GDPR - Forget Client Functionality

Introduction

Dolphin's Forget Client function enables users to purge personal data from customer profiles in accordance with the requirements of GDPR compliance. Personal data should normally be purged when:

• a customer gets in touch with a specific request that their personal data be removed
• a customer profile is deemed to be no longer in use

Security Profile setting:

Access to this functionality is governed by the Forget Client setting in the Access/Updates tab of their Security Profile:

Forget Client methods

When it comes to executing a Forget Client job in Dolphin, there are 3 methods to choose from:

1. Manual (individual client profiles)

This option allows the job to be run against a single client profile, which caters for the scenario where a client contacts the agency to request that their personal data be removed. Once the user has run a Client Search to find the profile, they can highlight the profile in the search results & click the Forget button

2. Manual bulk operation (multiple client profiles)

This option allows the user to manually trigger a Forget Client job to purge all client profiles which are no longer in use. From Bulk Operations > Customer Operations > Forget Clients, a Forget Clients dialog will open, displaying the total number of client profiles which have been either partially or fully forgotten to date, and also the last executed date. These fields will normally be updated once the user triggers a new job by clicking the Forget button:

3. Automated bulk operation (multiple client profiles)

The final method runs the same bulk operation job as method 2, but as a scheduled task rather than manually. There are 3 ways in which to set up the Forget Client job to run on a schedule:                                                                                                                                                                          

a)  via Bulk Operations > Scheduled Task Manager

b) via a Windows service, using start parameter /FC in conjunction with the scheduled task manager

c) via a SQL job which is run automatically on the SQL server

How does it work?

When a Forget Client job is initiated as a bulk operation using any of the available options for methods 2 & 3, this will trigger a 2-step process:

Step 1 - Identify all 'Inactive' client profiles which qualify to be forgotten

The criteria used to carry out this step are determined by a setting which can be configured via Options > System Settings:

Automatically Forget Inactive Client Profiles After [X] Years

A client profile will be classed as Inactive if:

• No folders have been created within the last X years, where the client profile is the folder client, AND
• No folders have been created within the last X years, where the client profile is linked to a folder passenger (regardless of whether they are also the folder client), AND
• No financial transactions have been issued for that client profile within the last X years, AND
• The client profile was created more than X years ago, i.e. before 'today - X years', AND
• All marketing preference opt-in dates set in the client profile are more than X years ago, i.e. before 'today - X years'

All Inactive client profiles will then undergo a data purge which will set them to a partially forgotten state, whereby:

• The client name & address details have been retained
• All other personal data has been erased
• The profile will be flagged as deleted

Step 2 - Identify all partially forgotten client profiles which qualify to be fully forgotten

Dolphin will now check the financial history for all partially forgotten profiles and will determine which profiles are eligible to be fully forgotten based on a second configurable setting within Options > System Settings:

Retain Forgotten Client's Name And Address For [X] Years After Last Financial Transaction

If the most recent financial transaction linked to a profile took place less than X years ago, no further action will be taken and the profile will remain partially forgotten.

If the most recent financial transaction linked to a profile took place more than X years ago, the profile will undergo an additional purge to set the profile to fully forgotten, whereby:

• The client last name is anonymised & updated to 'Forgotten - nnnnn' where nnnnn is the client ID. For example, a client with last name Smith and an ID 54321 would have the last name set to 'Forgotten - 54321'
• All other name & address data is deleted
• The profile remains flagged as deleted

As an example, let's say a Forget Client bulk operation has been run with the system settings configured as follows:

• Automatically Forget Inactive Client Profiles After 4 Years
• Retain Forgotten Client's Name And Address For 7 Years After Last Financial Transaction

Upon completion, any client profiles which have been inactive for more than 4 years but are linked to financial transactions issued within the last 7 years will be partially forgotten

Client profiles which have been inactive for more than 4 years and are not linked to any financial transactions issued within the last 7 years will be fully forgotten

Note: This 2-step process does not apply to method 1 where the purge is manually triggered for a single client profile from the Client Search dialog, as the client has requested the removal of their personal details. In this instance the client will be fully forgotten unless there are linked financial transactions within the last 'X' years, in which case it will be partially forgotten.

Folder Passenger Records

If a client profile is partially or fully forgotten, personal data that is stored in the folder passenger records of folders where that client profile is the folder client will also be purged.  The actions described below apply to ALL passenger records in ALL folders where that client profile is the folder client AND where the passenger record is not linked to its own client profile: 

This means that any folders where the folder client has been fully forgotten will no longer contain the original, actual passenger names - unless those passenger records are themselves linked to other client profiles

Similarly, any passenger records that are linked to a client profile that is partially or fully forgotten will be updated as per the table above.

When a folder’s passenger names are anonymised because the folder client profile has been fully forgotten the anonymised name will be displayed in the following areas of the folder item:

• Passenger/Pax dropdown fields:

e.g.

• Passenger tabs:

e.g.

The following information will be deleted in any folders where the folder client profile has been fully forgotten:

• The Folder Delivery Address
• Customer Address in the credit card details for credit card tickets