period of scheduled trips, Minimum: 60 days.
   9	SPOT	Spot Subcontracting	Spot Trip Follow-Up	Data retention	Yes	60 days	The data in scope is the data used by the spot subcontracting module.
   10	SENSOR	Sensors	Sensors information	Data retention	Yes	366 days	The data in scope is the data used by the sensor main module and contains all the collected main sensors in the sensor database.
   11	MSG	Messaging Retention Rule	Messaging	Data retention	Yes	366 days	The data in scope is the data used by the Messaging module.
   12	DRT-Tacho	Tachograph activities in DRT	Activity History	Data retention	Yes	366 days	The data in scope are the Tachograph activities used by the Remaining and the Tacho tabs in Map module.
   13	DRT-Tacho-Activities	Driving and Resting times	Driving and Resting times	Data retention	Yes	335 days	The data in scope is part of the data used for driving and resting times.
   14	DRM	Drivers	Driver Admin	Data retention	Yes	366 days	The data in scope is the data used by the Drivers module such as driver assignment to assets, among others.
   15	DM-RAW	Datahub – Developer Metrics – Timeseries Rule Code	Developer Metrics	Data retention	No	7 days	The data in scope is part of the data used by the Datahub module’s Developer Metrics product for timeseries data retention.
   16	DM-AGG	Datahub – Developer Metrics – Aggregation Rule Code	Developer Metrics	Data retention	No	366 days	The data in scope is part of the data used by the Datahub module’s Developer Metrics product for data aggregation retention.
   17	CMP-REQ-DONE	Compliance completed requests	Compliance	Data retention	No	365 days	The data in scope is the data used by the Compliance module for completed requests.
   18	CMP-REQ-AWAIT	Compliance pending requests	Compliance	Data retention	No	550 days	The data in scope is the data used by the Compliance module for unresolved requests where there was no recent activity.
   19	AUDIT	Audit log	Audit Log Access	Data retention	Yes	180 days	The data in scope is part of the data used by the Admin module namely Audit log data captured by Users, Assets, Places, Teams, Integrators, Settings, Alarm rules, Drivers, and Tachograph. This controls the retention period of the audit logs.
   20	ACR	Alarms	Operations Alarms	Data retention	Yes	366 days	The data in scope is the data used by the Alarms module.