GDPR Delete SOP
This SOP covers how Fedora Infrastructure handles General Data Protection Regulation (GDPR) Delete Requests. It contains information about how system administrators will use tooling to respond to Delete requests, as well as how application developers can integrate their applications with that tooling.
Fedora Infrastructure Team
batcave01.iad2.fedoraproject.org Various application servers, which will run scripts to delete data.
Respond to Delete requests.
This section covers how a system administrator will use our
gdpr-delete.yml playbook to respond to a Delete request.
When processing a Delete request, perform the following steps:
Verify that the requester is who they say they are. If the request came in email ask them to file an issue at https://pagure.io/fedora-pdr/new_issue Use the following in email reply to them:
In order to verify your identity, please file a new issue at https://pagure.io/fedora-pdr/new_issue using the appropriate issue type. Please note this form requires you to sign in to your account to verify your identity.
If the request has come via Red Hat internal channels as an explicit request to delete, mark the ticket with the tag
rh. This tag will help delineate requests for any future reporting needs.
If they do not have a FAS account, indicate to them that there is no data to be deleted. Use this response:
Your request for deletion has been reviewed. Since there is no related account in the Fedora Account System, the Fedora infrastructure does not store data relevant for this deletion request. Note that some public content related to Fedora you may have previously submitted without an account, such as to public mailing lists, is not deleted since accurate maintenance of this data serves Fedora’s legitimate business interests, the public interest, and the interest of the open source community.
Identify the users FAS account name. The delete playbook will use this FAS account to delete the required data. Update the
fedora-pdrissue saying the request has been received. There is a 'quick response' in the pagure issue tracker to note this.
Login to FAS and clear the
Telephone numberentry, set Country to
GPG Key IDand set
Time Zoneto UTC and
enand set the user status to
disabled. If the user is not in cla_done plus one group, you are done. Update the ticket and close it. This step will be folded into the following one once we implement it.
If the user is in cla_done + one group, they may have additional data: Run the gdpr delete playbook on
batcave01. You will need to define one Ansible variable for the playbook.
sar_fas_userwill be the FAS username of the user.
$ sudo ansible-playbook playbooks/manual/gdpr/delete.yml -e gdpr_delete_fas_user=bowlofeggs
After the script completes, update the ticket that the request is completed and close it. There is a 'quick response' in the pagure issue tracker to note this.
This section covers how an infrastructure application can be configured
to integrate with our
delete.yml playbook. To integrate, you must
create a script and Ansible variables so that your application is
compatible with this playbook.
You need to create a script and have your project’s Ansible role install
that script somewhere (most likely on a host from your project - for
example fedocal’s is going on
fedocal01.) It’s not a bad idea to put
your script into your upstream project. This script should accept one
environment variable as input:
GDPR_DELETE_USERNAME. This will be a
Some scripts may need secrets embedded in them - if you must do this be
careful to install the script with
0700 permissions, ensuring that
gdpr_delete_script_user (defined below) can run them. Bodhi
worked around this concern by having the script run as
apache so it
could read Bodhi’s server config file to get the secrets, so it does not
have secrets in its script.
In addition to writing a script, you need to define some Ansible variables for the host that will run your script:
The full path to the script.
The user the script should be run as
You also need to add the host that the script should run on to the
[gdpr_delete] group in inventory/inventory: