Log Reads

lubost

Is it possible to log reads from tables from within C/AL code?

Juhl

Not directly as far as I can think of.

But you could remove the table from the permissionset, if not using SUPER, and then give access through a codeunit, and log there.
Else do a solution in SQL.

Slawek_Guzek

Even on SQL it is not that easy. There is no trigger fired on read, and you need to restore to auditing or Extended Events. And even if you do it still won't give you information who exactly read the table - all you will get captured is the NST account.

Lastly - think about performance impact.

Slawek

lubost

Reason is GDPR, where reads of sensitive data should be logged. This requirement can be done by modifying OnAfterGetRecord triggers in pages (and report triggers), but I want to use more general solution independent from coding techniques and habits of programmers.
OnDatabaseRead trigger (CU1) should be very helpful.

Slawek_Guzek

To meet GDPR requirement it is enough to provide a list of users authorized to access sensitive data IMHO. I don't think you have to restore to logging every read from the database.

As far as I am into the implementing GDPR in my local conditions the company needs to prepare procedures of accessing/authorizing access to sensitive data, and register with local data commissioner all the repositories where sensitive information is held.

To my knowledge, there is no global detailed requirement to implement detailed data access log. Having said that each country prepares its own legislation, so you will likely have a different set of rules. Yet it is worth IMHO double checking with your regulator if you are not going over the top implementing detailed logging.

Slawek

lubost

Directive 216/680 in article 25 requests logging for acquire, modify, view, combine and deletion of data. These logs are requested to provide to legal authority for check.

Slawek_Guzek

Could you please post or send me the link please to the regulation.. I am quite interested to read this stuff myself.

lubost

http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016L0680&from=EN

In our country is this article applied slightly different but meaning is the same as in english version.

Slawek_Guzek

Thank you.

xStepa

Hi, I was thinking about the AccessByPermission (which will has only the DPO account) to hide selected fields on all default pages. Then (on selected pages) only a few fields with ShowOnRequest action button ... what do you think?

And B ) do you think that it is really needed when it is your legimitimate interest ... ? (of course you need to protect posted data, basicly only posted documents you can have without permission).

And C) under protection are only personal data (~B2C) - most of NAV users can really solve it only thru permissions and Change log (i think)

For me, it's more a company processes (internal or ISO) thing than hardcore programming in NAV ...

lubost

A) Agree to protect personal data against unauthorized displaying
I think (personally) that is not very usefull log all reads, but article says "must".
C) Change log does not logs reads

Agree (processes) but processes prevents against unauthorized view and I have to log authorized view too.

Slawek_Guzek

@lubost - what If you had a closed source system with no possibility to modify it? How would you comply?

lubost

Agree Slawek, but my task is not to discuss about other systems, but find a solution with low cost and hight generality.

Slawek_Guzek

You are in pretty much the same scenario - you can't really log all customer data reads from your system.

I have build a tool good few years ago which logged all usage of forms and reports. That was a part of a preparation to RTC upgrade, I needed to know what forms and reports are used and how often in order to skip converision of all others. I have come up with a tool which modified all the forms (in text form), and add a global variable to every one, and in OnOpenForm trigger inserted a call to to this var bases on a single instance codeunit, and this codeunit logged the call details in in-memory table Later on all logged data stored in this codeunit has been written to disk in OnCompanyClose

You could go the same path and log the user opening a page. And not every and all pages - only certain pages which dispay client's sensitive information. But it really depends on how you (and your lawyers ) interpret the GDPR regulation in your country.

If you insist that it says to log ALL the client data reads, and then you insist that your system need to do exactly that, and log even reads performed by the code (Cust.get(..) ) then you have a serious problem. Even if you come with some solution (I can suggest one) it will kick back causing enormous complexity and performance issues

So again - what it reallty necessary? Is there anywhere in your locally adopted version of GDPR regulation a requirement that a customer has a right to see who read his data down to when the data has been read and by whom? If not why do you try to log every customer data read? Perhaps it is enough to log who open the page showing the sensitive customer data.

It seems to me that you have focused purely on technical side of it, while the solution might be elsewhere.

Slawek

lubost

Thank you for your (long ) answer. I have used for a long time a short code in CU1 to log report usage so I have tool for logging reports. Your suggestion for pages seems easy to implement. I want to thank you for this suggestion. I hope that real implementation of GDPR will not be so hot as it seems now.
Our staff have to discuss with customer (and its security consultants) to purify the way to implement GDPR rules.