DPIA Red Hat OpenShift

© 2021 Belastingdienst . Auteursrechten voorbehouden. Niets uit dit rapport mag worden verveelvoudigd en/of openbaar gemaakt door middel van druk, fotokopie, microfilm, digitale verwerking of anderszins, zonder voorafgaande schriftelijke toestemming van de Belastingdienst . © 202 4 Belastingdienst . Auteursrechten voorbehouden. Niets uit dit rapport mag worden verveelvoudigd en/of openbaar gemaakt door middel van druk, fotokopie, microfilm, digitale verwerking of anderszins, zonder voorafgaande schriftelijke toestemming van de Belastingdienst . s Umbrella DPIA Red Hat OpenShift Data protection impact assessment on the processing of personal data with Red Hat OpenShift Version 1.0 Date 10 February 2025 Version 1. 1 Final version Umbrella DPIA Red Hat OpenShift FINAL VERSION Colofon Umbrella DPIA by Belastingdienst SLM Rijk Red Hat Postbus 9050 7300 GM Apeldoorn Contact Project Name Umbrella DPIA report on Red Hat OpenShift Authors Privacy Company Arnold Roosendaal Winfried Tilanus Lennart Huizing https:// www.privacycompany.eu / Umbrella DPIA Red Hat OpenShift FINAL VERSION Change log Version Date Summary of input 0. 3 29 - 03 - 2024 Draft part A 0. 6 1 0 - 05 - 2024 Review s part A processed Draft full text 0. 9 15 - 06 - 2024 Prefinal, comments processed, summary added 1. 0 08 - 07 - 2024 Final version 1.1 10 - 02 - 2025 Update status final risk Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument.

Page 5 of 53 Summary This report contains the results of the data protection impact assessment (DPIA) on Red Hat OpenShift (“OpenShift”) . Privacy Company performed this DPIA on behalf of SLM Rijk Red Hat . The DPIA was based on extensive legal and technical research. This umbrella DPIA covers the deployment of OpenShift in datacentres, especially those that are controlled by the government, regardless of the underlying infrastructure: bare metal hosting, virtual machines or outsourced to a privately or government - owned data cent re (‘overheidsdatacentrum’ (ODC)). When hosted in a privately owned data centre, that data centre needs an own privacy assessment for its infrastructure. OpenShift is an open - source platform to run so - called ‘containerised’ applications. It consists of a group of open - source components that jointly form the platform. The OpenShift platform is maintained by Red Hat.

This umbrella DPIA has identified one high, one medium and one low privacy risk that can occur when mitigating measures are not in place. Risk no. R isk M easures government organisations M easures Red Hat 1 Low risk: Accidental inclusion of container layer personal data in logfiles and support requests Optional measure: Create clear and enforceable guidelines on the use of logging and namespaces for applications running in OpenShift containers None 2 High risk: Support site third - party tracking cookies without consent None Remove tracking cookies that are placed without consent . Update 10 - 02 - 2025: RedHat has change d the cookie settings accordingly 3 Medium risk: Inability to exercise rights for employees and administrators Explicitly include logfiles and support requests in the procedures for dealing with employee data subject requests, and inclusion of these processing activities in the registry of processing activities and the relevant privacy statements None The high privacy risk can be fully mitigated by Red Hat by removing the third - party tracking cookies that are placed unlawfully via the support website without consent.

The medium privacy risk can be fully mitigated when the government organisation ensures that the processing activities around logging and support requests are included in relevant privacy statements, procedures and the registry of process ing activities. The low privacy risk can be fully mitigated if the government organisations implement org anisational measures to prevent applications from running in OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 6 of 53 containers that violate security best practices, and by making sure the implementation of these best practices is regularly verified. When standard information security is in place there are no application data from the containers available for OpenShift . Proper configuration is necessary, but for the risk of data becoming available to Red Hat to materialise , a rogue administrator and a rogue developer would be needed .

Therefore, the risk of unintended disclosure of personal data is qualified as a low risk. After implementation of mitigating measures, no privacy risks associated with the use of applications running in OpenShift containers remain. The use of OpenShift itself does not create any high privacy risk to the general public or to employees of the gov ernment organisation, other than administrators. This means that the use of Red Hat OpenShift complies with the requirements of the GDPR and can be implemented without need for prior consultation with the data protection authority, as long as the context i n which OpenShift is implemented does not create specific privacy risks. Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 7 of 53 Samenvatting Dit rapport bevat de resultaten van de gegevensbeschermingseffectbeoordeling (DPIA) voor Red Hat Open S hift ( “ OpenShift ” ) .

Privacy Company he e ft deze DPIA uitgevoerd namens SLM Rijk Red Hat . De DPIA is tot stand gekomen op basis van uitgebreid juridisch en technisch onderzoek. Deze parap lu - DPIA betreft het gebruik van OpenShift in d ata centra, in het bijzonder datacentra onder controle van de overheid, ongeacht de onderliggende infrastructuur: bare metal hosting, virtual machines, of geoutsourcet aan een priv aat of overheidsdatacentrum (ODC). Indien OpenShift in een priva at datacentrum wordt gehost is e en aparte beoordeling vereist voor de infrastructuur van dat datacentrum. OpenShift is ee n open - source platform om zo geheten ‘gecontaineriseerde’ applicaties op te draaien. Het bestaat uit een set van open source componenten die gezamenlijk het platform vo rmen . Het Open Shift platform wordt beheerd door Red Hat. Uit deze DPIA blijken een hoog, een la a g en een medium privacyris ico dat kan optreden als er geen mitigerende maatregelen worden getroffen.

Ris ico no. R is ico Maatregelen overheidsorganisatie Maatregelen Red Hat 1 L aag Risico : Onbedoeld opnemen van persoonsgegevens uit de container layer in logfiles en support requests Option ele maatregel : Creëer duidelijke en afdwingbare richtlijnen over het gebruik van logging en namespaces voor applicaties die draaien in OpenShift containers Geen 2 H oog risico : Support site bevat third - party tracking cookies zonder toestemming Geen Verwijder tracking cookies die worden geplaatst zonder toestemmin g . Update 10 - 02 - 20 25: RedHat heeft de cookie i n stellingen a a ngepast naar complia nce 3 Medium ri sico : Onmogelijkheid voor medewerkers en beheerders om hun rechten uit te oefenen Neem logfiles en support requests expliciet op in de procedures voor o m gang met inzageverzoeken van medewerkers, en neem deze gegevens verwerki ngen op in het verwerkingsregister en de relevante privacyverklaringen Geen Het hoge privacyrisico kan volledig worden wegenomen door Red Hat door de third - party tracking cookies die zonder toestemming via de support website worden geplaatst te v erwijderen.

Het mediumrisico kan volledig worden gemitigeerd als de overheidsorganisaties de gegevensverwerkingen rond logging en support requests opnemen in de relevante privacyverklaringen, procedures en het verwerkingsregister. Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 8 of 53 Het lage privacyrisico kan volledig worden gemitigeerd als de o verheidsorganisaties organisatorische maatregelen treffen om te voorkomen dat applicaties in OpenShift containers draaien en daarbij best practices van informatiebeveiliging schenden, en door te borgen dat de implementatie van best practices regelmatig wordt geverifieerd. Met standaard informatiebeveiliging zijn er geen applicatiegegevens beschikbaar voor OpenShift. Een juiste configuratie is vereist, maar alleen met een kwaadwillende beheerder e n /of een kwaadwillende ontwikkelaar kan het risico dat gegevens toch beschikbaar komen voor RedHat zich redelijkerwijs voordoen.

Daarom is dit gekwalificeerd als een laag risico. Na het treffen van de mitigerende maatregelen resteren er geen privacyrisico’s in verband met het gebruik van applicaties die het draaien in OpenShift containers. Het gebruik van OpenShift zelf levert geen hoog privacyrisico op voor het algemene publiek of voor de medewerkers van een overheidsorganisatie, anders dan de beheerders. Dit betekent dat het gebruik van Red Hat OpenShift voldoet aan de vereisten van de AVG en kan worden geïmplementeerd zonder dat voorafgaande raadpleging bij de Autoriteit Persoonsgegevens verplicht is , zolang de context waarin OpenShift wordt ingezet geen specifieke eigen privacyrisico’s creëert . Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 9 of 53 6.2 Interests of Red Hat/IBM 35 6.3 Interests of data subjects 35 7. Location of personal data processing 35 8.

Techniques and Methods of the Data Processing 35 9. Additional Legal Obligations 35 9.1 ePrivacy Directive 35 9.2 Baseline Information Security Government (BIO) 36 10. Retention Periods 36 Part B. Lawfulness of the data processing 37 11. Legal Grounds 37 11.1 Consent 37 11.2 Processing is necessary for the performance of a contract 37 11.3 Processing is necessary to comply with a legal obligation 37 11.4 Processing is necessary for a task in the public interest or for the legitimate interests of the controller or a third party 37 11.5 Valid legal grounds 38 12. Special categories of personal data 38 13. Purpose limitation 38 13.1 OpenShift layer processing activities 39 13.2 Container layer processing activities 40 13.3 Support requests 40 14. Necessity and proportionality 41 14.1 Assessment of the proportionality 41 14.2 Assessment of the subsidiarity 42 15. Rights of data subjects 43 Part C. Discussion and Assessment of the Risks 45 16.

Privacy Risks 45 16.1 Assessment of risks 45 16.2 Summary of privacy risks 46 Part D. Description of risk mitigating measures 47 17. Risk mitigating measures 47 17.1 Measures to be taken to mitigate privacy risks 47 17.2 Assessment of risks after taking mitigating measures 48 Conclusion 49 Appendix 1 – Technical research protocol i Appendix 2 – Test scripts ii Appendix 3 – Endpoints of Red Hat support site iii Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 11 of 53 Introduction The Dutch Strategic Vendor Management Red Hat (SLM Rijk Red Hat ) , as executed by the Tax and Customs Administration (Belastingdienst, hereinafter “ BD ” ) , commissioned this umbrella data protection impact assessment ( umbrella DPIA ) , to be executed by Privacy Company on Red Hat OpenShift (OpenShift) . This umbrella DPIA is meant to provide a general overview of the risks for the rights and freedoms of data subjects (hereinafter “ privacy risks”) that relate to the use of the OpenShift solution when used by a gov ernmental organisation.

The umbrella DPIA will provide Dutch governmental organisations with a generic privacy assessment on the use of OpenShift . Based on this umbrella DPIA, technical and organisational measures are identified to mitigate these privacy risks. This umbrella DPIA covers the deployment of Open Shift in datacentres , especially those that are controlled by the government , regardless o f the underlying infrastructure : bare metal hosting, virtual machines or outsourced to a privately or government - owned data centr e (‘overheidsdatacentrum’ (ODC) ) . When hosted in a privately owned data centre, that data centre needs an own privacy assessment for its infrastructure. Data Protection Impact Assessments Under the terms of the General Data Protection Regulation (GDPR), an organisation may under certain circumstances be obliged to carry out a data protection impact assessment (DPIA). According to a rticle 35, GDPR, a DPIA is required where the organisation is planning to process personal data and this processing can likely lead to high risks to the rights and freedoms of the data subjects.

DPIAs are intended to shed light on, among other things, the specific processing activities, and the implied risk to data subjects, and to propose safeguards to mitigate these risks. The purpose of a DPIA is to ensure that any privacy risks, that are attached to the process in question, are mapped and assessed in advance , so that adequate safeguards to mitigate those privacy risks can be implemented. A DPIA is connected to the right to data protection, which is enshrined in the Charter of Fundamental Rights of the European Union. A DPIA however also considers risks to other fundamental rights and freedoms, such as the freedom of expression, that are be yond the realm of privacy. Consideration 4 of the GDPR explains: “ This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and fam ily life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, relig ious and linguistic diversity ”.

Umbrella DPIAs versus individual DPIAs This document does not contain a full DPIA into the risks to the rights and freedoms of data subjects associated with a processing activity , but rather an investigation into the privacy risks associated with a specific technical platform . To standardise the use of software throughout Dutch national government institutions, a series of these umbrella DPIAs have been commissioned, with each one cover ing the use of a specific software solution or platform . These umbrella DPIAs assess the privacy risks that can be connected to most or all implementations of the software within the government, but do not consider the specific privacy risks that are connected to the purposes of each specific organisa tio n ’ s processing activities while using the software solution . Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 12 of 53 This umbrella DPIA is therefore meant to help all organisations within the Dutch national government with the DPIA they may need to conduct when they intend to deploy solutions using OpenShift , considering the specific context in which the ir organisation intend s to use the system .

These individual contexts could not be taken into consideration for this umbrella DPIA . This means that the legitimacy of the purpose and the legal grounds of the organisation could not be definitively investigated . This document therefore informs, but does not replace, the specific risk assessments the different government organisations implementing OpenShift may be required to mak e. Scope of this umbrella DPIA This umbrella DPIA applies to the use of OpenShift by Dutch governmental organisations. OpenShift offers a standardized and portable way of hosting custom applications . These applications run in so - called ‘containers’ , that can run custom software in a reliable and scalable way. Open S hift provides a management layer for these containers, making it easy to deploy solutions and to scale their operation. OpenShift runs on top of the Red Hat Enterprise Linux CoreOS (RHCOS) operating system.

RHCOS can be run on various infrastructures, virtual machines of different types , and bare metal machines , which can be run by the governmental organisation itself, by government - owned d ata cent re s like ODC - Noord, or by many other commercial cloud providers . OpenShift requires external storag e. In a typical setup, this is provided by a storage cluster that is not included in the scope of this umbrella DPIA . OpenShift and RHCOS are opensource products , developed by Red Hat Inc . Red Hat is an American software company, that is a subsidiary of IBM. Red Hat markets enterprise level versions of OpenShift and RHCOS and provides support and maintenance for the software. In scope are: • The Red Hat OpenShift container platform • The processing of data from the containers in RHCOS • The maintenance processes of Red Hat for OpenShift and RHCOS • The support processes of Red Hat for OpenShift and RHCOS Not in scope are: • The applications running in the container • The machines or platforms on top of which RHCOS runs • The storage cluster • The use of government - owned infrastructure • The use of an infrastructure by a commercial cloud provider Dependencies The following situa tions and architecture decisions can impact the interpretation of the findings of this umbrella DPIA: • When a governmental organisation is running RHCOS on top of a commercial cloud service, the impact of the cloud service on the rights and freedoms of data subjects needs to be separately assessed in a DPIA specific for that cloud provider . • This umbrella DPIA does not assess the privacy impact of the containerised applications running on OpenShift , only the use of OpenShift itself .

When assessing the privacy of a containerised application, the Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 13 of 53 governmental organisation can rely on this umbrella DPIA for the assessment of privacy risks caused by the infrastructure layer . • Some privacy risks identified by this umbrella DPIA may be assessed differently when using a hosting provider other than ODC - Noord. Especially Risk 1: Accidental i nclusion of container layer personal data in logfiles and service requests and Risk 3: Inability to exercise data subject rights for employees and administrators may differ with differ ent hosting. Outline of this umbrella DPIA This umbrella DPIA assesses the use of OpenShift by Dutch governmental organisations and follows the structure of the ‘ Model Gegevensbeschermings effect - beoordeling Rijksdienst (DPIA) ’ (September 2017). 1 This model uses a structure of four main parts: A. Description of the factual data processing B. Assessment of the lawfulness of the data processing C. Assessment of the risks for data subjects D. Description of mitigation measures Part A explains the processing of personal data when using OpenShift in detail, based on the specific deployment and configuration used by Dutch governmental organisations.

This part of the umbrella DPIA starts with a description of the way personal data are collected , stored, and processed and describes the categories of personal data and data subjects that may be affected by the processing, the purposes of the data processing, the different roles of the parties, the different interests related to this pro cessing, the locations where the data are stored , and the retention periods. For this part, project documentation has been investigated, as well as the contracts with vendors, including with Red Hat . For t he technical research, documentation was investigated, as well as the storage and network traffic of O pen Shift and RHCOS. A support request, including data gathering from the test system was submitted to Red Hat and a data subject access request was submitted to Red Hat . Part B provides an assessment by Privacy Company, with input from ODC - Noord and Red Ha t , of the lawfulness of data processing activities with the use of OpenShift .

This analysis starts with an analysis of the applicable legal grounds for the processing . Subsequently, Privacy Company has assessed conformity with the key principles of data processing, including transparency, data minimisation, purpose limitation, as well as the necessity and proportionality of the processing, as far as possible in an umbr ella DPIA where the context is not always fully established. Part C assesses the risks to the rights and freedoms of the data subjects created by the processing activities identified in OpenShift in Part A of this umbrella DPIA . It names specific risks that derive from these processing activities and aims to specifically determine both the likelihood that these risks may occur, and the severity of the impact on the rights and freedoms of the data subjects if the risks occur. Finally, Part D contains concrete measures that can be taken by either Red Hat , the hosting provider, or the individual governmental organisation to mitigate the privacy risks identified in Part C. These measures might either reduce the chance the privacy 1 The Model Data Protection Impact Assessment federal government (DPIA).

The first version of this model is used, as newer models do not change the core structure, and the added tables are not always compatible with the challenges of an umbrella DPIA. Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 14 of 53 risks occur, or the impact they might have, or both. Part D also contains an assessment of any residual privacy risk attached to the use of OpenShift , that could not be mitigated by applying the suggested measures. If such unmitigated privacy risks remain, the government organisation implementing OpenShift may be required to consult the supervisory agency prior to the processing. Technical research The main element of this umbrella DPIA consists of technical research into the investigated products. Privacy Company applied five different technical research methods: 1 Analy sis of publicly available technical documentation on OpenShift and RHCOS ; 2 O bserv ation of the behaviour of OpenShift and RHCOS during the running of the test scenario; 3 Analysis of storage usage and logfile generation by RHCOS; 4 Interception and decoding of traffic to and from the management console and the Red Hat support portal; 5 Examination of the network routing in OpenShift.

During the investigation it became apparent that only in exceptional circumstances , that would violat e several ( security) best practices , it could be possible for personal data to leave the container in which the application is running. No personal data from within the container can therefore be expected to be transmitted to Red Hat in any way. This made the following investigation methods obsolete , as n o viable way was discovered where these could contain personal data from the containers: 1 Interception of the network traffic to and from RHCOS; 2 Filing of a support request to Red Hat, including collection and sending of diagnostic data; 3 Filing a data subject access request directly with Red Hat for personal data collected. The test ing scenarios were: 1 Opening and navigating the OpenShift management console to perform a basic administrative task. 2 Executing a program within a container with mounted storage .

This program performs the following actions: a W rite personal data o f one of the researchers to the storage. b Log personal data of one of the researchers by writing to the standard out of the program . 3 Preparing and submitting a support request at Red Hat contai ni ng: a A n ‘ sos report’ b A ‘ must - gather’ report After preparing the support request and after verifying this support request does not contain personal data from the application running in the container, the investigators refrained from submitting the support request. Privacy Company ensured that both the research and the analysis of the results are reproduceable and repeatable. This was achieved by performing the testing on a freshly installed setup of RHCOS and OpenShift. This system was configured according to the default configuration cr e ated by ODC - Noord for RHCOS and OpenShift . ODC - Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument.

Page 15 of 53 Noord uses version control for their configuration management, so the configuration can be recalled or even be recon structed when needed . Browser - based testing was done with a Firefox browser, using a clean profile. The browser - based tests were executed with a small break between each step, in which screenshots were made between the steps to document the process. A ll traffic to and from the devices was captured in the background for later analysis. The analysis of the captured traffic consisted of both manual inspecti on and of automated analysis (with programmed scripts) , to reproduce the results as seen during manual inspection. Part of the automated analysis were ‘whois’ 2 lookups both on the domain names used and the IP - addresses traffic was observed to go to . These lookups provide ownership and country information , as they are registered with the subsequent registries for domain names and IP - addresses.

Location estimations were supported by performing traceroutes to observe the internet routing to a server as well as the packet roundtrip times. During testing the following setup was used: - RHCOS o Red Hat Enterprise Linux CoreOS o Version 412.86.202310141028 - 0 (Ootpa) o amd 64 architecture o Kernel version 4 .18.0 - 372.76.1.el8_6.x86_64 o C onfiguration as provisioned by ODC - Noord o S etup date November 17th 2023 o T esting date(s) December 1th 2023 – March 29th 2024 - OpenShift o V ersion 4.12.39 o C onfiguration as provisioned by ODC - Noord o S etup date November 17 th 202 3 o T esting date(s) December 1th 202 3 – March 29 th 2024 - Browser for testing administrative and support site o Fir efox for Windows o V ersion: 124.0.1 (64 - bit) o C lean profile before each test - Traffic interception for testing administrative and support site o MITM Proxy o V ersion: 10.2.2 (Python 3.11.8, OpenSSL 3.1.4 24 Oct 2023 ) o C ertificate installed in OS Timeline of this umbrella DPIA This Umbrella DPIA was commissioned by the BD in October 2023.

A kick - off meeting was held on 17 October, 202 3 , in attendance of representatives of the BD, ODC - Noord, Red Hat and Privacy Company. During this session, the testing setup and contractual landscape were examined, documentation was requested and plans for testing were made. A follow - up meeting to discuss the parameters of the testing environment was held in attendance with ODC - Noord and Privacy Company on 6 November, 2023. The testing environment was delivered by ODC - Noord on 17 November. Testing commenced on December 1 with initial operational tests aimed at creating a full testing scenario. This scenario was discussed with ODC - Noord on 26 2 RFC - 3912, https://datatracker.ietf.org/doc/rfc3912/ Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 16 of 53 January, 2024. Testing continued until 29 March, when the first draft of part A of this umbrella DPIA was delivered to the BD and the other stakeholders for review.

Review comments were obtained from the BD, Red Hat, and ODC - Noord. The comments were processed, most being accepted into the final draft version of Part A. This led to some additional testing of alternative scenarios. This was done in the period 16 April to 3 May 2024. The full final draft was sent to the BD and the other stakeholders on 1 0 May for review. Disclaimer This umbrella DPIA assesses privacy risks associated with the use of OpenShift but cannot take into consideration the circumstances of deploying this software in a specific environment. Any governmental organisation that is deploying solutions that include OpenShift will have to consider whether their use of the software requires a full DPIA and will have to re - examine the findings of this umbrella DPIA in the context they operate in. T he hosting solution underlying RHCOS and the application running in the container need to be assessed separately.

This umbrella DPIA can serve as a basis for these specific DPIAs but cannot replace them altogether. Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 17 of 53 Part A. Description of the Data Processing 1. Description of the Processing activities 1.1 A rchitecture of the system OpenShift is an open - source platform to run so - called ‘ containerised ’ applications. It consists of a group of open - source components that jointly form the platform 3 . The OpenShift platform is maintained by Red Hat. 4 Container technology is a way to separate applications from each other and from the underlying operating system, making it easy to transfer the run - time environment to another machine. Because several instances of the same application can run in multiple c ontainers at the same time, this also improves scalability of the application, as well as reliability.

As can been seen in Figure 1 , the containers share the operating system of the machine they run on and use the separation functions of that kernel. Each container ha s its own configuration file s and libraries . This is different from virtual machines, where the separation functions of the processor , rather than the kernel, are used and where each virtual machine runs its own full operating system. OpenShift offers Linux containers the ability to run on top of the shared Linux kernel. The containers deployed by OpenShift are stateless, meaning that each time a container and its apps are started , the container is newly created . Whenever an application needs to store information, the container can be configured to have access to external storage. 3 August Simonelli: Red Hat tested solution: Red Hat OpenShift Container Platform 4.6 and 4.7 on Red Hat OpenStack Platform 16.1; https://www.redhat.com/rhdc/managed - files/cl - openshift - on - openstack - reference - architecture - f28297 - 202105 - en.pdf (retrieved on 13 November 2023) 4 https://www.redhat.com/en/technologies/cloud - computing/openshift Figure 1 – Containers – separation on top of the Linux Kernel Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 18 of 53 1.1.1 Container management OpenShift uses the CRI - O 5 container server software to setup and configure the containers.

CRI - O supports the ‘ Open Container Initiative Runtime Specification ’ 6 , so the containers can also be used on other systems. CRI - O is controlled by Kubernetes 7 . Kubernetes is a system to describe containers and to orchestrate the creation of them . 1.1.2 Network OpenShift uses a software - defined network for the communication between containers , and between the containers and the external network and internet . The Red H at reference setup 8 for this network is Open Virtual Network 9 in combination with the Kuryr 10 software to manage Open Virtual Network. K uryr , for its part , can be configured with Kubernetes commands, which allows for central management by Kubernetes software. The setup ODC - Noord provides, uses Calico 11 instead of Open Virtual Network and Kuryr . Calico provides both the virtual network itself and the 5 https://cri - o.io/ 6 https://github.com/opencontainers/runtime - spec 7 https://kubernetes.io/ 8 August Simonelli: Red Hat tested solution: Red Hat OpenShift Container Platform 4.6 and 4.7 on Red Hat OpenStack Platform 16.1; https://www.redhat.com/rhdc/managed - files/cl - openshift - on - openstack - reference - architecture - f28297 - 202105 - en.pdf (retrieved on 13 November 2023) 9 https://www.ovn.org/ 10 https://github.com/openstack/kuryr 11 https://www.tigera.io/project - calico/ Figure 2 – Container management Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument.

Page 19 of 53 management of it with Kubernetes commands . When deploying containers, OpenShift gives the option to setup load - balancing between multiple instances of the same containerised application. OpenShift uses Octavia 12 to manage the load balancing. 1.1.3 Underlying operating system and infrastructure Red Hat bundles OpenShift together with Red Hat Enterprise Linux CoreOS (RHCOS) , a variant of Red Hat Enterprise Linux (RHEL) that is specifically tailored to run OpenShift. 13 RHCOS is only intended to be used as the foundation for OpenShift and is not supposed to be customised (although it can be with some effort), nor is the user supposed to install any custom software on RHCOS. OpenShift and RHCOS can be downloaded and used without charge under their open - source license s . Red Hat offers paid support on its use , as well as premium proprietary methods to install ation and upgrad ing .

Access for configuration and maintenance can either be managed by a bundled Keystone authentication server or by an external LDAP server. The containerised applications must arrange for their own security and access management. RHCOS with OpenShift can be run on a variety of platforms. It can be installed directly on a bare metal server , or it can run on Virtual Machines. Both virtual machines running on customer - owned hardware , and virtual machines provided by cloud providers are supported. One of the virtualisation systems OpenShift can run on is the Red Hat OpenStack virtualisation environment. When using OpenStack, the OpenShift management interface can also control some features of the underlying OpenStack environment , includ ing load b alancing. Red Hat offers hosted OpenShift environments on Amazon AWS, Microsoft Azure, Google Cloud , and IBM Cloud. The Dutch government data centre ODC - Noord also provides OpenShift environments .

Only the hosting solutions of ODC - Noord have been examined for this umbrella DPIA. 1.2 Storage of data Because the containers are newly created at each (re)start, they do not have any persistent memory or storage on their own. Instead , they must rely on external storage . In practice this will always be a storage cluster. OpenShift supports a wide array of storage clusters, both local and cloud based . ODC - Noord offers storage on a 12 https://github.com/openstack/octavia 13 https://docs.openshift.com/container - platform/4.1/architecture/architecture - rhcos.html (retrieved on 10 November 2023) Figure 3 – Open S hift networking as configured by ODC - Noord Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 20 of 53 Ceph storage cluster 14 . Not only the containers need external storage, RHCOS itself needs external storag e for the storage of configurations and logfiles. The Red Hat reference architecture for Open Shift 15 notes that Red Hat tests only with the Ceph backend .

The storage cluster s are not part of this umbrella DPIA, but the data stored by OpenShift have been included in the investigat ion . 1.3 Management environment OpenShift offers system administrators and software developer s an online management environment . This environment is accessible with a web browser. Through this management environment, every aspect of OpenShift can be managed. This management environment is hosted on special containers, running on the same OpenShift cluster. These containers are replicated across several so - called “ availability groups ” and the load balancer manages their availability. Th e users of the management environment can choose betwe en functions aimed at system administrators and functions aimed at software developers. Figure 4 - OpenShift management console The management environment enables system administrators and developers to: • m onitor cluster health and performance • a dd extensions to the cluster • create containers • manage and organise containers • manage the virtual network • manage connections to the storage cluster • configure the monitoring of the cluster • manage and configure the RHCOS (virtual) machines • manage administrator accounts and access 14 https://ceph.io 15 August Simonelli: Red Hat tested solution: Red Hat OpenShift Container Platform 4.6 and 4.7 on Red Hat OpenStack Platform 16.1; https://www.redhat.com/rhdc/managed - files/cl - openshift - on - openstack - reference - architecture - f28297 - 202105 - en.pdf (retrieved on 13 November 2023) Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument.

Page 21 of 53 • update the OpenShift software • manage resources used by OpenShift 1.4 Logging of data and l og management OpenShift uses the logging facilities offered by RHCOS to log system events. These may include activities of the administrators. The applications running in the containers can either store logs by writ ing them to the application ’ s ‘stdout’ ( standard text output) or to setup their own logging facility. When writing to the stdout , OpenShift picks up the text written by the application and stores it in a logfile specific for that container within the logging structure of RHCOS. Note that many applications use stdout to give (debug) messages to the developers , testers , and system administrators. The verbosity of the messages written to std out and the amount of personal data they contain can vary vastly between applications. When ever an application uses its own logging facilities , the application may write log files to the external storage cluster.

Another route would be to use a separate log server that was setup specifically for this task . F or example , one that is running in a separate container in the same cluster or in a different location . The containerised application could then send log messages to this log server. This log server could then further process and possibly store these messages. An external log server running in a container on the OpenShift c luster may also have the rights to access the OpenShift and the stdout log ging stored in RHCOS. This way it could process system events of OpenShift in addition to any logs sent directly to the log server . Such a log server could pass selected log messages on wards to an external service for log analysis , or to a security operations service. ODC - Noord deploys such a setup , forwarding the log messages to its own endpoint for storage , to make it compliant with the Baseline Informatiebeveiliging Overheid ( BIO ) . 16 The configuration of the logging of the application running in the contaier is solely determined by the develo pers of th at application.

The administrators of the OpenShift cluster may provide facilities and may decide to use those facilities to also log events of the cluster, including stdout logging of the containers. Red H at has no means to configure or access any of these. 1.5 License checking Red Hat licenses RHCOS on a per - installation base and OpenShift on a per - CPU base. 17 On the tested environment this was not enforced by technical means , which means that no information was automatically transmitted to Red Hat for the purpose of license checking . 1.6 Support procedure The services of Red Hat for ODC - Noord include technical support. System administrators of ODC - Noord can submit support requests to Red Hat’s support web site. Depending on the request , Red Hat may ask for additional information. This request for additional information may include requesting the output of two small programs that are designed to collect information from the system and prepare the information for submitting. 16 https://bio - overheid.nl/ , see chapter 9 for more details on the BIO. 17 Red Hat : Product Appendix 1 Software and Support Subscriptions, appendix at “The Red Hat Enterprise Agreement EMEA ”, July 2022. p .12 - 15 Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 22 of 53 1.6.1 Collection of data for support requests In response to a support request the Red Hat support team may ask the system administrators to run one o r two command - line scripts that can gather diagnostic data: “sos report” 18 and “oc adm must - gather” (“must - gather”) 19 .

Both scripts can easily be expanded with modules that gather additional types of data. Both scripts can be configured through configuration files and their behaviour can be modified by command line arguments when invoking them. The sos report script is an open source 20 script that can gather diagnostic information from several Linux distributions, including Red Hat Enterprise Linux and RHCOS. It is tailored to troubleshoot issues at the operating system level. It comes with several hundreds of available plugins aimed at gathering information on specific parts of the system , or on specific applications . This includ es modules for OpenShift and CRI - O . These plugins collect configuration data and may or may not collect specific logfiles, sometimes also depending on the command line arguments given to sos report . Among the generic log files that sos report can colle ct are authentication logs and audit logs.

The must - gather script is part of the OpenShift system and is specifically aimed at diagnosing issues with OpenShift. Both the ‘oc’ 21 script and the must - gather 22 plugin it uses are open - source software . The must - gather plugin is itself modular and many plugins are freely available . Must - gather runs in its own container and writes its output to the filesystem from where it was in voked. The collection scripts that are to must - gather by default include scripts for gathering audit logs, authentication logs, the logfiles of the containers and the logfiles of every other component of OpenShift. Must - gather also collects all configurations of OpenShift components. When results of running a script are shared with RedHat support, it has to be taken into account that these may include personal data . 1.6.2 Test results 1.6.2.1 Logging, must - gather , and sos report Using a YAML script (see: Appendix 2 – Test scripts ), a container was created that wrote personal data about one of the investigators to the stdout .

This information was automatically sent on to the logfile of the container in OpenShift . The personal data showed up in the container log in the management console and was accessible from the command line interface of the OpenShift installation. Note that writing personal data processed within a container to stdout is considered bad practice for administrators . The logging to stdout of a production environment should only contain events that cannot be logged to other facilities, for example when the appli cation fails to start up, a trace when the application crashes or issues that prevent the application 18 https://access.redhat.com/documentation/en - us/red_hat_enterprise_linux/8/html/generating_sos_reports_for_technical_support/generating - an - sos - report - for - technical - support_generating - sos - reports - for - technical - support , retrieved on 26 November 2023 19 https://docs.openshift.com/container - platform/4.14/support/gathering - cluster - data.html , retrieve d on 26 November 2023 20 https://github.com/sosreport/sos 21 https://github.com/openshift/oc 22 https://github.com/openshift/must - gather Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument.

Page 23 of 53 from connecting to other logging endpoints. For development purposes, verbose debug logging to stdout that contains personal data is possible , but such logging should never be enabled in a production environment. Figure 5 - Container log For testing purposes, t wo test application s w ere run in the testing environment: one running in the ‘Default” namespace and one running in the “ kube - public ” namespace. Note that running a n application in the ‘Default’ namespace is possible, but constitutes a violation of the OpenShift security guidelines: the ‘Default’ namespace is reserved for com ponents of OpenShift itself. 23 Subsequently , an “oc adm must - gather” and a n “sos report” command were executed according to the instructions as published by Red Hat on their support website. 24 The “sos report” was run a second time, this time without any command - line arguments. During the run , must - gather listed all files it included in the report.

The sos report output showed a warning about potentially sending sensitive information to Red Hat : sosreport (version 4.6.1) This command will collect diagnostic and configuration information from this Red Hat CoreOS system. An archive containing the collected information will be generated in /host/var/tmp/sos.y_zsr48x and may be provided to a Red Hat support representative. Any information provided to Red Hat will be treated in accordance with the published support policies at: Distribution Website : https://www.redhat.com/ Commercial Support : https://access.redhat.com/ 23 http://static.open - scap.org/ssg - guides/ssg - ocp4 - guide - cis.html 24 https://docs.openshift.com/container - platform/4.12/support/gathering - cluster - data.html Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 24 of 53 The generated archive may contain data considered sensitive and its content should be reviewed by the originating organization before being passed to any third party.

No changes will be made to system configuration. Press ENTER to continue, or CTRL - C to quit. A search for the name of the researcher in both the must - gather report and the sos report showed that they both contained the logged personal information of the application while it is running in the ‘Default’ namespace . Bot h when used with or without the extra command line parameters , the sos report output contain s the same personal data. Must - gather: quay - io - openshift - release - dev - ocp - v4 - 0 - art - dev - sha256 - cc6dd96281d1a85829fab5582dfec273f6787d0d051f4e5a51626d9a00b6f4e2/n amespaces/default/pods/dpia - container - pg - no - storage/dpia - container - pg - no - storage/dpia - container - pg - no - storage/logs/current.log:2024 - 03 - 2 4T20:46:26.142757046Z 43547 (Winfried Tilanus) flagged by fraud detection SOS report: var/log/pods/openshift - debug - 27l9v_os4 - worker - m - gn2b - npltd - debug_3a1ba489 - 5097 - 4632 - 9293 - 42e6b9d3e5d6/container - 00/0.log:2024 - 03 - 24T23:26:26.714634056+00:00 stdout F sos_commands/crio/containers/logs/crictl_logs_ - t_71db5dd4fa73d91b5b08b19ba9ece49841b09646a 11256c0ad64f2a427d66e 57:2024 - 03 - 24T20:46:26.142757046Z 43547 (Winfried Tilanus) flagged by fraud detection When running in the kube - public namespace, neither must - gather , nor sos report included the personal data of the researcher .

Hence, personal data from the containers can theoretically end up in a support request , but only when all of the following conditions are met: 1 The application runs in the ‘Default’ namespace . This is a violation of the security best practices. 2 The application writes personal data to stdout. This is a violation of the security best practices . 3 The administrator of the OpenShift cluster requests support from Red H at and sends the output of ‘oc adm must - gather’ or ‘sos report’ to Red H at. Additionally , the webserver logs of the administration interface were included in both files. These contain the IP - addresses of the administrator and details about the actions of the administrator. These are personal data about the administrator. The username of the administrator was also included in the files, but not in a context that enabled deduction of any behavior of the administrator.

None of the filenames included in the Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 25 of 53 reports contained personal data. The reports did, however, contain the YAML scripts use d to set up the containers. If these contain personal data or other sensitive information , these data could be sent to Red H at when ever a must - gather of a n sos report is requested by Red Hat support. This can only occur in violation of at least two separate security best practices and on top of it, the administrator requesting support needs to be submit the collected files without a review of the data it contains . 1.6.2.2 OpenShift console The administrators of OpenShift can access their installation through a management console. This console is hosted on the same cluster as the OpenShift installation itself. The console redirects the administrator to a different domain name to log in , but this domain is also hosted on the cluster.

These two domains are the only two domains the browser makes requests to w hen using the console . B oth domains set cookies, six distinct cookies in total, all of them contain ing authentication tokens. Five of the co okies expire at the end of the browser session . One cookie called ‘ openshift - session - token’ expires after twelve hours. Figure 6 : OpenShift management console 1.6.2.3 Red Hat support site The OpenShift management console contains a link to the Red H at support site at https:// access.redhat.com/ . Because the researchers did not have a support account at Red H at, this site was only investigated up to its login page. Upon opening the support page, the browser was redirected to a Red H at login page: https://sso.redhat.com/ . Both of these domains displayed the same cookie consent screen: Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 26 of 53 Figure 7 – Red Hat support site cookie consent statement The “Privacy Statement” link at the cookie consent popup links to: https://www.redhat.com/en/about/privacy - policy .

For testing purposes, the option “Proceed with Required Cookies only” was selected. A choice on the cookie consent screen in one of the pages was effective for both. During the loading of the support site and the login page, the browser made 199 requests to 27 distinct hostnames . The registrants (‘owners’) of the hostname were: Table 1 – Overview of hostnames called from the Red Hat support website and its login page Registrant Number of hostnames Red Hat 7 Adobe Inc. 4 Trustarc 3 Oracle Corporation 2 Salesforce.com Inc. 2 Sentry 2 Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 27 of 53 Registrant Number of hostnames Bombora 1 Demandbase 1 Fontawesome 1 Freewheel 1 Google LLC 1 The Trade Desk, Inc. 1 Twitter, Inc. 1 All Red Hat hosts were hosted on a n IP address registered to Akamai . During test ing, the following cookies were set by the support websites : Table 2 – Cookies from the Red Hat support website found during testing Host Cookie name Expiry analytics.twitter.com personalization_id 1 Year(s) c.la2 - c2 - ph2.

S alesforceliveagent.co m X - Salesforce - CHAT Session cm.everesttech.net 27 loqua 27 _g_v2 Tue, 25 - Mar - 2025 18:16:19 GMT 27 loqua 27 _session_v2 Session cm.g.doubleclick.net IDE Session test_cookie Session dpm.demdex.net demdex 5 Month(s) dpm 5 Month(s) id.redhat.com 168f7f24cd6392ceb8082ae3dfd8aaba Session rh_common_id Session match.prod.bidr.io bito Session bitoIsSecure Session checkForPermission Session s1795.t.eloqua.com ELOQUA Session ELQSTATUS Session smetrics.redhat.com s_ecid 1 Year(s) Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 28 of 53 Host Cookie name Expiry sso.redhat.com 2a4bcc483fa585dc0ad94b51550d092 3 Session AUTH_SESSION_ID Session AUTH_SESSION_ID_LEGACY Session KC_RESTART Session The non - session cookies are set by Red Hat ( smetrics.redhat.com ) , probably for website statistics and session management, by Adobe ( dpm.demdex.net and cm.everesttech.net ) , and by X ( formerly known as Twitter, analytics.twitter.com ). 1.6.2.4 Network traffic The researchers inspected the routing information of the virtual network of OpenShift.

This virtual network is both used for communication of OpenShift itself and for communication of the applications running in the containers. The routes define to which endpoints outside OpenShift installation network traffic is possible. Because the test application did not confi gure any network facilities, it should not be included in the routes. In total nine routes were configured. F our routes were connected to performance and security monitoring of the cluster and two routes were connected to the management console . T he other routes were connected to the upgrading of the OpenShift software, accessing help pages from the management console and authentication of the management console. All of these routes pointed to services under control of ODC - Noord. 1.6.2.5 Storage The containers can optionally connect to external storage. This external storage is out of scope of this umbrella DPIA.

Because no further storage was found that could be used for storage of personal data, the storage was not further investigated. 1.6.2.6 Data subject access request Since no personal data from the containers was found to be sent to Red H at , a data subject access request would not produce any relevant material to this umbrella DPIA . A request was therefore not submitted . 2. Personal Data and Data Subjects 2.1 Possible types of data subjects Three groups of data subjects have personal data that gets processed within the scope of this umbrella DPIA: 1 Administrators: Administrators working for the government organisation or the hosting party 2 Employees: Other e mployees (including contract workers) of the government organisation using the applications in the containers Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 29 of 53 3 General public: D ata subjects whose personal data is being processed with in the Containers .

Depending on the application running in the Container, this may be a subset of the public as a whole . I n many cases , the se data subjects may be particularly vulnerable, including for instance applications processing personal data of children, people with developmental disabilities, people with severe (mental) health problems, or people without sufficient understanding of the Dutch language, which may impact the risk level of the processing activitie s. A fourth group is only tangentially relevant to this umbrella DPIA , as the processing activities associated with this group are not directly through OpenShift, but only through the business processes of Red Hat : 4 Red Hat’s business contacts at the government organisation, whose data is processed by Red Hat for its legitimate business purposes. 2.2 Possible categories of personal data For the operati on of OpenShift , personal data gets processed in five separate layers , with different actors interacting in different ways with the processing .

These layers and the way the different actors are expected to behave, have been summarised in Figure 8 below. The government organisation will under all circumstances be the sole data controller for the processing activitie s using OpenShift. Only in the context of support requests could the hosting party and Red Hat have access to diagnostic data of the container . However, only when the government organisation violates at least two security best practices ( setup in wrong namespace and writing data to s td out, see paragraph 1.6.2.1 ) these diagnostic data can include container content and therefore personal data that was included in container logfiles . Only in the context of its legitimate business purposes, such as billing, should Red Hat ever hav e access to Customer Account Data. In these situations , it should be the Figure 8 - overview of data categories and processing roles. Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 30 of 53 controller as it would in these contexts control the purpose and the means of the processing activitie s. Customer Account Data will not be included in the further analysis of this umbrella DPIA, since the government organisation will not have controllership over these processing activitie s and their processing does not take place through OpenShift as investigated here.

T hey are therefore not further included in this umbrella DPIA. This umbrella DPIA finds that the following types of personal data may be processed by OpenShift for each of the three remaining groups of data subjects: Table 3 - Overview of possible categories of personal data processed in OpenShift Data subjects Categories of personal data Potential Sensitivity level Special categories Administrators Name, business contact details, employer, username and password, access level, settings, activities within OpenShift Low No Cookies and ad identities from Red Hat support website Medium No Employees Name, email address, employer, username and password, access level, settings, activities within Containers Medium No General public Any data processed by the applications within the Container, potentially including sensitive personal data High Possible 2.2.1 Classified information The Cloud Strategy 2022 by the Dutch government forbids the use of cloud technologies for the processing of classified information.

However, classified information may be processed in containers managed by OpenShift deployed on an on - premise solution. These could potentially be includ ed in logfiles and be sent to Red Hat as part of the service agreement in violation of the guidelines of the Dutch government for the handling of classified information , but this would require at least two violations of security best pra ctices, as described in paragraph 1.6.2.1 . 2.2.2 S pecial categories of personal data OpenShift in no way require s the processing of special categories of personal data and is unlikely to do so for administrators or employees. However, with the applications running in the containers, special categories of personal data may be processed in the course of a public task. When a government organisation is processing health insurance data, this may include health data. When a governmental organisation processes data on immigration, this may include information revealing ethnicity or race.

However, these types of personal data will never be directly processed by OpenShift, unless several security best practices were ignored by the government organisation, as described in paragraph 1.6.2.1 . Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 31 of 53 3. Processing of personal data via OpenShift The following processing activitie s have been detected when using OpenShift : the processing activitie s associated with the management of OpenShift and its containers, and the processing activitie s inside of the containers. The processing activitie s necessary for the installation and management of the containers mostly include personal data of the administrators, and only process limited information about the accounts and system usage of those administrators. The applications inside of the containers can process any information about employe es and the general public that they were programmed to use , but in most situations, OpenShift has no interactions with these processing activitie s. Red Hat’s support website uses several tracking and other cookies whenever an administrator logs on to submit a request.

Table 4 - Overview of processing activitie s in OpenShift Processing Data subjects Personal data OpenShift layer Account creation and management Administrators Admin account data Usage logging Administrators Admin account data, telemetry, audit trail information Container layer * Running a pplication s General public Anything in the context of the application running in the container Employees Application account data, names and business contact details Application logging General public Employees Application log data for diagnostic purposes Support Support requests General public Employees Administrators OpenShift log data for diagnostic purposes Support portal tracking Administrators Tracking cookies and ad id’s shared with third parties * The data processing activities in the Container layer are mentioned here, but when installed corre ctly Red Hat does not have access to these data , unless these are included in a support request .

Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 32 of 53 4. Purposes of the p rocessing activities The purposes of the use of the applications within the containers are for the government organisations to determine and are outside of the scope of this umbrella DPIA. Some common types of purposes can however be identified. 4.1 C ontainer level processing and processing of diagnostic data At the container level, OpenShift processes information about the administrators for the purpose of providing a scalable run - time environment for the applications needed by the governmental organisation . This includes the need to record information about the running of the containers in logfiles and other types of output to keep the system available and reliable and to safeguard the system’s integrity. 4.2 Support request processing In the context of support requests, the purpose is to repair any malfunction or to improve the quality of service for the applications in the containers.

However, this umbrella DPIA has also shown that Red Hat uses the support portal website for tracking and ad purposes. 5. Controller, Processor, and Subprocessors For the purpose of this umbrella DPIA, it is essential to establish what roles the different parties involved in the data processing have. In this chapter, the different parties will be described and the information about their expected roles, based on the agreements they have engaged in, is described. This focuses primarily on the data processing roles of the government organisation implementing OpenShift, on Red Hat as the supplier, and on the role of the optional hosting party. In this role this umbrella DPIA specifically i nvestigates the role of ODC - Noord and does not address specific circumstances when using any commercial supplier of hosting facilities. 5.1 The role of the government organisation Any government organisation implementing an OpenShift solution, whether on - premise or in the cloud, is determining the purposes and means of the processing activities that are associated with it.

It may act as independent or as a joint controller, depending on what other parties it collaborates with and whether purposes for processing are determined jointly . The government organisation qualifies as a data controller for any use of Red Hat OpenShift, because it is the means for the processing activities, as determined by the government organisation to fulfil the purposes related to its tasks in the public interest or other lawful processing activities . 5.2 The role of Red Hat Red Hat is the provider of the software, but it does not directly influence the running of the software. It is only directly involved when a support request is entered by either the government organisation or by the hosting party. For the processing of personal data of administrators in the course of a support request, Red Hat qualifies as a data processor. Red Hat has carefully constructed its licensing agreement for the use and service of OpenShift to make sure that it does not become a party to the data processing that occurs within the container.

It specifically aims to limit all processing activities to only those of the data subjects who are the contact persons for the client with Red Hat (“business contacts”) . This falls in the category of Account Data processing, as described in paragraph 2.2 . For the processing of Account Data by Red Hat , Red Hat Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 33 of 53 will independently determine the purpose s and the means of the processing and will therefore be an independent data controller. Red Hat is also a data controller for the processing of cookies on the support website, including tracking cookies placed by third parties , that target the administrator group of data subjects 25 . It may be in fact a joint controller for these with the third parties offering the tracking cookies. Red Hat asks permission to the administrator using the support website to place additional commercial cookies, that have not been examined during this umbrella DPIA.

It appears that Red Hat places some third party tracking cookies also when consent to do so has not been given by the user. For the processing of all other categories, the purpose of the processing is set by the government organisation and Red Hat has included language in the Red Hat Enterprise Agreement EMEA (article 9.2) to ensure that no other types of personal data may be transmitted to Red Hat: “ 9.2 N o Personal Data. […Y] ou agree not to provide to Red Hat personal data subject to the General Data Protection Regulation (the “GDPR”) or a similar law requiring a contract governing the processing of personal data between you and Red Hat where Red Hat is acting as a processor (as such term is defined in the GDPR or the applicable law) on behalf of You as part of the Services. In the event of a change where Red Hat will act as a processor of personal data, you will notify Red Hat in advance in writing and the parties shall agree on the terms of a data processing a ddendum, which will amend this Agreement, as is reasonably required to comply with GDPR and similar data protection laws, if applicable. ” (emphasis Red Hat) 26 This means that the controller or any processor is not allowed to upload personal data to the systems of Red Hat, including as part of the general logs.

Unless the government organisation ignores several security best practices, this should not occur. 5.3 The role of the hosting party The hosting party does not have access to the content of the containers. The hosting as such, however, is a form of data processing for which the hosting party qualifies as a data processor. 5.3.1 ODC - Noord as the hosting party ODC - Noord is a self - owned service provider for the Dutch national government. It offers a range of services to governmental organisations . It is itself part of the Education Exe cutive Agency ( NL: Dienst Uitvoering Onderwijs, DUO), which is an independent agency that is part of the Ministry of Education , Culture and Science . ODC - Noord profiles itself as “ THE knowledge centr e in the area of data cent re and IT services .” 27 It aims to contribute to the efficiency of the Dutch government. This umbrella DPIA has not found any evidence of ODC - Noord interacting with the containers running in OpenShift .

ODC - Noord does , however, process administrator 25 An overview of the se cookies and third parties can be found in paragraph 1.6.2.3 . 26 Red Hat Enterprise Agreement EMEA, article 9.2. The sole exception to this clause applies only to Red Hat online services, which OpenShift is not. 27 ODC - Noord mission statement in document “Beschrijving ODC dienstverlening”, translation Privacy Company. Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 34 of 53 data, where ODC - Noord is actively involved in the processing. The purposes of these processing activitie s are set by the governmental organisation , which also ultimately determines the means of the processing , as suggested by ODC - Noord. Therefore, for these processing activitie s ODC - Noord is acting as a processor of personal data and is required to enter into a data processing agreement with the controller. 5.3.2 Generic commercial hosting party There is little difference between a generic commercial hosting party and ODC - Noord, except that the latter has the advantage of itself being part of the Dutch government and cleared – at least to a degree – to handle sensitive material.

The use of a comme rcial alternative is a viable option for governmental organisations wishing to use OpenShift. Their roles during data processing will be very similar to the role of ODC - Noord, in that they too will not be involved in the processing at all unless they handl e personal data as part of a service request. 5.4 The roles of other parties No other parties have been identified that are likely to have a role in the processing of personal data through OpenShift. There may be specific external parties involved by the governmental organisation deploying an OpenShift solution, such as external application developers, or collaborating agencies but those are outside of the scope of this umbrella DPIA. 6. Interests in the Data Processing 6.1 Interests of Dutch governmental organisations 6.1.1 Interests of the governmental organisations using OpenShift Governmental organisations that decide to use OpenShift as a platform for deploying their IT solutions must comply with the BIO 28 , the Public Records Act (Archiefwet) , the GDPR, and other relevant legislation.

Their primary concerns when using OpenShift will be the efficiency, availability, reliability and confidentiality of the solution, as well as cost reduction. Depending on the purpose of the applications running on OpenShift, and on the general sensitivity of the data processed in the system (including the presence of ( politically ) sensitive or classified information) and the potential for reputation damage, the governmental organisation may have a greater interest in keeping the information safe. The use of OpenShift generally allows for greater compartmentalisation, which offers benefits to the governmental organisation in terms of scalability, cost s , manageability, and security. 6.1.2 Interests of ODC - Noord Since ODC - Noord is an integral part of the Ministry of Education, the interests of ODC - Noord are based on the interests of the ministry and of the Dutch government as a whole.

There is no interest in profit maximi s ation. There is however an interest in creating sufficient scale of the operation and in keeping costs as low as possible, while maintaining speed, security, and reliability. ODC - Noord does not have a direct interest in the specifics of the personal data p rocessed on its systems. 28 See paragraph 9.2 . Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 35 of 53 6.2 Interests of Red Hat / IBM In the Red Hat Enterprise Agreement EMEA Red Hat states a clear interest in not getting involved in the data processing at all. Its interest is limited to the cost - effective offering of its services and support, and the increase of the market share of its products. From the fact that Red Hat has included scripts from several online tracking and ad vendors as part of the support website, it follows that Red Hat also has an interest in marketing their support environment for additional revenue. 6.3 Interests of data subjects The general public has an interest in the secure, efficient , error - free and cost - effective handling of their data by the Dutch government and in not having their data processed for purposes beyond the public tasks of the government. 7.

Location of personal data processing ODC - Noord hosts all data processing through OpenShift in its data centres in Groningen, the Netherlands. Other providers that may be used by the Dutch government can be located anywhere, including outside the EU and EEA. The processing of logs may be hosted in a different location and must therefore be separately addressed . I n general , the processing of logs will take place at the same physical location on a separate storage solution. For service requests, the administrators may choose to send logfiles and other diagnostic data to Red Hat, which may process the personal data included in those files outside of the EU or EEA , despite its statement that it will not allow personal data to be included. 8. Techniques and Methods of the Data Processing Though the applications running in the containers can use any available technique for data processing, OpenShift itself does not use any special or new techniques or methods .

Nor does it perform automated decision making. Red Hat employs the use of tracking cookies on its support website, which can have impact on the rights and freedoms of the administrators who use that website. Some of these cookies are placed by third parties, including Adobe and X (formerly known as Twitter). 9. Additional Legal Obligations 9.1 e Privacy Directive On the support site of Red Hat several tracking cookies are installed without the consent of the data subject. The cookies set belong to: • X Corp. (FKA Twitter, Inc.) • Everesttech (Adobe, Inc.) • Demdex (Adobe, Inc.) • Red Hat , Inc. For the use of these cookies, the ePrivacy Directive is relevant . It requires that valid consent from the users of the support site must be obtained for any cookie , unless Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 36 of 53 the cookie is necessary for the functioning of the website . Under Dutch law, the use of cookies without consent has been extended to include visitor statistical analytics 29 . 9.2 Baseline Information Security Government (BIO) The Dutch government has adopted a modified version of the information security framework ISO27001 under the name Baseline Information Security Government (Baseline Informatiebeveiliging Overheid, BIO).

The BIO sets rules that govern the way governmental organisations are expected to protect the information they control, including personal information. This means that all processing activities for the Dutch government through OpenShift must comply with the BIO framework. ODC - Noord itself is covered by the B IO directly, and indirectly through its governmental clients and the data protection agreements that cover the processing activities in OpenShift. In these agreements, ODC - Noord commits to send the controller an annual In Control declaration , as well as an assurance statement 30 . 10. Retention Periods No mandatory minimum or maximum retention periods apply to the processing of personal data through OpenShift, except for Container Content Data, for which the governmental organisation using OpenShift will be responsible. These retention periods fall outside of the scope of this umbrella DPIA .

The retention for all other categories of personal data, particularly of Container Diagnostics and OpenShift Usage Data , must be based on the GDPR - rule that data that is no longer necessary for the purpose for which it was collected, must be destroyed. For this purpose, no specific protocols or technical measures have been discovered during this umbrella DPIA. It is therefore possible that log files are generally not deleted after a reasonable amount of time has passed and may exist outside of the reasonabl e retention periods. The application of retention periods depend s on decisions by developers and architects of the container applications, rather than on structured design processes . 29 Cf. article 5 (3) ePrivacy Directive, implemented into Dutch law as article 11 ( 7 a) of the Telecommunications Act. 30 As seen in the Dictu - ODCN processing agreement v 1.1, which is slightly outdated and refers to BIR2017 rather than the current BIO .

Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 37 of 53 Part B. Lawfulness of the data processing 11. Legal Grounds In this chapter, the applicable legal grounds for processing will be examined for the processing activities described in chapter 3 . Processing activities inside of the containers are outside of the scope of this umbrella DPIA, but as was explained in paragraph 1.6 , these personal data can in some cases end up in logfiles, which can subsequently be come part of support requests. The support requests are part of the assessment of legal grounds in this chapter, but the processing of container data of members of the general public will be seen as a further processing, the lawfulness of which will be assessed in chapter 13 . 11.1 Consent Consent is only used for the placement of cookies in the context of support requests.

Whenever an employee of the governmental organisation or of the hosting provider will submit a support request at the support website of Red Hat, cookies, including tracking cookies, will be placed. A cookie consent form is available, but some non - functional cookies will be placed regardless of the answer provided. Consent as a legal ground for processing requires that the consent can be freely given, and that it can be withdrawn by the data subject. As employees of the governmental organisation or of the hosting provider are required to use the support website, the placement of non - functional cookies must be done only with validly obtained consent, that takes into account whether the employee may feel pressured to accept. Red Hat allows some third parties , in particular X, Corp. and Adobe, Inc. to process these data. 11.2 Processing is necessary for the performance of a contract None of the processing activities described in chapter 3 can be performed on the legal ground of a contract between the government organisation or another party to which the data subject is a party .

The only applicable contract would be the employment contract between the government organisation and its employees , including the administrators . However, the processing of personal data of employees in the context of the use of a specific software solution is not necessary for the execution of the contract, in the way GDPR require s for this legal ground being valid . 11.3 Processing is necessary to comply with a legal obligation None of the processing activities described in chapter 3 can be directly related to a clear legal obligation under Dutch or EU law . 11.4 Processing is necessary for a task in the public interest or for the legitimate interests of the controller or a third party All processing activities described in chapter 3 flow from a legitimate interest of the governmental organisation or possibly for a task in the public interest, assigned to the governmental organisation in Dutch or EU law .

Most processing activities can be based on the legitimate interest of the governmental organisation to provide a safe, scalable and cost - effective platform for their computing needs, in line with the BIO 31 . The interests , fundamental rights and freedoms of the data subject groups employees and administrators must be weighed against this legitimate interest. No such legitimate interest assessment was provided by the government organisations , but this would be explored more directly in the specific DPIA the government organisation 31 See paragraph 9.2 . Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 38 of 53 makes based on the findings of this umbrella DPIA . The interest can however be seen as strong and urgent, whereas the impact on the interests, rights and freedoms of the data subjects , based on the findings of this umbrella DPIA , appears to be quite limited. Also, the data subjects are aware of most processing activities and participate in them actively, significantly reducing the chance that they themselves feel the processing is excessive.

The likelihood that a legitimate interest assessment for these gro ups of data subjects would lead to the conclusion that the legitimate interest is balanced and valid as a legal ground for the processing activities described is high. 11.5 Valid legal grounds Table 5 - Overview of processing activities and their legal grounds Processing name Data subject group Legal ground OpenShift layer Account creation and management Administrators Legitimate interest * Usage logging Administrators Legitimate interest * Container layer Running a pplication s General public Out of scope Employees Out of scope Application logging Employees Legitimate interest * or conceivably task in the public interest Support Support requests Employees Legitimate interest * Administrators Legitimate interest * Support portal tracking Administrators Out of scope * A legitimate interest assessment is required for this processing 12.

Special categories of personal data Under normal circumstances, no special categories of personal data should be part of the processing activities described in this umbrella DPIA . T he only exception occurs when the government organisation processes these types of sensitive data inside of the containers allowing them to become part of log files. This can only occur when at least two security best practices a re ignored. 13. Purpose limitation The processing activities described in chapter 3 (excluding the support website cookies) fall into three main categories : container layer, OpenShift layer, and support request s . Whether these processing activities collect personal data for the first time or should be considered further processing activities often depends on the context of the application running in the container . In those case s where the processing activities are in fact further processing activities , their purpose must be found to be compatible with the original purpose for which the personal data were collected.

Article 6 (4) Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 39 of 53 GDPR provides a number of criteria to determine whether the further processing is compatible with the original purpose for which they were collected: “(a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing; (b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller; (c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10; (d) the possible consequences of the intended further processing for data subjects; (e) the existence of appropriate safeguards, which may include encryption or pseudonymisation” 32 Further processing activities in each of the three layers will be examined in the rest of this chapter. 13.1 OpenShift layer processing activities Within the OpenShift layer, some of the personal data processed may be newly created, such as usernames and passwords and logging information, while other personal data, such as names, may be reused.

These data types have generally been collected by the government organisation for the purpose of entering into an employment contract. The further processing activities are in these cases normal, work - related activities, often performed by or with direct knowledge of the data subjects. This means that these processing activities can be considered to be compatible further processing activities . Table 6 - Further processing assessment for OpenShift layer processing activities Criterium Explanation Compatible Link between purposes The link between the employment contract and the execution of work - related processing activities is direct Yes Context of collection The context of work - related processing activities within a work environment is appropriate Yes Nature of the personal data and p ossible consequences for data subjects No sensitive or consequential personal data will be processed Yes Existence of appropriate safeguards The personal data is protected under normal BIO - based information security measures Yes Conclusion No major deviations from compatibility have been found Yes 32 Article 6 (4) GDPR.

Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 40 of 53 13.2 Container layer processing activities The purposes of the internal processing activities within the container layer are outside of the scope of this umbrella DPIA and are determined by the government organisation that will implement OpenShift solutions. These need to be investigated for purpose limitation in a separate DPIA. These data can become in - scope when they are included in logfiles and memory dumps, as described in paragraph 1.6.2 , but since this can occur only when several security best practices get ignored, this was not considered here . 13.3 Support requests Whenever either the government organisation or the hosting provider files a support request with Red Hat, some supporting documentation may be requested by Red Hat. As was described in paragraph 1.6 , this is unlikely to include data that originates from within the container, such as information about members of the general public, possibly including sensitive information.

It will however include information about the usage of the containers in the OpenS hift layer processing activities. The use of these types of data in support requests constitutes a further processing. This further processing must then be compatible with the original purposes, for which these data were collected originally . Table 7 - Further processing assessment for support request processing activities Criterium Explanation Compatible Link between purposes The processing of some diagnostic data to determine why errors may have occurred is a normal part of modern computing and any data subject can expect that any automated system will need to be regularly debugged. Yes Context of collection Not much about the context is known during this umbrella DPIA , but in general, the relationship between the government and the data subjects is based on employment and the personal data processed is strictly work related and does not contain any sensitive information Y es Nature of the personal data and p ossible consequences for data subjects The personal data is related to work activities by employees and do not contain any sensitive information Y es Existence of appropriate safeguards Security best practices are in place to prevent sensitive personal data from being included.

Otherwise, BIO - based Y es Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 41 of 53 Criterium Explanation Compatible information security measures apply to the processing Conclusion No major deviations from compatibility have been found Yes 14. Necessity and proportionality Article 5 (1) under c GDPR requires that every processing activity must be limited to what is necessary to achieve its purpose. The concept of necessity is made up of two related concepts, namely proportionality and subsidiarity. P roportionality demands a balancing act between the interests of the data subject and the data controller. Proportionate data processing means that the amount of data processed is not excessive in relation to the purpose of the processing. Second , it must be assessed whether the purpose can reasonably be achieved with other, less invasive means.

If so, these alternatives must be used instead . If the purpose can be achieved by processing fewer personal data, th e n the amount of personal data processed should be decreased to what is necessary. 14.1 Assessment of the proportionality Processing name Data subject group Assessment Proportional OpenShift layer Account creation and management Administrators Without these processing activities the integrity and confidentiality of the system cannot be guaranteed Yes Usage logging Administrators The use of logging is essential to detect intrusions and malfunctions of the system. The amount of logging was not shown to be excessive Yes Container layer * Running a pplication s General public Out of scope Out of scope Employees Out of scope Out of scope Application logging Employees The use of logging is essential to detect intrusions and malfunctions of the system. Proportionality depends on the extent Out of scope Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 42 of 53 of the logging, which cannot be determined within the scope of this umbrella DPIA Support Support requests Employees Only limited amount of employee - related information is included .

The processing of these data is urgent to determine causes and solutions to malfunctions or other issues Yes Administrators Only limited amount of employee - related information is included. The processing of these data is urgent to determine causes and solutions to malfunctions or other issues Yes *When installed correctly, these data are not availab le to Red Hat, unless these are included in a support request. 14.2 Assessment of the subsidiarity The use of OpenShift itself is not without alternatives. Similar results may be reached by using non - cloud based computing systems. These are however generally less scalable, less reliable and less cost - effective than working with containerised solutions. These would also not automatically be more privacy friendly for the administrators, employees or the general public. Processing name Data subject group Assessment According to s ubsidiarity principle OpenShift layer Account creation and management Administrators There is no less intrusive alternative to having an account creating and management system Yes Usage logging Administrators The governmental organisation must balance the amount of information logged with the interests, rights and freedoms of the data subjects.

In particular where information may be processed that can Y es Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 43 of 53 have an impact on the employment record. No Excessive logging is found when using the default settings of OpenShift Container layer * Running a pplication s General public Out of scope Out of scope Employees Out of scope Out of scope Application logging Employees The governmental organisation must balance the amount of information logged with the interests, rights and freedoms of the data subjects. In particular where information may be processed that can have an impact on the employment record. Out of scope Support Support requests Employees Only when necessary information gets shared with Red Hat, and only when necessary to solve a performance issue Yes Administrators Only when necessary information gets shared with Red Hat, and only when necessary to solve a performance issue Yes *When installed correctly, these data are not available to Red Hat, unless these are included in a support request.

Based on the above analysis, the use of Red Hat Open Shift does meet the requirements of proportionality and subsidiarity. 15. Rights of data subjects The GDPR grants data subjects a number of privacy right s : 1 Right to informatio n D ata subjects have a right to information. This means that data controllers must provide people with easily accessible, comprehensible, and concise information in clear language about, inter alia, their identity as data controller, the purposes of the data processing, the intended duration of the storage and the rights of data subjects. 2 Right to access D ata subjects have a right to access personal data concerning them. Upon request, data controllers must inform data subjects whether they are processing Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 44 of 53 personal data about them. If this is the case, data subjects should be provided with a copy of the personal data processed, together with information about the purposes of processing, recipients to whom data have been transmitted, the period for which pers onal data are to be stored, and information on their further rights as data subjects, such as filing a complaint with the Data Protection Authority. 3 Right of rectification and erasure D ata subjects have the right to have inaccurate or outdated information corrected, incomplete information completed and - under certain circumstances - personal information deleted or the processing of personal data restricted. 4 Right to object to profiling D ata subjects have the right to object to an exclusively automated decision if it has legal effects. 5 Right to data portability Employees may also have a right to data portability if their personal data are being processed based on their consent or on a necessity to execute the (labour)contract.

Within the context of OpenShift, the personal data processing activities are determined by the governmental organisation and the administrator of this organisation will have access to the logging . This means that the rights of data subjects can usually be granted via the normal procedures of the government al organisation, without the need for involvement of Red Hat. The government org a nisation, however, has to include clear information about the logging in its privacy statement for employees . Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 45 of 53 Part C. Discussion and Assessment of the Risks This part concerns the description and assessment of the risks for data subjects. This part starts with an overall identification of the risks to the rights and freedoms of data subjects as a result of the processing of personal data when using Red Hat Open Shift.

The risks will subsequently be classified according to the likelihood they might occur, and the impact on the rights and freedoms of the data subjects when they do. 16. Privacy Risks Risks to the rights and freedoms of the data subject (‘privacy risks’) occur when processing of personal data violate s a right or freedom given to the data subject by the GDPR or any other legislation. High risks usually occur when a processing violates a legal protection of one of the fundamental rights as described in the European Charter of Fundamental Rights, but violations of other rights given by Union or Member State law may als o constitute a privacy risk. In this chapter, this umbrella DPIA will lis t all privacy risks identified during the use of OpenShift . Each privacy risk will be assessed based on the potential impact it has on the rights and freedoms of the data subjects, and on the likelihood the risk will in fact occur.

Some privacy risks will automatically occur to some or all data subjects, others will have a high, medium or low likelihood of occurring. The severity of the risk and the likelihood are assessed based on the factual description in part A and B of this DPIA. 16.1 Assessment of risks Risk 1: Accidental i nclusion of container layer personal data in logfiles and service requests It requires ignoring at least two security best practices and a lack of review of the files included in the service request to get any personal data that was processed inside of a container into the OpenShift logfiles and subsequently into a service request, but it is not impossible for this to occur. This could expose personal data, including special categories of personal data, criminal data, or national identification numbers, to Red Hat , wh ich would not be authorized to have access to these data. The potential impact of this risk is high , because of the potential sensitive nature of the data involved, and because such processing would be unlawful .

The likelihood that this risk will occur is low . Therefore, this is a low risk to the rights and freedoms of the primary data subjects. Risk 2: Red Hat’s support website sets third - party tracking cookies without consent Red Hat is the controller for the support website, but the government organisation’s or its hosting partner’s employees are required to use the site and some of the tracking cookies are unlawfully placed without prior consent. The potential impact of this risk is high, because of the unlawful processing of personal data by Red Hat and its commercial partners. The chan c e of this risk occurring is high , because even when not giving consent, some tracking cookies are placed . Therefore, this is classified as a high risk to the rights and freedoms of the data subjects (in this case only administrators) . Risk 3: Inability to exercise data subject rights for employees and administrators Some of the processing activities around logging and support requests may not always be very transparent for employees and administrators.

Government organisations are required to provide information about these processing activities and must be able to provide access to the personal data processed and stored, and must allow for its correction or deletion, unless clear reasons to deny such a request are present. Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 46 of 53 The potential impact of this risk is medium, since much of the personal data will only be temporarily stored or will be a copy of data processed elsewhere. The likelihood that any data subject will submit a request for these data is also minimal. The chance of this privacy risk occurring, however, is assessed as medium , as long as a government organisation does not include these processing activities in its procedures around requests of data subjects. 16.2 Summary of privacy risks This umbrella DPIA has identified one high risk to the rights and freedoms of the data subjects, one medium risk, and one low privacy risk, before taking mitigating technical and/or organisational measures.

When plotted in the matrix created by the UK Data Protection Authority IC O , the privacy risks look like this: Figure 9 - ICO - based privacy risk assessment for Red Hat OpenShift (before measures) Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 47 of 53 Part D. Description of risk mitigating measures Part D describes the proposed (counter - )measures that are necessary to mitigate the risks found in Part C. This part also contains an analysis of the residual risk after the implementation of the proposed measures, and a recommendation on whether the measures will be sufficient in reducing risk to an acceptable level. 17. Risk mitigating measures 17.1 Measures to be taken to mitigate privacy risks The following measure is necessary to minimize the high privacy risk found in part C of this umbrella DPIA. Table 8 - Overview of mitigating measures for each high privacy risk Risk no. High risk M easures government organisations M easures Red Hat 2 Support site third - party tracking cookies without consent None Remove tracking cookies that get placed without consent .

U pdate 1 0 - 02 - 2025 : Red Hat has ch an ged the cookie settings accordingly. Full implementation of this technical measure completely removes this privacy risk. One privacy risk in this umbrella DPIA is qualified as a medium privacy risk. This means that mitigation of the risk is needed to reduce it to a low residual risk or remo v e the risk : Table 9 - Overview of mitigating measures for each medium privacy risk Risk no. Medium risk M easures government organisations M easures Red Hat 3 Inability to exercise rights for employees and administrators Explicitly include logfiles and support requests in the procedures for dealing with employee data subject requests, and inclusion of these processing activities in the registry of processing activities and the relevant privacy statements N one Full implementation of this organisational measure fully removes this privacy risk. One privacy risk this umbrella DPIA identified was classified as a low privacy risk.

The controller is not required to take any additional mitigating measures for these privacy risks . However , an easy to implement optional measure would eliminate much of the possible remaining impact on the rights and freedoms of the data subjects involved: Umbrella DPIA Red Hat OpenShift FINAL VERSION Page 48 of 53 Table 10 - Overview of low risks and suggested mitigating measures Risk no. Low risk Optional measures governmental organisation Optional measures Red Hat 1 Accidental inclusion of container layer personal data in logfiles and support requests Create clear and enforceable guidelines on the use of logging and namespaces for applications running in OpenShift containers None Full implementation of this organisational measure fully removes this privacy risk. 17.2 Assessment of risks after taking mitigating measures This umbrella DPIA has identified one high , one medium and one low privacy risk that can occur when mitigating measures are not in place .

T he high privacy risk can be fully mitigated by Red Hat by removing the third - party tracking cookies that are placed unlawfully without consent . The medium privacy risk can be fully mitigat ed when the government organisation ensures that the processing activities around logging and support requests are included in relevant privacy statements, procedures and the registry of processing activities. The low privacy risk can be fully mitigated if the government organisations implement organisational measures to prevent applications from running in OpenShift containers that violate security best practice s, and by making sure the implementation of these best practices is regularly verified. After implementation of mitigating measures, no privacy risks associated with the use of applications running in OpenShift containers remain. The use of OpenShift itself does not create any high privacy risk to the general public or to employees of the government organisation, other than administrators.

This means that the use of Red Hat OpenShift complies with the requirements of the GDPR and can be implemented without need for prior consultation with the data protection authority , as long as the context in which OpenShift is implemented does not create specific privacy risks. Umbrella DPIA Red Hat OpenShift Umbrella DPIA Red Hat OpenShift FINAL VERSION Alleen hoofddocument. Page 49 of 53 Conclusion The use of Red Hat OpenShift does not lead directly to any high risks to the rights and freedoms of natural persons . One relevant high privacy risk was identified in the use of third - party tracking cookies on Red Hat’s support website, when Red Hat did not obtain the data subject’s consent. This risk only impacts data subjects that are administrators of OpenShift and is the sole responsibility of Red Hat as independent data controller to solve. When following standard security guide lines, the dat a from the applications in the containers does not propagate into other containers or the OpenShift and RHCOS platform s. One medium risk is created by the possibility that government organisations overlook the presence of processing activities such as logfiles and support requests when creating procedures, privacy statements and when completing the registry of processing activities.

This could impact the ability of data subjects (administrators and other employees) to exercise their rights. This can be mitigated by the government organisation by ensuring that these rights are fully respected and implemented. One final potential privacy risk is created by the very low chance that in the support request to Red Hat, personal data is included that was placed in logfiles by the application running inside of the OpenShift container. This should never happen, as long as normal security best practices for logging and running container applications are followed, but can at the same time cause the unlawful processing of potentially highly sensitive personal data. Therefore, government organisations are recommended to imp lement strict monitoring of the adherence of the developers of containerised applications to these best practices. With these technical and organisational measures in place, OpenShift is safe to use in a way that complies with the requirements of GDPR.

Appendix 1 – Technical research protocol Prerequisites: 1. RHCOS environment including OpenShift 2. Access to external storage 3. A ccess to the RHCOS / OpenShift management portal 4. Root access to RHCOS 5. Container with elevated access and tcpdump for traffic analysis 6. Testing machine with MITMproxy 7. Browser with clean profile per test group and the following configuration: a. Do not track off b. Allow third party cookies c. No add or tracking blockers d. Proxy through MITMproxy 8. Container with script that writes personal data to both stdout and the external storage Tests on management portal: 1. Walk through of management portal while collecting traffic with MITMproxy 2. Check on information stored on the administrator(s) in the management portal 3. Check on access to logfiles and storage of containers 4. Search the RHCOS instances for the account name of the administrator and the IP - address of the adm i nistrator Tests on OpenShift: 1.

Collect network traffic to the external network for 7 days 2. Restart one instance of RHCOS while collecting traffic 3. Run the container with the test script 4. Search the RHCOS instance where the container ran on for the personal data the script has written 5. Search the external storage of the container for the personal data the script has written Tests on Red Ha t support: 1. Submit a support request through the portal while collecting traffic with MITMproxy 2. Perform a n ‘sos report’ according to the specifications of Red Hat 3. Search the collected sos report data for the personal data written by the container and data of the administrator 4. Perform a ‘oc adm must - gather’ according to the specifications of Red Hat 5. Search the collected must - gather for the personal data written by the container and data of the administrator 6. Submit sos report and must - gather to Red Hat support Data Subject Access Request: 1.

Request Red Hat via their standard privacy contact for: a. The logfiles and other data connected to the visit of the support portal b. Any personal data that was found within the sos report and the must - gather c. Any other traffic found to Red Ha t servers that may contain personal data Appendix page ii of iii Appendix 2 – Test scripts Kubernetes / YAML definition of test pod writing to the logfile: apiVersion: v1 kind: Pod metadata: name: dpia - container - pg - no - storage namespace: default spec: containers: - name: dpia - container - pg - no - storage image: debian command: ["/bin/sh"] args: [" - c", "echo '43547 (Winfried Tilanus) flagged by fraud detection' && sleep 60"] restartPolicy: OnFailure Appendix page iii of iii Appendix 3 – Endpoints of Red Hat support site Referrer Host Number of requests None access.redhat.com 1 sso.redhat.com 6 access.redhat.com access.redhat.com 42 static.redhat.com 2 www.redhat.com 1 www.redhatstatic.com 2 service.force.com 1 consent.trustarc.com 4 assets.adobedtm.com 4 c.la2 - c2 - ph2.salesforceliveagent.com 1 consent - pref.trustarc.com 1 sso.redhat.com 4 www.redhatstatic.com www.redhatstatic.com 43 consent - pref.trustarc.com consent - pref.trustarc.com 20 consent - st.trustarc.com 2 consent.trustarc.com 4 sso.redhat.com sso.redhat.com 11 www.redhat.com 4 consent.trustarc.com 4 assets.adobedtm.com 4 static.redhat.com 3 js.sentry - cdn.com 1 use.fontawesome.com 1 api.company - target.com 1 dpm.demdex.net 2 id.redhat.com 1 access.redhat.com 5 browser.sentry - cdn.com 1 smetrics.redhat.com 2 redhat.demdex.net 1 cm.everesttech.net 1 consent - pref.trustarc.com 1 img.en25.com 1 s1795.t.eloqua.com 3 static.redhat.com static.redhat.com 4 redhat.demdex.net cm.g.doubleclick.net 2 analytics.twitter.com 1 match.adsrvr.org 1 ml314.com 1 dpm.demdex.net 3 match.prod.bidr.io 2