DPIA IBM Cloud Pak for Business Automation as a Service

© 2021 Belastingdienst . Auteursrechten voorbehouden. Niets uit dit rapport mag worden verveelvoudigd en/of openbaar gemaakt door middel van druk, fotokopie, microfilm, digitale verwerking of anderszins, zonder voorafgaande schriftelijke toestemming van de Belastingdienst . © 202 3 Belastingdienst . Auteursrechten voorbehouden. Niets uit dit rapport mag worden verveelvoudigd en/of openbaar gemaakt door middel van druk, fotokopie, microfilm, digitale verwerking of anderszins, zonder voorafgaande schriftelijke toestemming van de Belastingdienst . s Umbrella DPIA IBM Cloud Pak for Business Automation as a Service Data protection impact assessment on the processing of personal data with IBM Cloud Pak for Business Automation as a Service Version 1. 0 Date 9 November 202 3 Version 1. 3 Final version Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Colo ph on Umbrella DPIA by Belastingdienst SLM IBM Rijk Postbus 9050 7300 GM Apeldoorn Contact Marco Bijkerk Project Name Umbrella DPIA report on IBM Cloud Pak for Business Automation as a Service Authors Privacy Company Arnold Roosendaal Winfried Tilanus Lennart Huizing https:// www.privacycompany.eu / Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Change log Version Date Summary of input 0.1 06 Dec ember 2021 First internal draft (Part A) 0.3 22 December 2021 Draft Part A for review 0.4 28 January 2022 Part A for review (extended) 0.5 8 February 2022 Added UC4 to part A 0.6 23 February 2022 Full draft for review 1.0 24 May 2022 Final version 1.1 12 May 2023 Dutch summary added 1.2 20 July 2023 Updated overview status mitigating measures 1.3 9 November 2023 Update status mitigating measures Summary This report contains the results of the data protection impact assessment (DPIA) on IBM Cloud Pak for Business Automation as a Service (CP4BAaaS).

Privacy Company performed this DPIA on behalf of SLM IBM Rijk. The DPIA was based on extensive legal and tech nical research. Tests were performed on a temporary tenant provided by IBM . With the use of CP4BAaaS, different categories of data subjects can be impacted. These can be government employees, system administrators, but also citizens whose data is processed by governmental institutions. The DPIA is a so - called umbrella DPIA , which assesses the risks that may occur as a result of the use of the CP4B A aaS in general , regardless of the types of content data that are processed. A focus is on the use of diagnostic data, logging, and access to and other types of processing of personal data by IBM or its (sub)processors as a supplier. The umbrella DPIA contains input for governmental organisations that might want to start using CP4B A aaS. They can use the in formation from this DPIA and complete this with an assessment of their own specific data processing activities.

The DPIA resulted in a list of 11 high and 5 low risks for the rights and freedoms of data subjects. Main risks relate to the role of IBM. IBM p resents itself as a data processor. However, due to the formulation of some own purposes for personal data processing, IBM may act as a controller. Moreover, when using CP4B A aaS many third parties get involved that are placing (tracking) cookies or providi ng additional processing activities. For this reason, IBM should be considered to be a joint controller with the governmental organisation. Some measures can be taken to mitigate those risks and to make IBM qualify as a processor. Another major concern rel ates to the transfer of personal data outside the EER. The provisioning of the service is taking place from the US, with a full database of all user accounts being kept for verification during account activation and login processes. Technical support is de livered by employees that are located worldwide with access to the tenants and the content data.

For all risk s , measures have been identified to mitigate those risks. The measures related to the high risks must be taken before starting to use CP4B A aaS. The measures mitigating the low risks can further lower these risks where desired. The risks and measures are summarized in the table s below . IBM has implemented measures according to the remediation table below. With these measures all high risks are reduced to low residual risks or no longer apply. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Summary of risks: Risk no. High risk Measures government organisations Measures IBM 1 Loss of control and unnecessary processing The authentication and account activation services must be provided as integral part of the business agreement for CP4BAaaS, with IBM acting as a data processor for the government organisation. Remove the creation of an implicit contract between the user and IBM for using the authentication page. 2 Violation of d ata protection by default Change the default setting for cookies on the login page to required cookies only.

Place this option on the first page. 3 Lack of transparency (cookies) Provide full information about the cookies necessary for the functioning of CP4BAaaS and any other cookies used. 4 No consent for unnecessary cookies For cookies that require consent of the data subject, these may only be issued after valid consent has been obtained (instead of directly when loading the page) 5 L oss of control: subprocessors Actively monitor and audit the use of subprocessors by IBM. IBM must provide information on all subprocessors in the public documentation or contracts and inform about their tasks. Furthermore, IBM must guarantee that the same requirements on data protection compliance apply to those subprocessors as apply to IBM. 6 Loss of control: joint controllership with third parties Third parties and ad networks must be excluded from CP4BAaaS. Their presence is not necessary to provide the services.

When these third parties Risk no. High risk Measures government organisations Measures IBM are excluded, the joint controllership ceases to exist, and IBM acts as a data processor for the government orga nisation as a data controller. 7 Unlawful data transfers to USA As a data controller, the government organisation must provide a valid transfer mechanism for the structural transfer of personal data to the USA. The impact of the transfer must be assessed in a DTIA. IBM must host the Google Fonts on their own servers to avoid transfer of personal data to Google. Data processings must be taking place in the EU/EEA only, unless adequate safeguards apply. 9 Incompatible further processing (marketing, etc.) Re gularly audit IBM’s use of personal data of primary data subjects for its own legitimate business purposes to ensure that the data is not used for these purposes. The purposes of marketing, product improvement and business intelligence are purposes of IBM as a data controller.

These purposes must be excluded from the general terms and conditions, since IBM as a data processor is not allowed to determine own purposes for further processing the personal data it receives from the government organisation. 10 W orldwide access for support without transfer mechanism Optional: The government organisation may consider limiting support to local office hours and from within the EU/EEA only. (This requires that IBM can indeed limit support and access to regions) IBM mu st provide guarantees for the protection of personal data according to the GDPR when providing support from establishments outside the EU/EEA. For instance, Binding Corporate Rules in combination with technical measures. Alternatively, IBM can limit support to regions. 11 Insufficient technical security measures in default email settings Turn on the encryption functionality in the setup of the email application.

Monitor that the setting remains set to encrypt. By default, enable the encryption settin gs for sending email. 13 Failure to fully comply with data subject access request Annually audit the data subject request procedures used by IBM and its Review the internal data subject request procedures. Also: Audit and rep ort on the internal Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Risk no. High risk Measures government organisations Measures IBM subprocessors and affiliates. data subject request procedures with subprocessors and affiliates. Risk no. Low risk Optional measures governmental organisation Optional measures IBM 8 Unlawful processing of special categories of personal data in filenames Provide guidance to users of CP4BAaaS to prevent inclusion of special categories of personal data in filenames 12 Data subject background check Tighten internal procedures to prohibit data subject background checks when processing a data subject request, including those that only use public sources. 14 Tracking pixel in response email Stop including tracking pixels in the confirmation email after a data subject request. 15 Email address unintentionally disclosed Adjust the configuration of the own email server 16 Applications build on CP4BAaaS may create a disproportionate audit trail Instruct application managers to minimize the audit trail Overview of mitigating measures and current status ( November 2023) Note: These measures have been taken by IBM.

Measures 1, 2, 6, 10, and 11 have not yet been tested or otherwise verified by Privacy Company. Ris k no. High risk as per art. GDPR Measures government organisations Measures IBM Status 1 Loss of control and unnecessary processing Of e - mail address, name and surname etc etc Article 24(1) GDPR Create an account activation and log - in in the EEA with support from I BM. The authentication and account activation services must be provided from an EU country within considerable time. Alternatively there must be an technical solution to remove the data after account creation in the US. Remove the creation of an implicit contract between the user and IBM for using the authentication page. IBM now provides the option to have the account activation services and log - in facilities fully hosted in the EER. 2 Violation of data protection by default Installation of p ersonalization and non - functional cookies.

Article 25(2) GDPR Describe in the use - manuals to pay attention to the cookie wall and select the most private option. Change settings of the browsers, to standard refuse cookies. Change the default setting fo r cookies on the login page to required cookies only. Place this option on the first page. IBM has an internal process in which it reviews and as necessary modifies the cookies used on a quarterly basis. Status: IBM indicates to have changed the settings a n d categorization accordingly. 3 Lack of transparency (cookies) Installation of personalization and non - functional cookies Change settings of the browsers, to standard refuse cookies. Provide full information about the cookies necessary for the functioning of CP4BAaaS and any other cookies used. IBM has cleared and properly categorized the cookies. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Ris k no. High risk as per art. GDPR Measures government organisations Measures IBM Status Article 13 GDPR 4 No consent for unnecessary cookies Article 6(1)a GDPR, Telecommunic ation Act Change settings of the browsers, to standard refuse cookies.

For cookies that require consent of the data subject, these may only be issued after valid consent has been obtained (instead of directly when loading the page) • There are third party requests to : • TrustArc ( provider of the consent m anager ) • Tiqcdn.co m, w hich is Tealium, a tag manager (marketin g) • S81.com, a dom a in u nder control of IBM • None of the third parties issues a cookie • From the domain www.auto mationcloud.ibm.c om 6 cookies are issued prior to consent: • 4 cookies are sessi on cookies or have an expiry date in the past . These can be considered ‘functional ’ cookies • 1 cookie remains for a year , but this cookie Ris k no. High risk as per art. GDPR Measures government organisations Measures IBM Status only contains the consent - choice. The cookie is not related to an individual and does not contain personal data. This cookie is also considered to be a ‘functional ’ cookie. 5 Loss of control: subprocessors of the following personal data: IP addresses Article 28 GDPR and Article 13 GDPR Actively monitor and audit the use of subprocessors by IBM.

Mask/hide or otherwise obfuscate IP address of the laptops and users. IBM must provide information on all subprocessors in the public documentation or contracts and inform about their tasks. Furthermore, IBM must guarantee that the same requirements on data protection compliance apply to those subprocessors as apply to IBM. IBM has provided the requested information about Cloudflare and Akamai. IBM has guaranteed that ultimately end of March 2024, b oth parties are listed in the privacy statement as processors for IBM for purposes of security, content management, and verifying the geolocation of the user for compliance purposes. (IBM indicates that C loudflare will not be used for Cloud Pak services. If so, Cloudflare can be left out). T his risk is mitigated. 6 Loss of control: joint controllership with third parties Third parties and ad networks must be excluded from CP4BAaaS. Their presence is not IBM indicates it has removed all tracking and marketing cookies.

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Ris k no. High risk as per art. GDPR Measures government organisations Measures IBM Status Article 24(1) and article 26 GDPR necessary to provide the services. When these third parties are excluded, the joint controllership ceases to exist, and IBM acts as a data processor for the government orga nisation as a data controller. 7 Unlawful data transfers to USA Chapter 5 GDPR As a data controller, the government organisation must provide a valid transfer mechanism for the structural t ransfer of personal data to the USA. The impact of the transfer must be assessed in a DTIA. IBM must host the Google Fonts on their own servers to avoid transfer of personal data to Google. Data processings must take place in the EU/EEA only, unless adequa te safeguards apply. This risk is mitigated. No further actions. 9 Incompatible further processing (marketing, etc.)

Article 6(4) GDPR Regularly audit IBM’s use of personal data of primary data subjects for its own legitimate business purposes to ensure that the data is not used for these purposes. The purposes of marketing, product improvement and business intelligence are purposes of IBM as a data controller. These purposes must be excluded from the general terms and conditions, since IBM as a da ta processor is not allowed to determine own purposes for further processing the personal data it receives from the government organisation. T his risk is mitigated. Ris k no. High risk as per art. GDPR Measures government organisations Measures IBM Status 10 Worldwide access for support without transfer mechanism Chapter 5 GDPR Optional: The government organisation may consider limiting support to local office hours and from within the EU/EEA only. (This requires that IBM can indeed limit support and access to regions) Optional: intern al instructions not to provide and send contentdata or log data including PII in a support ticke t etc. Optional: no access/resolutio n in production environment, only in test.

Optional: Only third line support requests with IBM. First and second internally. IBM must provide guarantees for the protection of pers onal data according to the GDPR when providing support from establishments outside the EU/EEA. For instance, Binding Corporate Rules in combination with technical measures. Alternatively, IBM can limit support to regions. IBM now offers the option for support from the EER only (with limitation to business hours). 11 Insufficient technical security measures in default email settings Article 32 GDPR. Turn on the encryption functionality in the setup of the email application. Monitor that the setting r emains set to encrypt. By default, enable the encryption settings for sending email. E mails will be encrypted if enabled by the Dutch government, regardless of the This risk is mitigated. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Ris k no. High risk as per art. GDPR Measures government organisations Measures IBM Status tick box setting in CP4BAaaS. 13 Failure to fully comply with data subject access request (art. 15 GDPR) Annually audit the data subject request procedures used by IBM and its subprocessors and affiliates.

Review the internal data subject request procedures. Also: Audit and report on the internal data subject request procedures with subprocessors and affiliates. This risk is mitigated. Risk no. Low risk Optional measures governmental organisation Optional measures IBM Advice 8 Unlawful processing of special categories of personal data in filenames Provide guidance to users of CP4BAaaS to prevent inclusion of special categories of personal data in filenames Follow advice 12 Data subject background check Tighten internal procedures to prohibit data subject background checks when processing a data subject request, including those that only use public sources. Will be added as a to - do in the governance tasks. No legal necessity to resolve. 14 Tracking pixel in res ponse email Stop including tracking pixels in the confirmation email after a data subject request. Will be added as a to - do in the governance tasks.

No legal necessity to resolve. 15 Email address unintentionally disclosed Adjust the configuration of the own email server Follow advice 16 Applications build on CP4BAaaS may create a Instruct application managers to Follow advice Risk no. Low risk Optional measures governmental organisation Optional measures IBM Advice disproportionate audit trail minimize the audit trail Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Samenvatting Dit rapport bevat de resultaten van de gegevensbeschermingseffectbeoordeling (DPIA) voor IBM Cloud Pak for Business Automation (CP4BAaaS). Privacy Company he e ft deze DPIA uitgevoerd namens SLM IBM Rijk. De DPIA is tot stand gekomen op basis van uitgebreid juridisch en technisch onderzoek. Tests zijn uitgevoerd op een tijdelijke tenant , aangeleverd door IBM. Het gebruik van CP4BAaaS k an verschillende categorieën van betrokkenen treffen .

Dit k unnen ambtenaren of systeembeheerders zijn, maar ook burgers wiens persoonsgegevens worden verwerkt door overheidsinstellingen. De DPIA is een zogeheten ‘paraplu - DPIA,’ waarin de risico ’ s in kaart worden gebracht die kunnen optreden bij het gebruik van CP4BAaa S in het algemeen, los van de soorten content data die worden verwerkt. De fo cus ligt op het gebruik van diagnos tische gegevens, logging, en toegang en andere soorten verwerkingen van persoonsgegevens door IBM of haar (sub)verwerkers als verstrekker. De p ara plu - DPIA bevat input voor overheidsinstanties die overwegen ge bruik te gaan maken van CP4BAaaS. Zij k unnen de informatie uit deze DPIA gebruik en en aanvullen met een beoordeling van hun eigen specifieke verwerkingsactiviteiten. De DPIA lever t een lijst op van 11 hoge en 5 lage risico’s voor de rechten en vrijheden van betrokkenen. De belangrijkste risico’s hebben betrekking op de rol van IBM.

IBM zet zichzelf neer als een verwerker. Doordat ze echter zelf een aantal doelen voor de verwerking van persoonsge gevens formuleert, kan IBM ook als verwerkingsverantwoordelijke optreden. Da arnaast raakt bij het gebruik van CP4BAa aS een groot aantal derde partijen betrokken dat (tracking) cookies plaatst of aanvullende verwerkingen uitvoert. Da arom moet IBM aangemerkt worden als gezamenlijk ver werkingsverantwoordelijke samen met de overheidsinstantie. Er is een aantal maatregelen mogelijk o m d eze risico’s te mitigeren en IBM als verwerker te kunnen aanmerken. Een ander belangrijk aandachtspunt is de doorgifte van persoonsgegeve ns buiten de EER. De dienstverlenin g vindt plaats vanuit de VS, waar een volledige database van alle gebruikersaccounts wordt bewaard voor verificatie tijdens accountactiv atie - en inlogpr ocessen. T echnische ondersteuning wordt verzorgd door medewerkers die wereldwijd ver spreid zijn met toegang tot de tenants en de content data.

Voor ieder risico zijn maatregelen voorgesteld om dez e te mitigeren. De maatregelen die betrekking hebben tot d e hoge risico ’ s moeten worden getroffen voordat wordt begonnen met het gebruik van CP4BAaaS . De maatregelen die de lage risico ’ s mitigeren kunnen deze risico ’ s verder verminderen wanneer dit gewenst is. De risico’s en maatregelen zijn samengevat in de onderstaande tabel . IBM heeft maatregelen getroffen volgens de remediation tabel hieronder. Met deze maatregelen zijn alle hoge risico’s gereduceerd tot een laag restrisico of geen risico. Risi co Nr. Hoog risico Maatregelen overheidsinstanties Maatregelen IBM 1 Controlever lies en niet - n oodzakelijke verwerking De authenticatie - en accountacti vatie diensten moeten Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 18 of 99 Risi co Nr. Hoog risico Maatregelen overheidsinstanties Maatregelen IBM worden verleend als integr a al onderdeel van de bedrijfsovereen - komst voor CP4BaaaS , waarbij IBM optree d t als verwerker voor de overheidsinstantie.

St op met het creëren van een stilzwijgende overeenkomst tussen de gebruiker en IBM voor het gebruik van de authenticatiepagina. 2 Schending van gegevensbeschermi ng door standaardinstellinge n Verander de standaardinstelling vo or cookies op de inlogpagina naar ‘alleen noodzakelijke cookies .’ Plaats deze optie op de eerste pagina. 3 Gebrek aan transparantie (cookies) Verstrek volledige informatie over de cookies die noodzakelijk zijn voor het functioneren van CP4BAaaS en andere gebruikte cookies. 4 Geen toestemming voor noodzakelijke cookies Cookies waarvoor toestemming van de betrokkene vereist is mogen pas geplaatst worden nadat geldige toestemming is verkregen (in plaats van meteen bij het laden van de pagina) 5 Controleverlies: subverwerkers Controleer actief het gebruik van subverwerkers door IBM. IBM moet informatie verstrekken over al haar subverwerkers in de publieke documentatie of contracten en informeren over Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument.

Risi co Nr. Hoog risico Maatregelen overheidsinstanties Maatregelen IBM hun taken. Daarnaast moet IB M garanderen dat dezelfde vereisten die met betrekking tot gege vens - bescherming moeten worden nageleefd op dezelfde wijze van toepassing zijn op die subverwerkers als op IBM. 6 Controleverlies: gezamenlijke verantwoordelijkhei d met der den. Derde partijen en advertentie - netwerken moeten worden uitgesloten van CP4BAaaS . Hun betrokkenheid is niet noodzakelijk voor het leveren van de diensten. Wan neer deze derden worden uitgesloten houdt de gezam enlijke verantwoordelijkheid op te bestaan en treeft IBM op als verwerker voor de overheidsinstantie als verantwoordelijke. 7 Onrechtmatige doorgifte van persoo nsgegevens naar de VS. Als verwerkingsverantwoordel ijke moet de overheidsinstantie een geldig doorgeef mechanisme verzorgen voor de structurele doorgifte van persoonsgegevens naar de VS. H et effect van de doorgifte moet wo rden beoordeeld in een DTIA.

IBM moet de Google Fonts op haar eigen servers hosten om doorgifte van persoonsgegevens naar Google te v ermijden. Verwerkingen moeten alleen plaatsvinden in de EU/EER , tenzij passende waarborgen van toepassing zijn. 9 Onvere nigbare verdere verwerkingen (marketing, etc.) Controleer regelmatig het gebruik door IBM van persoonsgegevens van primaire betrokkenen voor haar eigen rechtmatige zakelijke belangen om te verzekeren dat de gegevens niet voor deze doeleinden worden gebrui kt. De doeleinden van marketing, productverbetering en bedrijfsinformatie zijn doeleinden van IBM als verwerkingsverantwoordelij ke. Deze doeleinden moeten worden uitgesloten van de algemene voorwaarden, aangezien IBM als verwerker geen eigen doelen mag bep alen Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 20 of 99 Risi co Nr. Hoog risico Maatregelen overheidsinstanties Maatregelen IBM voor verdere verwerkingen van persoonsgegevens die ze ontvangt van de overheidsinstantie 10 Wereldwijde toegang tot ondersteuning zonder mechanisme voor doorgifte n. Optioneel: de overheidsinstantie kan overwegen ondersteuning te beperken tot lokale kantoor uren en uitsluitend van binnen de EU/EER.

(Dit vereist dat IBM inderdaad ondersteuning en toegang tot bepaalde regio’s kan beperken) IBM moet waarborgen kunnen geven met betrekking tot de bescherming van persoonsgegevens volgens de AVG bij het leveren van ondersteuning vanuit vestigingen buiten de EU/EER. Bijvoorbeeld: bindende bedrijfsvoorschriften in combinatie met technische maatregelen. Ook zou IBM de ondersteuning naar de regio’s beperken. IBM must provide guarantees for the prot ection of personal data according to the GDPR when providing support from establishments outside the EU/EEA. For instance, Binding Corporate Rules in combination with technical measures. Alternatively, IBM can limit support to regions. 11 Ontoereikende technische maatregelen in standaardinstellinge n voor e - mail. Schakel de encryptiefunctionaliteit in de setup van de e - mail - applicatie in . Controleer of de instelling op versleutelen blijft staan.

Schakel de versleutelings - instellingen voor het verz enden van e - mails in als standaard. 13 Er niet in slagen om inzageverzoeken van betrokkenen volledig te faciliteren. Controleer jaarlijks de procedures voor inzageverzoeken van IBM en haar subverwerkers en gelieerde ondernemingen. Beoordeel de interne procedures voor inzageverzoeken. Controleer en rapporteer ook over de interne procedures voor inzageverzoeke n van sub verwerkers en gelieerde ondernemingen. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Risiconummer Laag risico Optionele maatregelen overheidsinstantie Optionele maatregelen IBM 8 Onrechtmatige verwerking van bijzonder e categorieën van persoonsgegevens in bestandsnamen. Geef richtsnoeren aan gebruikers van CP4BAaaS om te voorkomen dat bijzondere persoonsge gevens in bestandsnamen worden opgenomen 12 Achtergrondcontrole betrokkene Scherp interne procedures aan om te verbieden dat achtergrondonderzoek wordt gedaan naar betrokkenen bij het verwerken van een verzoek, waaronder ook degene die uitsluitend gebruik maken van publiek toegankelijke bronnen. 14 Tracking pixel in antwoordmail.

Stop het plaatsen van tracking pixels in de bevestigingsmail na een verzoek van een betrokke ne. 15 Emailadres onbedoeld geopenbaard Pas de configuratie van de eigen emailserver aan 16 Applicaties gemaakt op CP4BAaaS kunnen een disproportioneel auditspoor achterlaten. Ins trueer de beheerders van applicaties het auditspoor te minimaliseren. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 22 of 99 Overzicht van mitigerende maatregelen en huidige status ( november 2023) Let op: Deze maatregelen zijn getroffen door IBM. Maatregelen 1, 2, 6, 10 en 11 zijn nog niet getest of anderszins geverifieerd door Privacy Company. Ris ico n r . Hoog risico in relatie tot art. AVG Maatregelen overheidsorga nisaties Maatregelen IBM Status 1 Verlies van controle bovenmatige v erwerking Betreft: e - mailadres, naam en achternaam etc Artikel 24(1) AVG Creëer een account activatie en login binnen de EER met hulp van IBM.

De authenticatie en account activatie diensten moeten binnen afzienbare tijd vanuit de EU worden aangeboden. Alternatief is een technische o plossing om na het aanmaken van een account de gegevens uit de VS te verwijderen. Verwijder het impliciete contract t ussen eindgebruiker en IBM bij het gebruik van de account activatiepagina. IBM bi ed t nu de mogelijkheid om account activatiediensten en login mogelijkheden volledig binnen de EU te hosten. 2 Schending van gegevensbesc herming door standaard instellingen Installatie van personalisatie - en non - functionele cookies. Artikel 25(2) AVG Geef in de gebruikershandl eiding aan dat aandacht moet worden besteed aan de cookie m uur en selecteer de meest privacyvriendeli jke optie. Pas de browserinstellin gen aan, zo dat deze cookies standaard weigert. Wijzig de standaardinstelling voor cookies op de loginpagina naar alleen nood zakelijke cookies.

Plaats deze optie op de eerste pagina. IBM heeft een intern process waarmee ieder kwartaal cookies worden gecontroleerd en indien nodig aangepast. IBM geeft aan de instellingen en categorisering volgens advies aangepast te hebben. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Ris ico n r . Hoog risico in relatie tot art. AVG Maatregelen overheidsorga nisaties Maatregelen IBM Status 3 Gebrek aan transparen tie (cookies) Installati e van personalisatie - en niet - functionele cookies Arti kel 13 AVG Wijzig de instellingen van de browsers, zodat deze standaard cookies weigeren. Geef volledige informatie over de cookies die noodzakelijk zijn voor het functioneren van CP4BAaaS en alle andere gebruikte cookies. IBM heeft de cookies opgeschoond en juist gecategoriseerd. 4 Geen toestemming voor niet - noodzakelijke cookies Artikel 6(1)a AVG, Telecommunic atiewet Wijzig de instellingen van de browsers, zodat deze standaard cookies weigeren.

Cookies waarvoor toestemming van de betrokkene is vereist mogen pas geplaatst worden nadat rechtsgeldige toestemmin g daarvoor is verkregen (in plaats van direct bij laden van de pagina). • Er zijn netwerkrequests naar derde partijen: • TrustArc (aanbieder van de consent manager) • Tiqcdn.co m, dit is Tealium, een tag manager (marketin g) • S81.com, een domein onder controle van IBM • Geen van de derde p artijen plaatst een cookie • Vanuit het domein www.automationc loud.ibm.com worden 6 cookies geplaatst vooraf aan toestemming: • 4 cookies zijn sessie cookies of hebben een verloopdat um in het ver leden . Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 24 of 99 Ris ico n r . Hoog risico in relatie tot art. AVG Maatregelen overheidsorga nisaties Maatregelen IBM Status Deze ku nnen worden beschouw d als ‘function el e ’ cookies • 1 cookie blijft een jaar geldig, maar deze cookie bevat alleen de toestemmi ngskeuze .

De cookie is niet gekoppeld aan een individu en bevat geen pers oonsg egevens . Deze cookie kan ook worden beschouw d als een ‘functionel e’ cookie. 5 Verlies van control e : sub verwerke rs verwerken IP adressen Arti kel 28 AVG en artikel 13 AVG M onitor en audit actief de inzet van subverwerkers door IBM. Maskeer/verber g of maak op andere wijze de IP adressen van de laptops en gebruike rs niet zichtbaar. IBM moet informatie verschaffen over alle subverwerkers in de publieke documen tatie en contracten en informeren over hun taken. Daarnaast moet IBM garanderen dat dezelfde vereisten aangaande gege vensbeschermi IBM heeft de vereiste informatie verstrekt over Cloudflare en Akamai. IBM heeft toegezegd dat uiterlijk eind maart 2024 b eide partijen zijn opgenomen in de privacy verklaring als verwerkers voor IBM voor doeleinden v an beveiliging , content management, en het verifiëren van de Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument.

Ris ico n r . Hoog risico in relatie tot art. AVG Maatregelen overheidsorga nisaties Maatregelen IBM Status ng geld en voor de subverwerkers als voor IBM . geolocat ie van de gebruiker voor compliance doeleinden . (IBM geeft aan dat Cloudflare niet gebruiikt wordt voor Cloud Pak services. Als dat het geval is can Cloudflare buiten beschouwing gelaten worden Dit risico is gemitigeerd . 6 Verlies van controle : gezamenlijke v erwerkingsve rantwoordelijk heid met derde partijen Arti kel 24(1) en arti kel 26 AVG Derde partijen en adverte n tienetwerke n moeten worden ui tgesloten van CP4BAaaS. Hun aanwezigheid is niet noodzakelijk voor het leveren van de di ensten . Wanneer deze partijen zijn uitgesloten is er geen gezamenlijke verwerkingsverantw oordelijkheid mee ren is IBM verwerker voor de overheidsorganisati e als verwerkingsverantw oordelijke. IBM geeft aan dat alle tracking en marketing cookies zijn verwij derd . 7 Onrechtmatige doorgifte van persoonsgegev ens n aar de VS Hoofdstuk 5 AVG Als verwerkingsver antwoordelijke moet de overheidsorgani satie een geldig doorgiftemecha nisme hebben voor de struct urele doorgifte van persoonsgegeve ns naar de VS. De impact van de doorgifte moet worden IBM moet de Google Fonts op haar eigen servers hosten om doorgifte van persoonsgegevens naar Google te voorkomen.

Gegevensverwerkin gen mogen alleen in de EU/EE R plaatsvinden, tenzij passende waarborgen aanwezig zijn. Dit risico is gemitigeerd, geen verdere actie vereist. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 26 of 99 Ris ico n r . Hoog risico in relatie tot art. AVG Maatregelen overheidsorga nisaties Maatregelen IBM Status beoordeeld in een DTIA. 9 Onverenigbare verdere verwerking (marketing, etc.) Arti kel 6(4) AVG Audit regelmatig het gebruik door IBM van persoonsgegeve ns van primaire betrokkenen voor IBM’s eigen doeleinden om zeker te stellen dat dit niet gebeurt. De doeleinden van marketing, product improvement en business intelligence zijn doeleinden van IBM als verwer kingsverantw oordelijke. Deze doeleinden moeten worden verwijderd uit de general terms and conditions, omdat IBM als verwerker niet gerechtigd is eigen doelen voor ver dere verwerking van persoonsgegevens die zij van de overheidsorganisati e heeft ontv angen vast te stellen.

Dit risico is gemitigeerd . 10 Wereldwijde toegang t echnische support zonder doorgiftemech anisme Hoofdstuk 5 AVG Option ee l: de overheidsorgani satie kan overwegen support te beperken tot locale kantooru ren binnen de EU/EER. ( Dit vereist dat IBM support en toegang kan beperken tot regio’s) Option ee l: Interne instructies om geen contentdata of loggegevens inclusief PII in een s upport ticket te delen. IBM moet garanties bieden voor de bescherming van per soonsgegevens bij het bieden van support vanuit vestigingen buiten de EU/EER. Bijvoorbeeld middels Binding Corporate Rules in samenhang met technische maatregelen . Als alternatief kan IBM de support beperken tot regio’s. IBM bi ed t nu de mogelijkheid voor support binnen de EU/EER (beperkt tot lokale kantooruren) . Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Ris ico n r . Hoog risico in relatie tot art. AVG Maatregelen overheidsorga nisaties Maatregelen IBM Status Option ee l: geen toegang/oplossi ng in productieomgev ing, maar alleen in testomgeving.

Optio nee l: Alleen derde lijns support verzoeken naar IBM. Eerste en tweede lijn intern . 11 Onvoldoende technische b eveiligingsma atregelen in standaard e - mail instellingen Arti kel 32 AVG . Zet de encryptiefunctie aan bij het instellen van de e - mailfunct ionalit eit. Monitor of deze ook aaan blijft staan. Stel de encryptiefunctie in als standard voor e - mailconfiguratie s . E - mails worden versleuteld door de overheidsorganisati e, ongeacht de instellin g in CP4BAaaS. Dit risico is gemitigeerd . 13 Niet voll edig voldoen aan inzageverzoek A rt ikel 15 AVG . Audit jaarlijks de procedures voor inzageverzoeke n van IBM en haar subverwe rkers en affiliates. Herzie de interne procedures voor inzageverzoeken . En : Audit en rapporteur over de interne procedures voor inzageverzoeken bij subverwerkers en affiliates. Dit risico is gemitigeerd . Ris ic o n r . L aag risico Optionele maatregelen overheidsorganisat ie Optionele maatregelen IBM Adv ies 8 Onrechtmatige verwerking bijzondere persoonsgegeve ns in bestands namen Geef richtlijnen over CP4BAaaS o m te voorkomen dat bestandsnamen bijzondere Volg advies op. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 28 of 99 Ris ic o n r .

L aag risico Optionele maatregelen overheidsorganisat ie Optionele maatregelen IBM Adv ies persoonsgegevens bevatten. 12 Achtergrondchec k betrokkene inzageverzoek Versterk interne procedures om achtergrondchec ks te verbieden bij inzageverzoeken, inclusief checks op alleen openbare bronnen. Wordt toegevoegd aan de takenlijst. Geen juridische noodzakelijkhei d. 14 Tracking pixel in antwoord e - mail Stop met het insl uiten van tracking pixels in de bevestigingsmail van een inzageverzoek. Wordt toegevoegd aan de takenlijst. Geen juridische noodzakelijkhei d. 15 E - mailadres onbedoeld ontsloten Pas de configuratie van de eigen mailserver aan. Volg advies op. 16 Applicati es gebouwd op CP4BAaaS kunnen een disproportionele audit trail opleveren Instru eer applicati e managers om de audit trail te minimaliseren. Volg advies op. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. 2.2.1 Primary data subjects: users of CP4BAaaS 48 2.2.2 Secondary data subjects: data subjects in Content Data 48 2.2.3 System administrators 48 2.3 Possible categories of personal data 48 2.3.1 Classified inform ation 49 2.3.2 Personal data of a sensitive nature, including special categories of personal data 50 3.

Processing of personal data via IBM CP4BAaaS 50 4. Purposes of the Processing 5 1 4.1 Purposes of the controller 51 4.2 Purposes of IBM 51 4.3 P urposes of ad networks 52 4.4 Purposes of subprocessors 53 5. Controller, Processor, and Subprocessors 53 5.1 The role of the governmental organisation 53 5.1.1 Assessment of the governmental organisation as data controller 53 5.2 The role of IBM 54 5.2.1 Contractual framework 54 5.2.2 Assessment of IBM as data processor 54 Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 30 of 99 5.2.3 Assessment of IBM as data controller 56 5.3 The roles of other parties 56 5.3.1 Akamai 56 5.3.2 CloudFlare 57 5.3.3 TrustArc 57 5.3.4 Ad networks 57 5.4 Assessment of joint controllership 57 6. Interests in the Data Processing 58 6.1 Interests of Dutch governmental organisations 58 6.2 Interests of IBM 58 6.3 Interests of Akamai 58 6.4 Interests of CloudFlare 58 6.5 Interests of advertisers and advertising networks 58 6.6 Interes ts of primary data subjects 59 6.7 Interests of secondary data subjects 59 7.

Location of personal data processing 59 8. Techniques and Methods of the Data Processing 60 8.1 Big data 60 8.2 Automated decision making 60 8.3 Profiling 60 9. Additional Legal Obligations 60 9.1 E - Privacy Directive (Telecommunications Act) 60 10. Retention Periods 62 Part B. Lawfulness of the data processing 64 11. Legal Grounds 64 11.1 Consent 64 11.2 Processing is necessary for the performance of a contract 65 11.3 Processing is necessary to comply with a legal obligation 67 11.4 Processing is necessary for a task in the public interest or for the legitimate interests of the controller or a third party 67 11.5 Valid legal grounds 69 12. Special categories of personal data 70 13. Purpose limitation 70 13.1 Purposes of government organisations as controller 70 13.2 Purposes for which IBM processes personal data as a controller 71 14. Necessity and proportionality 71 14.1 Assessment of the proportionality 71 14.2 Assessment of the subsidiarity 72 15.

Rights of data subjects 72 15.1 Right to information 72 15.2 Right to access 73 15.3 Right of rectification and erasure 73 15.4 Right to object to profiling 73 15.5 Right to data portability 73 Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Part C. Discussion and Assessment of the Risks 75 16. Risks 75 16.1 Assessment of risks 75 16.2 Summary of risks 81 Part D. Description of risk mitigating measures 83 17. Risk mitigating measures 83 17.1 Measures to be taken to mitigate high risks 83 17.2 Assessment of risks after taking mitigating measures 86 Conclusion 87 Appendix 1 – Technical research protocol i Setup of the research systems i Analysis i UC0: setting up an account i UC1: storing, retrieving and editing a document in Word i UC2: searching for documents ii UC3: performing a workflow with a handover of a document iii UC4: sending a document by e - mail iii Verification test iii Appendix 2 – Observed Traffic and Cookies v Appendix 3 – Architecture of CP4BAaaS x Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 32 of 99 Introduction The Dutch Strategic Supply Management IBM (SLM IBM Rijk) as executed by the Tax and Customs Administration (Belastingdienst, hereinafter B D) commissioned this umbrella DPIA to be executed by Privacy Company on the IBM Cloud Pak for Business Automation as a Service (CP4BAaaS).

CP4BAaaS runs on the IBM Cloud infrastructure: servers in data centres controlled by IBM. This umbrella DPIA is meant to provide a general overview of the risks for the rights and freedoms of data subjects that relate to the use of the CP4BAaaS solution when used by a governmental organisation. The umbrella DPIA will provide a government wide generic privacy assessment o n the use of these CP4BAaaS services. T his umbrella DPIA focuses particularly on the processing of Diagnostic Data by IBM. Based on this umbrella DPIA, technical and organisational measures are identified to mitigate these risks. Data Protection Impact Ass essments Under the terms of the General Data Protection Regulation (GDPR), an organisation may be obliged to carry out a data protection impact assessment (DPIA) under certain circumstances. According to a rticle 35, GDPR, a DPIA is required where the organ isation is planning to process personal data and this processing likely constitutes high risks to the rights and freedoms of the data subjects.

DPIAs are intended to shed light on, among other things, the specific processing activities, and the implied ris k to data subjects, and to propose safeguards to mitigate these risks. The purpose of a DPIA is to ensure that any risks to the rights and freedoms of the data subjects, that are attached to the process in question, are mapped and assessed, and that adequa te safeguards have been implemented to mitigate those risks. A DPIA is connected to the right to data protection, which is enshrined in the Charter of Fundamental Rights of the European Union. A DPIA however also considers risks to other fundamental rights and freedoms, such as the freedom of expression, that are beyond the realm of privacy. Consideration 4 of the GDPR explains: “ This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined i n the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity ”.

Umbrella DPIAs versus individual DPIAs A DPIA is required when a controller intends to start a data processing that may lead to a high risk to the rights and freed oms of the data subjects (privacy risks). It investigates the risks to the rights and freedoms of natural persons that are a result of the data processing. Each data controller within the Dutch government that intends to process personal data through CP4BA aaS is required to execute a DPIA if it is likely that the processing will constitute a high risk to the rights and freedoms of natural persons. To standardise the use of software throughout Dutch national government institutions, a series of umbrella DPIA s have been commissioned, that cover the use of specific software packages. These umbrella DPIAs consider the privacy risks that will be connected to most or all implementations of the software within the government, but do not consider the specific risks associated with the purposes of each specific institution.

This umbrella DPIA is therefore meant to help all Dutch national government organisations with the DPIA they shall need to conduct if they Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. intend to deploy CP4BAaaS. It is not in itself a complete DPIA, since it cannot evaluate the context in which an organisation intends to use the system. This lack of context means that the legitimacy of the purpose and the legal grounds of the organisation cannot be considered. This document therefore informs, bu t does not replace, the specific risk assessments the different government organisations implementing CP4BAaaS must make . Scope of this umbrella DPIA This umbrella DPIA applies to the use of IBM Cloud Pak for Business Automation (CP4BAaaS) by Dutch governm ental organisations. The scope was limited to four specific use cases, that were selected by de Belastingdienst, IBM and Privacy Company to be broadly representative of the way many government organisations would use CP4BAaaS.

To select use cases that refl ect the main functionalities and uses of CP4BAaaS, the proposed use cases have been discussed and finetuned with the architect of the central government programme RDDI. The resulted selection covers the scope and functionalities which are most relevant for the information management domain and for the interests of government organisations. The use cases are: 1 Document Management System, including Microsoft Office integration 2 Enterprise search 3 Collaboration between several applications and locations 4 Sending e mail (receiving emails takes place outside the CP4BAaaS environment and is thus excluded) CP4BAaaS as a whole offers a range of functionalities 1 . All functionalities that were not relevant in the context of the use cases above are out of the scope for this umbrella DPIA. Also out of scope is the use of Microsoft Office plug - ins, since those are not used by Dutch governmental organisations.

Dependencies For the discovery phase, IBM has prepared a generic cloud environment that reflects the minimum setup necessary for the execution of the use cases mentioned above. This umbrella DPIA does not verify that this setup matches completely with the actual setups in use at governmental organisations. The test environment was provided as a SaaS PoC environment. Ou tline of this umbrella DPIA This Data Protection Impact Assessment assesses the use of the CP4BAaaS by Dutch governmental organisations, as exemplified by a testing deployment of CP4BAaaS made available for this umbrella DPIA . This umbrella DPIA follows the structure of the Model Gegevensbeschermings effect beoordeling Rijksdienst (DPIA) (September 2017). 2 This model uses a structure of four main divisions, which are reflected here as “parts”. 1 See: https://www.ibm.com/cloud/cloud - pak - for - business - automation. 2 The Model Data Protection Impact Assessment federal government ( D PIA).

For an explanation and examples (in Dutch) see: https://www.rijksoverheid.nl/documenten/ rapporten/2017/09/29/model - gegevensbeschermingseffectbeoordeling - rijksdienst - pia Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 34 of 99 A. Description of the factual data processing B. Assessme nt of the lawfulness of the data processing C. Assessment of the risks for data subjects D. Description of mitigation measures Part A explains the processing by CP4BAaaS in detail in general terms, based on the specific deployment at Dutch governmental organisat ions. This starts with a description of the way the data are collected and processed and describes the categories of personal data and data subjects that may be affected by the processing, the purposes of the data processing, the different roles of the par ties, the different interests related to this processing, the locations where the data are stored and the retention periods.

For this part, project documentation has been investigated, as well as the contracts with vendors, including IBM. Privacy Company h as also experimented with the software that was setup in the cloud on servers prepared by IBM with default settings, allowing access to those parts that were required to execute the use cases. This allowed for the capture of network traffic and for the col lection of information on the servers of IBM. This has provided valuable information about the way CP4BAaaS collects and processes personal data. Part B provides an assessment by Privacy Company, with input from the Belastingdienst and IBM, of the lawfulne ss of these data processings through CP4BAaaS. This analysis starts with an analysis of the extent of the applicability of the GDPR and the ePrivacy Directive, in relation to the legal qualification of the role of any Dutch government organisation as provi der of CP4BAaaS.

Subsequently, Privacy Company has assessed conformity with the key principles of data processing, including transparency, data minimisation, purpose limitation, and the legal ground for the processing, as well as the necessity and proporti onality of the processing, as far as possible in an umbrella DPIA where the context is not always fully established. In this section the legitimacy of any transfers of personal data to countries outside of the EEA is separately addressed, as well as how th e rights of the data subjects are respected. Part C assesses the risks to the rights and freedoms of the data subjects created by the processing activities identified in CP4BAaaS in Part A of this umbrella DPIA . It names specific risks that derive from the se processings and aims to specifically determine both the likelihood that these risks may occur, and the severity of the impact on the rights and freedoms of the data subjects if the risks occur.

Part C also contains an analysis of the severity of each ri sk in terms of the chance the risk will occur and the impact the risk could potentially have on the rights and freedoms of the data subjects. Finally, Part D contains concrete measures that can be taken by either IBM or the individual governmental organisa tions to mitigate the risks identified in Part C. These measures might either reduce the chance the risks occur, or the impact they might have, or both. Part D also contains an assessment of any residual risk attached to the use of CP4BAaaS, that could not be mitigated by applying the suggested measures. If such unmitigated risks remain, the government organisation implementing CP4BAaaS might be required to consult the supervisory agency prior to the processing. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Technical research Privacy company appli ed four different investigation methods: 1. observing the behaviour of CP4BAaaS during several test scenarios; 2. analysing the audit logs available within the management interface of CP4BAaaS; 3. the interception and decoding of traffic to and from CP4BAaaS during the execution of the test scenarios; 4. filing an access request directly with IBM for data collected by CP4BAaaS and linked services.

The test scenarios were designed to resemble the most common use of CP4BAaaS within the government. The test scenarios contained five use cases: • UC0: setting up an account • UC1: storing, retrieving and editing a document in Word • UC2: searching for documents • UC3: performing a workflow with a handover of a document • UC4: sending a document per e - mail A detailed list of steps of the test scenarios is available in Appendix 1. During the configuration needed for UC3, a technical problem arose. For this problem the helpdesk of IBM was contacted. After extensive contact with IBM, a workflow for testing UC3 was configured. For UC4 a SMTP server needed to be configured. IBM agreed to provide one of their servers that could be used in the development environment. This server was configured on the 31 st of January 2022. To setup this server correctly, an IBM representative with administrator access to the testing environment was needed.

In response to the data subject access request, IBM indicated that selecting the minimal cookie settings during login would result in only two cookies being set by providers outside of the IBM d omains. An additional test was performed by Privacy Company to verify this claim. For this test a clean browser instance with an empty cookie storage and cache was used to log in with an already initiated account, that had all settings to minimal usage of cookies. With this setup the page dpia.automationcloud.ibm.com was opened, after which the “obliged” cookies setting was selected. Then, when the account was logged in, a file was downloaded from the ‘navigator’ application. After this procedure, the accou nt was logged out. This verification test confirmed the findings of the tests performed for UC0 to UC2. Privacy Company ensured that both the research and the analysis of the results are reproduceable and repeatable.

This was done by performing the testin g from a browser with a clean profile and well - defined settings. The test scripts were executed with a small break between each step, in which screenshots were made between the steps to document the process. In the background all traffic to and from CP4BAa aS was captured for later analysis. The analysis consisted of both manually inspecting the captured traffic and of automated analysis (with programmed scripts) to reproduce the results as seen during manual inspection. Part of the automated analysis were ‘ whois’ 3 lookups both on the domain names used and the ip - addresses 3 RFC - 3912, https://datatracker.ie tf.org/doc/rfc3912/ Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 36 of 99 traffic was observed to. These lookups provide ownership and country information as it is registered with the subsequent registries for domain names and ip - addresses.

Based on the observe d traffic, two sets of data subject access requests were filed with IBM, one request directly at the account manager of IBM, one through the official privacy portal of IBM. The request that was filed at the account manager of IBM asked for both the Content Data and Diagnostic Data that were linked to IP - addresses from which the testing was done, that were linked to the usernames used during testing, and that were linked to other identifiers found within the traffic . In total approximately one hundred entiti es were requested. In the first response IBM provided the server logs of the dpia.automationcloud.ibm.com webserver cluster. These files were extensively analysed on completeness and on content they contained. Subsequently, IBM gave also an overview of th e purposes, identifiers used and locations of the endpoints we observed traffic to. IBM also indicated of which endpoints they would be able to provide server logs.

A second data subject access request was filed through the official portal IBM provides fo r privacy inquiries. This request asked for all data, including all items as listed in GDPR article 15) linked to two of the test accounts and to the two IP - address from which the testing was done. This request was submitted from the e - mail address of a sy stem administrator account, where the administrator asked for processed data to be able to comply to a data subject access request the system administrator had received. In the first response, the DSR Operations team of IBM’s IBM Chief Privacy Office respo nded with a request to confirm the correctness of the accounts and IP - addresses. To this request was responded with a confirmation from the system administrator e - mail address. Subsequently, the DSR Operations team sent requests to the e - mail addresses of the two test accounts the system administrator asked information about, with the request to submit a data subject access request form and to provide ID’s.

To this request was reacted from the test account e - mail addresses, explaining they are test accounts owned by the system administrator. These responses contained the completed data subject access request form and a copy of the ID of the system administrator. Details on the test environment IBM provided Privacy Company with a testing environment of CP4BA aaS. This was a standard environment as would be set up for production. Because the investigators observed unusual behaviour form the login page of the testing site, IBM was explicitly asked for confirmation whether the production site would use the same l ogin page as the testing site provided to the investigators. IBM answered this question with: To first create an account, we received an activation link that directed us to https://www.automationcloud.ibm.com/. This site must be visited by the users to activate their account. When you want to log in you are also redirected to this domain.

Only after finishing this investigation IBM mentioned that in a typical setup the customer would use its own system for Identity and Access Management (IAM), which woul d make it possible to bypass the htpps://www.automationcloud.ibm.com/ page. The environment was created with one administrator account. With this administrator account two other administrator accounts were set up and three accounts for normal users. The t esting was done with the accounts for normal users while the administrator accounts were used for setting up the environment and as reference. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. A Windows 10 laptop owned by Privacy Company was used for testing. The laptop had both IPv4 and IPv6 connectivit y. To intercept TLS encrypted traffic, a SSL root certificate was created and added to the list of known root certificates of Windows.

This made it possible for MITMproxy to intercept TLS encrypted traffic. Firefox was used as a browser. For each user acco unt at CP4BAaaS, the investigators created a separate profile in Firefox, to avoid irreproducible results caused by cookies or cached files present from visits with other accounts. These profiles were clean, without any cookies present or data in cache. In each profile Firefox was configured to accept all cookies, to not send a ‘Do Not Track’ header and to use the localhost as proxy for MITMproxy. CP4BAaaS is regularly updated. Because there was some delay in setting up the tests for the further use cases due to technical issues with the provided environment, the testing was continued after there had been updates to CP4BAaaS and Firefox. The versions used for testing the different use cases are listed in the table below: Table 1 - T est use cases overview Use case Version (date) of CP4BAaaS Version of Firefox UC0: setting up an account 2021 - 11 - 29 94.0 UC1: storing, retrieving and editing a document in Word 2021 - 11 - 29 94.0 UC2: searching for documents 2022 - 01 - 14 96.0 UC3: performing a workflow with a handover of a document 2022 - 01 - 14 96.0 UC4: sending a document by e - mail 2022 - 02 — 8 97.0 Verification test 2022 - 01 - 27 96.0.2 Interception was primarily done with MITMproxy, but for reference Wireshark was also used to make a full dump of all network traffic.

The version of MITMproxy used was 7.0.4, in combination with Python 3.9.7 and OpenSSL 1.1.1l. Timeline of this umbrella DPIA The testing scenarios have been prepared and accepted by the BD and architect RDDI in Nove mber 2021. The actual tests were performed in November 2021 and January and February 2022. In November and December 2021 a legal analysis was performed and a first data subject access request was initiated (directly at the IBM administrators) . In January 2 022, findings were updated and extended based on the newly performed use cases and responses from IBM to questions asked by Privacy Company. Also a new data subject access request was initiated via the formal procedure. In February 2022, based on the respo nses to the data subject access requests, the findings were further updated and the actual assessment was performed. Word of caution Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 38 of 99 This umbrella DPIA assesses the use of CP4BAaaS but cannot take into consideration the circumstances of deploying this sof tware in a specific environment.

Any governmental organisation that is deploying CP4BAaaS will have to consider whether their use of the software requires a DPIA, and will have to re - examine the findings of this umbrella DPIA in the context they operate in . This umbrella DPIA can serve as a basis for these specific DPIAs but cannot replace them altogether. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Part A. Description of the Data Processing 1. Description of the Processing This first part of this umbrella DPIA provides a description of the data proce ssing when using IBM Cloud Pak for Business Automation as a Service (CP4BAaaS). With IBM CP4BAaaS, IBM aims to provide a single platform to manage enterprise content, process workflows, automate tasks, and to use intelligent capture – the automatic discove ry and verification of unformatted data. The Digital Business Automation on Cloud platform consists of several parts, including an authentication services layer and a backend.

For each customer, IBM will setup a tenant , a dedicated environment in the IBM c loud. IBM Cloud is the infrastructure provider for CP4BAaaS. Within the tenant, IBM provides the customer with a development, a testing, and a production environment. The basic system architecture is displayed in Figure 1 below. Figure 1 - Architecture overview for IBM Digital Business Automation on Cloud tenants (see Appendix 3 for a full size version) . 1.1 Account activation A new user receives an email link to the CP4BAaaS account activation page. This page is independent from the CP4BAaaS environment the government organisation is running CP4BAaaS on and is instead operated directly by IBM. When opening this page, a pop - up appears with an explanation of the cookie settings. The default setting includes Personalisation and allows IB M and its authorized partners to use cookies, collect data via these cookies, collect statistics, and personalise the web experience, and to display more relevant advertisements on websites of third parties.

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 40 of 99 Figure 2 - Pop - up on s tart screen account activation The user has the option to choose another setting, which is referred to in the description as ‘necessary cookies’. Via ‘Preferences for cookies’ the user can choose between three levels. The default setting includes all pe rmissions. The other options are ‘Functional cookies’ and ‘Mandatory cookies’ (which appears to match with the description of ‘necessary cookies’ mentioned above). The choice can be made by adjusting a slider. The slider only becomes available when the use r selects the ‘preferences for cookies’ button. Next to the slider, an explanation of the functionalities and permissions that are included in the selected setting is presented. Figure 3 - Slider for cookie options (default setting ) When adjusting the slider, the explanation also indicates what functionality is not activated by IBM (‘not allowed’).

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Figure 4 - Slider adjusted Via advanced settings, more information on the cookie settings can be found, and there is an option to explore the list of cookies per setting. It appeared that the cookies listed by IBM were not the same as the cookies that were issued in practice. Figure 5 - Advanced settings Figure 6 - Example of list of cookies Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 42 of 99 Before the selection of the cookie preferences, the site makes 15 requests to domains that are not controlled by IBM (based on the domain WhoIs register). Six of these sites already issue third - party tracking c ookies to the user’s computer. 4 Some of these cookies contained a tracking ID and were set by hosts owned by companies that are known for profiling users, including Microsoft, Adobe and Twitter.

When selecting “mandatory cookies”, this number remains the same. When selecting the default setting (Personalized), on top of the third - party cookies already set about seventy additional cookies from thirty - one third - party sites are issued. During subsequent testing, the number of additional cookies varied, but st ayed within the same magnitude . Also, the exact list of third - party hosts and third - party cookies varied. In one case, after the authentication of one of the administrator accounts timed out because of a long period of inactivity, the login page the browse r was redirected to, displayed a survey about the satisfaction with CP4BAaaS. Several requests to third - party servers were made while displaying this survey. Because this happened to an administrator account and not a testing account, the traffic for this event was not fully captured. This behaviour of the system could not be recreated with a testing account.

IBM has indicated that this survey will be removed from all IBM pages on the 16 th of February 2022. When opening the login page after account activat ion, the pop - up for cookie choices does not appear anymore, but it is possible to open it again by clicking on a button on the lower right side of the page. Figure 7 - Login page after activation 1.2 Logging in When opening the login page with a browser that previously selected the minimal cookie settings, the page still makes the same third - party requests and sets the same cookies as during activation before consent. Because IBM contested these findings in reaction to the data subjec t access request, this finding was also replicated with a 4 See Appendix 2, table “Requests and cookies before consent ” Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. browser that did not contain any cookies or cached items, while directly selecting the most minimal cookie settings.

When opening the login page with a browser that previously selected one of the mo re permissive cookie settings, the site makes the same third - party requests and sets the same cookies as when selecting the same more permissive cookie settings during activating of the account. The login page contains a link to a privacy statement 5 and terms of usage 6 . The content of these pages differs from the documents from the contractual framework. See paragraph 5.2.1 (Contractual framework). 1.3 Authentication The server www.automationcloud.ibm.com provides the frontend during authentication. It uses an authentication server (LDAP) as backend. It is possible to configure what authentication server is used, allowing for the implementation of single sign - on. The naming of the backend server (the name contains ‘ams’) in the test se tup strongly suggests the test setup uses a LDAP sever that is located in Amsterdam.

In the default configuration, authentication is done with an e - mail address as the username, and a password. An admin user can add new users via an access management conso le. By default, CP4BAaaS had several user groups configured. Depending on the choices made in the access management console, users are assigned to several of these groups. Beside the initial user that is created during provisioning, CP4BAaaS comes with one other user configured: “ECMoC_Service_Account”. This is a system account, not connected to any natural person. 1.4 Use after login After login, CP4BAaaS triggers third - party requests to one site, fonts.gstatic.com, and no third - party cookies are set. After lo gging in, during the testing both using the ‘Navigator’ (File browser) and the test application, requests were made to six different hostnames. Five of these hostnames were owned by IBM (based on the domain WhoIs database).

The underlying IP - addresses were owned by SoftLayer Technologies Inc, Cloudflare, Inc and Akamai Technologies. Inc. SoftLayer is a company owned by IBM, Cloudflare and Akamai are content delivery networks that operate independent from IBM. The main site, dpia.automationcloud.ibm.com, is located in Amsterdam according to information from IBM. This is confirmed by the WhoIs database information and network traces. According to IBM, the hosts www.automation cloud.ibm.com and login.ibm.com are located in the USA, while the other hosts are dis tributed globally. Because of the use of content delivery networks for these hosts, the visible endpoints were located within the EU, so the actual physical location of these hosts could not be independently confirmed. Another host the browser made request s to was fonts.gstatic.com. This host and its associated IP addresses are registered to Google LLC.

This host serves fonts used for the lay - out of the site. These requests have an expiry time of one year, which means that the browser caches the fonts up to a year. In the meantime, the cached fonts 5 http://www.ibm.com/privacy/nl/nl 6 https://www.ibm.com/nl - nl/legal Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 44 of 99 are not requested again from the same browser. The host fonts.gstatic.com did not set any cookies and no cookies were observed to be transmitted to fonts.gstatic.com. CP4BAaaS does not have built - in functionalitie s for geotagging, geolocation or reverse geo - lookups. As example of use after login, Table 2 shows the servers used during the testing for UC1 (storing, retrieving and editing a document in Word) with the most permissive cookie settings. This test run took 18 minutes. Table 2 - Servers observed when using CP4BAaaS H ostname R equests R egistrant of IP - address # % dpia.automationcloud.ibm.com 148 89% SoftLayer Technologies, Inc www.automationcloud.ibm.com 15 9% Cloudflare, Inc. login.ibm.com 2 1% Akamai Technologies, Inc. dbdm - events.mybluemix.net 2 1% SoftLayer Technologies, Inc www - api.ibm.com 1 1% Akamai Technologies, Inc. 1.5 Audit trail, logging and D iagnostic Data CP4BAaaS retains old versions of the documents and registers which user created a new version of a document and when .

When browsing through the lists of documents this history is accessible for normal users at the bottom of the page. It is possible to set a retention period for types of documents. Within this retention period it is impossible to delete the document. Automated deletion of documents must be programmed in the application build upon CP4BAaaS in the BACSoc (FileNet Content Manager). Deleting a d ocument also deletes the history of the document and any other reference to it. In the default configuration there is no undelete function and no log entry about the deletion, so with the default configuration, a deleted document disappears without a trace . It is possible to enable audit logging in the site configuration and to configure events to log. The retention period of the audit logs is adjustable. The management interface for site administrators provides the option to download logfiles of CP4BAaaS.

These logfiles are available in different verbosity. The configuration panels have an option to mask the UserID in the logfiles. This option is enabled b y default. Analysis of these logfiles shows that the only direct identifier within these logfiles was the username used when a user logs in. On its most detailed level, it contained many details on the performance of the application, without including any other direct identifiers. Nevertheless, the logs related to a username have to be considered personal data as well. The content of the traffic between the browser and CP4BAaaS did not contain any metrics about the browser or about the behaviour of the user , such as mouse movements or key presses. Nor did the traffic contain any debug information. The process of requesting a web page inevitably involves sending some data to the webserver, such as the requested webpage, the version of the web browser used, th e webpage the request was made from, and authentication information when logged in.

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. To what extent this data is used for diagnostic purposes cannot be determined by analysing web traffic but must be determined through data subject access requests. The very limited answers of IBM to the data subject access requests (see paragraph 1.8) did not contain any indication of analysis of the behaviour of users by IBM, but the answers were so limited that it is impossible to give a reliable indication about the absen ce of such processing. 1.6 Document search CP4BAaaS has a built - in search engine as well as the option to configure alternative search engines, like Watson or Elastic. Only the built - in search engine is part of this umbrella DPIA . If a government organisation wishes to implement an alternative search engine, the data protection implications need to be separately investigated.

The built - in search engine does not search the content of the documents. For it to be able to search the content of Microsof t Office documents, it needs to have a plugin loaded in Microsoft Office, which is never used by the Dutch government and therefore out of scope for this umbrella DPIA.. The built - in search engine does search file names as well as properties stored with th e file, such as tags, additional data fields and other file properties. The search engine offers to save searches, to repeat them later and to make them available to other users. It respects the permissions the user performing the search has been granted: documents the user does not have access to, will not appear in the search results. 1.7 Sending mail The ‘Navigator’ application (file browser) offers the possibility to send documents by mail. When selecting it, it offers a basic interface to compose a mail.

A link to the selected document is included in the mail. This link points to the document and is the same for every sender and recipient. The link does not contain any authentication information. CP4BAaaS will restrict access to each document to those users that have permission to view and download the document. If the user lacks permissions to be able to open the document, CP4BAaaS will display the login page instead. The mail sent when sharing documents does not contain any elements that are loaded from a server when displaying the mail. Nor does the mail contain any tracking pixels. The ‘from’ address is an administrative address unique to the instance of CP4BAaaS. The ‘reply - to’ address is the e - mail address the sender used while logged in to CP4BAaaS. Th is e - mail address is also visible in several different header lines. The communication between CP4BAaaS and the e - mail server used for sending the mail, can be configured to be encrypted.

The maintainers of this sending e - mail server are also responsible f or the configuration of DKIM, SPF, DMARC, DNSSec and DANE. 1.8 Data subject access request As part of this umbrella DPIA two data subject access request (cf. article 15 GDPR) were filed with IBM to obtain an overview of the log files and other personal data th at was collected during the testing of the use cases. As response to the first request that was filed with IBM account manager, IBM only provided a small part of the requested data. This batch of data was provided a couple of days after the deadline of one month had expired . No notification of a delay or of an extension of the deadline, in accordance with article 12(3) GDPR, was given . The rights of the data subject were thus not fully respected in this case. Moreover, instead of fulfilling the request, IBM employees have attempted to collect more information from public sources about the individuals behind the request.

Using the IP - addresses included in the request for this uDPIA and the name of the owner, additional searches have been performed, most Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 46 of 99 likel y via Google Search, to collect information about websites and projects the individual had worked on in the past. The searches were subsequently revealed to Privacy Company researchers, when they were included in forwarded emails showing the internal discu ssions of IBM employees that handled the request. The data subject access requests were based on different types of identifiers. First, for each of the dedicated test users all information known about the behaviour of that test user, identified by the user names, and any other data linked to that test user was requested. IBM answered to this request that they do not collect any data like that. The second type of data requests was using the users IP - addresses (both IPv4 and Ipv6) as identifier.

For each of th e 29 servers/server clusters were traffic was observed, the server logs and any other information linked to the users IP - addresses were requested. IBM provided the server logs of one server: dpia.automation - cloud.ibm.com, the main host of the CP4BAaaS ins tance setup for this umbrella DPIA . For the 28 other servers no logs were provided. The provided logs contained all requests to the for this umbrella DPIA set up test instance of the IBM cloudCP4BAaaS over a timeframe of 7 days. The data subject informatio n request did not limit in time but asked specifically for all requests from the specified IP - addresses. Because they were limited by time, the provided logs contained less information th a n requested. By providing all requests, including requests from four unrelated IP - addresses, the provided logs contained more information than requested, including the behaviour of unknown users and unrelated requests.

The server logs contained several details about the requests, including the IP - addresses of the users and , when the request was made by a user that was logged in, the username of that user. The presence of the username contradicts the answer IBM gave to the first type of data subject request: the data subject access requests based on username. Comparing the logs to a sample of 322 observed requests showed one (0.3%) request that was in the server logs and that could not be connected to an observed request. This was a long polling request for notifications. At the same time 9 (2.8%) observed requests could not be found in the provided logs. The timestamps in the provided logs were in Central Standard Time (CST) and not in the more usual Coordinated Universal Time (UTC). Because many of the requests logged were calls to REST - APIs, the logfile provides only a lit tle information about the user’s behaviour within CP4BAaaS.

Most information can be derived from the timing of the activity and the IP - addresses a user has. The third type of data requests were based on the third - party cookies that were set during the test ing. For each of those cookies that contained an ‘unique user identity’ (UUID) a request was filed to provide all information linked to that UUID. IBM did not provide any information in reaction to these requests. In a second reaction to this information r equest, IBM provided for each of the observed endpoints the purposes of the processing of that endpoint, what data can be linked to the end - users IP - address, if logs can be provided, the location of the service host, the location of the database backends, the locations the data is mirrored to and the locations the metadata is mirrored to. This overview indicates IBM is also able to provide information from the logfiles of www.automationcloud.ibm.com and www.ibm.com .

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. The second set of data subject access requests was submitted with the webform of IBM’s privacy portal 7 . This request was written from the perspe ctive of a system administrator who needs additional information from IBM to comply with a data subject access request filed the controller’s system administrator and asked for all data linked to two of the test users accounts and to the IP - addresses the t esting was performed with . The submission of the form was confirmed with an automated reply. This reply was sen t by a S endgrid mailer. Sendgrid is a domain owned by IBM. The location of the originating mail server for this automated mail could only be esti mated, but it appears to be located in the USA . This automated mail contained a tracking pixel that can be used to keep track of opening the mail.

This data subject access request was handled by the IBM chief privacy office, which is located in Canada. The Chief Privacy office replied with a request to clarify how the system administrator was contacted, with a request for the original data subject access requests and a request for more information on how the IP - addresses where obtained. This request was ans wered with a confirmation that the system administrator acts on behalf of the data - responsible organisation of the test site and a confirmation of the identity of the system administrator. Subsequently both the test users received on their e - mail address a request to confirm their identity with a copy of their ID. In the replies to these requests, the ID of the system administrator was presented, with an explanation that these accounts are test accounts of the system administrator. These requests were answe red from the e - mail addresses of the test users. 2.

Personal Data and Data Subjects The Dutch government DPIA model requires that this section provides a list of the kinds of personal data that will be processed, and per category of data subjects, what kind o f personal data will be processed by the product or service for which the DPIA is conducted. To help readers that are not GDPR experts understand the data protection risks, this section explains in detail why the stored Diagnostic Data about the use of CP4 BAaaS are personal data as defined in article 4(1) of the General Data Protection Regulation (GDPR). 2.1 Definition of personal data According to article 4(1) (a) GDPR, “‘personal data’ means any information relating to an identified or identifiable natural pe rson (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” 2.2 Possible types of data subjects Three general groups of data subjects have been recognised in the processing of personal data through C P4BAaaS.

This umbrella DPIA targets the processing of personal data of CP4BAaaS users primarily. This group consists of employees and contract workers of the governmental organisation deploying CP4BAaaS. In the remainder of this umbrella DPIA this group wi ll be referred to as the ‘ primary data subjects ’. This group will work with CP4BAaaS and, depending on their activities, they will process personal data of other data subjects, such as their co - workers, Dutch inhabitants, and other contacts outside the gov ernmental organisation. This umbrella 7 https://www.ibm.com/privacy/portal/us - en Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 48 of 99 DPIA will call this group ‘ secondary data subjects ’. The third group is the small group of administrators of the CP4BAaaS deployment. This umbrella DPIA can only indicate types of personal data and types of data subjec ts that may be involved in the processing but cannot assess the specific risks of the actual data processing per organisation that uses or will use CP4BAaaS.

The risks for data subjects strongly depend on the privacy choices and settings that each organisa tion makes, as well as on the nature of the work performed by their employees and the specific characteristics of the group of secondary data subjects. 2.2.1 Primary data subjects: users of CP4BAaaS This group consists of all people that make use of CP4BAaaS for work related activities. They log onto the system and use it to do their work. During the course of these activities CP4BAaaS collects and processes information about the way they work: Diagnostic Data (see chapter 2.3). They are either employ ees or contract workers of the governmental organisation, or in some cases employees of parties contracted by the governmental organisation. 2.2.2 Secondary data subjects: data subjects in Content Data This group consists of anyone who’s data is being processed by the governmental organisation through the use of CP4BAaaS.

The group will be different for each governmental organisation. The type of information that the governmental organisation processes for this group also depends on the activities of the organisa tion. These data are considered Content Data. Processings concerning Content Data are considered out of scope for this umbrella DPIA, because the required context for the analysis of risk is not available. However, this umbrella DPIA does investigate to wh at extend Content Data can be included in the processing of Diagnostic Data. It should be noted that in many cases, personal data of primary data subjects will be included in the Content Data, for instance when they are named in the content of documents or files , or when they are themselves subject to the business activities of the government organisation they work for (a parent of students, who happens to work at the Ministry for Education, for instance). 2.2.3 System administrators A special subset of the prima ry data subjects is the group of system administrators, for whom additional data , like a more extended audit log, may be processed.

They are the data subjects with special administration rights, who can make changes to the way CP4BAaaS functions. 2.3 Possible categories of personal data This umbrella DPIA has found that the following types of personal data may be processed for each of the three groups of data subjects: Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Table 3 - Overview of possible categories of personal data processed in CP4BAaaS Data subjects Categories of personal data Sensitivity level Primary (users of CP4BAaaS) User account data: e - mail address as username, password, name. Normal Diagnostic D ata: IP address, use times, activities (log data), device identifiers. Normal Cookies: functional cookies, tracking cookies. Normal Audit logs: logging configured to log certain user actions. Normal Server request logs: logging tracking the requests the user’s browser makes.

Normal Application logs: logging to track the internal performance of the application. Contains username when a user logs in, may contain usernames at more places. Normal Secondary (data subjects in Content Data ) Content Data : Depending on the purpose of the organisation: BSN, name, address, email, case information, complaints, communication, etc. Depends on the use of CP4BAaaS System admins Audit logs: logging configured to log certain system administrator actions. Normal The processing of personal data with a normal sensitivity level may become more sensitive when processed in disproportionate amounts. 2.3.1 Classified information Some Dutch government e mployees will, depending on the capacity in which they work, frequently process Classified Information. The Dutch government defines four classes of Classified Information, ranging from confidential within the ministry to extra secret state secret. 8 Classified Information is not a separate category of data in the GDPR or other personal data legislation.

Nonetheless, information processed by the government that is qualified as classified information, whether it qualifies as personal data or not, must l egally be protected by special safeguards. The processing of this information when related to an individual, can also have a privacy impact. If the personal data of an employee, such as an account ID, or unique device identifier, can be connected to the in formation that this person works with Classified Information, the impact on the private life of this employee may be higher than if that person would only process ‘regular’ personal data. Unauthorised use of this information could for example lead 8 Defined in: Besluit Voorschrift Informatiebeveiliging Rijksdienst Bijzondere Informatie 2013 (VIRBI 2013) Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 50 of 99 to a hig her risk of being targeted for social engineering, spear phishing and/or blackmailing.

Therefore, information that connects an employee with their access to classified information, can increase the risks to the rights and freedoms of that individual. When processing such information, the risk assessment must be adjusted accordingly to take this increased risk into account. This is especially relevant for the risk of processing this data outside the European Economic Area (EEA) or for the risk of processing this data by subprocessors or joint controllers. 2.3.2 Personal data of a sensitive nature, including special categories of personal data Depending on the nature of the core activities a governmental organisation uses CP4BAaaS for, highly sensitive data may be p rocessed through CP4BAaaS. Organisations active in delivering health care to patients, or working with information about people’s sexuality, ethnicity, religion or political affiliation may plan to process special categories of personal data as a matter of routine in CP4BAaaS.

Many governmental organisations will also be mandated in law to process the national identification number (Burgerservicenummer, BSN) , which is also considered personal data of a sensitive nature. While these organisations are author ised as well as expected to process these sensitive data, the data protection measures implemented must in these cases reflect the increased risks for the rights and freedoms of the data subjects. To test this, Privacy Company has included in the test scen arios several types of fake sensitive data to be able to track the use of these data. These fake sensitive data were entered into the document contents, in the document names, and in the tags/data fields added to the documents. Neither t he server request l ogs , nor the application logs contained any of these fake sensitive data, demonstrating that it is unlikely that Content Data may inadvertently end up in Diagnostic Data sources when using CP4BAaaS. 3.

Processing of personal data via IBM CP4BAaaS The followin g processings have been detected when using CP4BAaaS. Table 4 - Overview of processings in CP4BAaaS Processing Data subjects Personal data Account creation Primary data subjects Username, email, password, settings, roles Tracking Primary data subjects IP address, cookie IDs, cookie consent choice, visiting domain, time of use, location, device information, browser settings Login Primary data subjects Username, password, IP address, date and time, roles Environment creat ion Admins Logs, personal settings, work done, role Document creation Primary data subjects Username, date and time, activity log, filenames, etc. Secondary data subjects Any personal data included in the document (Content Data), including possibly BSN, special Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. categories of personal data, etc. Workflow execution Primary data subjects Username, date and time, role, activity log, filenames, etc. Secondary data subjects Po ssibly: Name, email address, home address, case information, etc. Search documents Primary data subjects Username, activity log, search terms, etc. Secondary data subjects Any available data Server request logging Primary data subjects IP - address, username, browser characteristics, date and time, pages visited Application logging Primary data subjects Username, date and time, application functions used Audit trail creation Anyone Can be fully configured, can be setup to contain Content Data. 4.

Purposes of the Processing 4.1 Purposes of the controller The specific purposes for which a governmental organisation will be processing Content Data through CP4BAaaS are impossible to predict in an umbrella DPIA such as this one. However, several general purposes for the processing of Diagnostic Data can be expected to apply to all organisations implementing CP4BAaaS: • The use of CP4BAaaS facilitates the creation and monitoring of workflows. Workflow management is needed to ef ficiently and accurately execute the tasks of the governmental organisation and to monitor whether tasks are up to schedule. • CP4BAaaS can also be used to exchange documents between applications. • CP4BAaaS includes options to search content based on labels o r other types of metadata. Full text search is possible as well but was not tested as part of this umbrella DPIA . • CP4BAaaS can be used to store and retain documents and other content, and to delete content after expiration of the retention term. 4.2 Purposes of IBM The purposes of the processing by IBM are generally defined by the governmental organisation deploying CP4BAaaS.

According to the Data Processing and Protection Datasheet, IBM's data actions based on Client's instructions are: • Collection • Di rect data collection from individuals through manual or automated means • Transformation • Manipulation (parsing, formatting or transformation) of data • Use • Reading data only Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 52 of 99 • Presenting, accessing, using or copying data • Sharing with third parties • Storage of dat a, including backups • Deletion of data The governmental organisation will define the purposes related to these processing activities. According to the Data Processing Addendum, the governmental organisation assigns to IBM the role of processor. The purpose and subject matter of the processing by IBM is the provisioning of the Service as described in the Agreement. Some additional purposes are defined by IBM.

These purposes concern the professional information required for business dealings (entering into and providing the contracts), and certain account information to provide support and improve the services. As stated in the General Terms for Cloud Offerings: “IBM, its affiliates, and contractors of either require use of business contact information and cert ain account usage information. This information is not Content. Business contact information is used to communicate and manage business dealings with the Client. Examples of business contact information include name, business telephone, address, email, and user ID. Account usage information is required to enable, provide, manage, support, administer, and improve Cloud Services. Examples of account usage information include digital information gathered using tracking technologies, such as cookies and web bea cons during use of the IBM Cloud Services.”

As part of the data subject access requests, IBM also provided a list of purposes of the processings done by the various endpoints of the communication. Beside the main side (dpia.automationcloud.ibm.com), reque sts were made to IBM owned sites to facilitate authentication of users, distribution of common scripts, determining the IP - based location of the user to present the right type of consent choice, serving the favorites icon and synchronizing consent choices when visiting other IBM sites. The sites not owned by IBM were used for cookie consent management, analytics and marketing tags and beacons, marketing analytics, and javascript error logging. 4.3 Purposes of ad networks When creating an account, the researcher s detected the placement of several dozen cookies, depending on the chosen settings for the acceptance of cookies. With the default, accepting cookie setting, 42 different hosts set in total 100 different cookies.

Because some cookies were set multiple tim es, in total 241 times a cookie was set. Of the 42 different hosts setting a cookie, 5 hosts were controlled by IBM, 37 were third party hosts. Some of these were placed after the user gave consent, while other s were placed before consent was asked. Before obtaining consent, 4 servers controlled by IBM set cookies and servers controlled by Demdex, Twitter, Microsoft, Adobe, TowerData and MathTag set cookies. All of the servers that were not controlled by IBM did set third party tracking cookies. Most of the 37 hosts setting third party cookies were setting so - called tracking cookies , which are placed for the purpose of creating user profiles for ad networks such as Google’s Doubleclick , which was detected . With the cookies, users can be tracked as they use a multitude of websites for professional or personal purposes, creating a detailed picture of the interests and activities of the user.

This information can be used in any number of ways, most notably fo r the personalisation of ads, even when no ads are placed on the CP4BAaaS environment. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. 4.4 Purposes of subprocessors Several subprocessors are involved in the processing for CP4BAaaS. Most notably, cloud providers Akamai and CloudFlare. Privacy Company was no t able to detect whether those parties process personal data for purposes of their own . They seem to act only for the purposes of their customers. 5. Controller, Processor, and Subprocessors The different roles of the involved (commercial) parties in the proc essing of personal data are defined in a rticle 4(7 to 9 ) GDPR: 'Controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; 'Processor' means a natural or legal person, public a uthority, agency or other body which processes personal data on behalf of the controller.

For the purpose of this umbrella DPIA, it is essential to establish what roles the different parties involved in the data processing have. In this chapter, the differ ent parties will be described and the information about their expected roles, based on the agreements they have engaged in, is described. 5.1 The role of the governmental organisation 5.1.1 Assessment of the governmental organisation as data controller The governmental organisation qualifies as an independent data controller when determining the purposes and means of the processing. By choosing to use IBM and giving instructions on the data processing and the related purposes, the governmental organisation i s a data controller. To be in control, and to factually determine the purposes of the processing, the governmental organisation needs to take contractual measures to limit the data processing to self - determined purposes.

The governmental organisation must also take organisational and technical measures to prohibit types of processing for which IBM would be qualified as (joint) controller. Based on the DPA (article 3): “IBM will Process Client Personal Data according to Client’s documented instructions. T he scope of Client’s instructions for the Processing of Client Personal Data is defined by the Agreement, and, if applicable, Client’s and its authorized users’ use and configuration of the features of the Service.” Client Personal Data as listed by IBM in the DPA is defined in line with the GDPR and includes several categories and types of personal data. Diagnostic data are covered by the items in the list when seen as data concerning ‘behavior’ or ‘technology identifiers’. 9 As far as the instructions in the Agreement cover the intended data processings, the governmental organisation is in control as far as it concerns the organisational 9 Article 2.2.1 of the DPA Exhibit – IBM Services for Managed Apps (Any Cloud).

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 54 of 99 measures. This implies that for the processings by IBM to deliver CP4BAaaS the governmental organisation is the controll er. 5.2 The role of IBM 5.2.1 Contractual framework When using the CP4BAaaS services, the governmental organisation must conclude a general service agreement, in which the services are described, and their use is regulated. In addition to this general agreement, IBM applies several other documents containing terms and conditions. According to IBM, t he relevant documents for the tested services in the course of this DPIA are the following: • Data Processing Addendum (DPA) 10 • Overview of local data protection laws (as ref erence) 11 • IBM Data Security and Privacy Principles 12 • DPA Exhibit 13 • Terms of Use – General Terms for Cloud Offerings 14 Some of these documents contain links to other documents that are relevant, such as the Transparency Report 15 which is linked to in the DP A Exhibit.

Some processing s take place by SoftLayer Technologies, Inc., which is fully owned by IBM. 5.2.2 Assessment of IBM as data processor IBM acts as a processor for the governmental organisation when processing Content Data that is provided by the organisa tion when using CP4BAaaS. With regard to Content Data, the government organisation decides what data to store and to process via the cloud services. The Content Data, which falls under the categories IBM calls Client Personal Data, is processed and stored exclusively in the EU and this storage is a service IBM offers as a processor. According to the DPA, a rticle 1.3, “ IBM will Process Client Personal Data according to Client’s documented instructions. The scope of Client’s instructions for the Processing of Client Personal Data is defined by the Agreement, and, if applicable, Client’s and its authorized users’ use and configuration of the features of the Service.

Client may provide further legally required instructions regarding the Processing o f Client Personal Data (Additional Instructions)”. The additional instructions are further explained in article 10.2 of the DPA, and refer to assistance by IBM to help the 10 Latest version available at: https://www.ibm.com/support/customer/csol/terms/?ref=Z126 - 7870 - 03 - 09 - 2021 - zz - en . 11 Available at: https://www.ibm.com/support/customer/csol/terms/?ref=DPA - DPL - 10 - 10 - 2021 - zz - en . 12 Available at: https://www.ibm.com/support/customer/csol/terms/?ref=Z126 - 7745 - 04 - 10 - 2020 - zz - en . 13 Available at: https://www.ibm.com/software/reports/compatibility/clarity - reports/report/html/softwareReqsForProdu ct?deliverableId=6207A810166F11E8873F3D2319B 8F34B . 14 Available at: https://www.ibm.com/support/customer/csol/terms/?ref=i126 - 5948 - 09 - 08 - 2020 - zz - en . 15 See: https://www.ibm.com/downloads/cas/DAGAKDJG .

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. governmental organisation in fulfilling legal obligations to comply with data protec tion laws, such as helping to comply with data subject access rights, helping in providing information and communication in case of a personal data breach or a data protection impact assessment, “ including prior consultation with the responsible Supervisor y Authority, if required, taking into account the nature of the processing and the information available to IBM. ” ( a rticle 10.1 DPA) Article 2 of the DPA contains the instruction by the governmental organi s ation to have IBM implement technical and organ isational measures (TOMs) to ensure a level of security appropriate to the risk for IBM’s scope of responsibility. The measures are further defined in the DPA Exhibit. The general TOMs are described in the IBM Data Security and Privacy Principles.

These include general aspects such as compliance with data protection laws, privacy by design, and confidentiality clauses. Article 5.3 of the DPA Exhibit defines Additional TO Ms: “The following additional TOMs are applicable to this Cloud Service: Data Security • Content is encrypted when transmitted by IBM on any public networks. • Content is encrypted when transmitted by IBM within the Cloud Service's private datacenter network. • Content is encrypted at rest within the IBM Cloud Datacenter. Business Continuity • The Cloud Service has Business Continuity plans in place to provide for the recovery of both the Cloud Service, and the associated Client Content, within hours in the event o f a corresponding disaster. Certifications This Cloud Service maintains the following industry recognized compliance, certifications, attestations, or reports as one measure of this Cloud Service's implementation of the TOMs: • ISO 27001 • ISO 27017 • ISO 27018 • ISO 27701 • CSA STAR Level 1 (Self - Assessment) • PCI - DSS for Payment Card Industry - as Service Provider” Audit rights Article 5 of the DPA contains the conditions under which IBM will contribute to the performance of an audit by the governmental organisation.

IBM will, upon request, handover the most recent certifications and/or summary audit reports. When further informa tion is requested by the governmental organisation, IBM will reasonably cooperate by providing additional information. When additional information is required for the governmental organisation to comply with its own audit obligations, or when requested by a supervisory authority, IBM will provide this extra information in writing. Only when an audit right cannot be satisfied according to the above, legally mandated entities, the governmental organization, or its mandated auditor may conduct an onsite visit at IBM. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 56 of 99 5.2.3 Assessment of IBM as data controller IBM is a data controller for the processing of business contact information in the course of business dealings. IBM is authorised in the General Terms for Cloud Offerings to process some information for its own legitimate business purposes.

These purposes and the personal data processed for these purposes are defined separately in the Data Processing Addendum. With regard to the purpose of IBM to compl y with laws or regulations, the governmental organisation imp lementing CP4BAaaS may only allow IBM to process personal data as independent data controller in the following circumstances: • IBM has verified the legitimacy of the legal order to disclose personal data from the governmental organisation to law enforcemen t authorities in or outside of the EEA . • The requested data are not protected by professional secrecy . • IBM is legally prohibited (with a gagging order) from redirecting the order to its Enterprise customer . IBM processes account usage information for purpos es of enabling, providing, managing, supporting, administer, and improving the services. For these processings IBM acts as a data controller. On the login and account activation pages, IBM includes a link to separate terms and conditions for users.

In thes e, IBM states that the use of this website creates a binding contract between the user and IBM. The IBM privacy policy applies during the use of at least these pages. 16 5.3 The roles of other parties 5.3.1 Akamai Akamai is a major content distribution network (CDN), based in the United States. Content distribution networks offer the centralised hosting of common resources such as frontend frameworks and fonts. This allows the resources to be shared and to be accessed quicker by the end - user. Akamai also provides host ing services that allow websites to be available from a server closer to their location, which makes the loading faster. Akamai also provides protection against DDOS attacks. Some CDNs have been known to use their access to the end user for the purpose of creating user profiles through tracking cookies. As far as could be determined, Akamai does not sell or even collect user profile information based on tracking cookies.

Because no documentation is currently available, t his umbrella DPIA could not determine whether Akamai processes any of the personal data for purposes such as threat analysis or machine learning for the purpose of load balancing, etc. Given that this umbrella DPIA has not shown that Akamai processes personal data for purposes other than thos e set by the government organisation, Akamai can be classified as a subprocessor for IBM. 16 URL: https://www.ibm.com/ie - en/legal (Irish version, hyperlinks removed, last visited 21 February 2022) and URL: https://www.ibm.com/privacy , last visited 21 February 2021 Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. 5.3.2 CloudFlare Cloudflare is a major connectivity and networking provider, based in the United States. It offers a range of products, including content delivery (CDN, see above), and security.

IBM uses CloudFlare for hosting and content delivery, and possibly for additional services . This cannot be determined with external tests, only with audits. These audits are not in scope of this umbrella DPIA. Like Akamai, CloudFlare does not sell or even collect user profile information based on tracking cookies, as far as could be determined. Because no documentation is currently available, t his umbrella DPIA could not determine whether CloudFlare processes a ny of the personal data for purposes such as threat analysis or machine learning for the purpose of load balancing, etc. Given that this umbrella DPIA has not shown that CloudFlare processes personal data for purposes other than those set by the government organisation, CloudFlare is classified as a subprocessor for IBM. 5.3.3 TrustArc TrustArc is a consent platform that manages user choices for cookies and that loads the cookies as configured.

The use of TrustArc and its configuration, is controlled by IBM. Bloc king the cookies of TrustArc does not result in losing any functionality of CP4BAaaS. There is no documentation provided about the data processing by TrustArc, therefore it is impossible to determine if TrustArc processes data for their own purposes or not . As a result it is impossible to determine if TrustArc is a processor or a joint - controller. 5.3.4 Ad networks This umbrella DPIA has shown that during the creation of a new account, a number of cookies get placed on the user’s computer. These are placed by adv ertising networks. These advertising networks process personal data in connection to the use of CP4BAaaS for commercial purposes of their own. The ad networks therefore must be considered to be data controllers, either independently or jointly with IBM and /or the government organisation implementing CP4BAaaS. 5.4 Assessment of joint controllership The use of tracking cookies is likely a joint responsibility of the government organisation deploying CP4BAaaS and IBM, with the ad networks that have access to the I BM websites.

They share responsibility, since the purpose that the user is using CP4BAaaS for is determined by the government organisation, whereas the purpose of the tracking cookies is determined by IBM or the ad networks themselves. 17 The governmental o rganisation has no clear benefit but does require (some of) its employee to create an account and therefore determines part of the purpose of the processing. At the very least, the governmental organisation is facilitating this processing by ad networks of personal data of government employees in the course of their activities for the governmental organisation. No documentation could be 17 The Court of Justice for the EU (CJEU) has confirmed this interpretation in several cases. In C - 25/17 Jehovah’s Witnesses, the CJEU stated that access to the processed data is not require d for controllership to arise. In C - 40/17 Fashion ID, it stated that joint controllership exists when one party permits the processing and both parties benefit.

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 58 of 99 provided by either the government al organisation, IBM, or the ad networks about their respective roles as joint controller s. 6. Interests in the Data Processing 6.1 Interests of Dutch governmental organisations Governmental organisations have reasons of efficiency to make use of CP4BAaaS for workflow management, document management, and business automation. By using the software it can automate workflows and processes and monitored their use in an efficient manner. Dutch governmental organisations also have an interest in being accountable , which requires that documentation is easily searchable and that business procedures are well r ecorded and tamper proof. 6.2 Interests of IBM IBM has a strong economic interest in increasing the revenues from cloud solutions and hybrid deployments. In its Annual Report 2020, IBM states: “At the beginning of 2020, less than 25 percent of mission - critical workloads had moved to the cloud.

As companies sought to equip their employees to work remotely during the pandemic, many sped up the pace of their technological changes. They’ve realized the sooner they can make the jump to cloud and cloud - enabled AI, th e better. This trend will continue until the 75 percent of workloads that were left behind migrate to hybrid cloud. IBM is doubling down on its investment in hybrid cloud and AI because we see it as the best way to help our customers on this journey. They want the speed, efficiency and innovation that comes with moving to the cloud, without having to reinvent their entire IT infrastructure. That’s what hybrid cloud is all about.” 18 IBM has a commercial and business interest to build and maintain the reputat ion that it guarantees a high level of data protection and IT security for its customers. 6.3 Interests of Akamai Akamai has a commercial and business interest to deliver services for content delivery and cloud security to IBM as its customer.

Since Akamai is not mentioned in the contracts of IBM, it is unclear what services exactly it provides for CP4BAaaS . 6.4 Interests of CloudFlare CloudFlare has a commercial and business interest to deliver services for infrastructure security and protection against DDoS and C DN attacks. Since CloudFlare is not mentioned in the contracts of IBM, it is unclear what services exactly it provides for CP4BAaaS . 6.5 Interests of advertisers and advertising networks The interest of advertisers and the advertising networks detected is to sell ads and to create detailed personal profiles of the users. Since each instance of CP4BAaaS will be hosted on a separate virtual server in the cloud, the advertising cookies will i nform 18 https://www.ibm.com/ annualreport/2020/path - to - growth.html , last accessed 2 December 2021. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. these parties of the fact that the user they see is working together with the other users using the same server – likely colleagues working at the same organisation.

They may be able to tell which organisation. 6.6 Interests of primary data subjects Empl oyees of the governmental organisation (primary data subjects) have an interest in their personal data being properly protected and legitimately processed. 6.7 Interests of secondary data subjects Other groups of data subjects, whose data are processed as Cont ent Data, have an interest in their personal data being processed accurately and securely. 7. Location of personal data processing Governmental organisations implementing CP4BAaaS have the option to host the software within the EU. In principle, this limits m ost of the processing to servers within EU jurisdiction. IBM does however leave room for some processings to take place outside of the EU or the European Economic Area (EEA). In the General Terms for Cloud Offerings it states: “IBM may use personnel and re sources in locations worldwide, including contractors to support the delivery of the IBM Cloud Services.

Client's use of the Cloud Services may result in the transfer of Content, including personal data, across country borders.” The website for account act ivation that has to be visited by every single user in order to activate their account is www.automationcloud.ibm.com , the identity platform of IBM. During testing, IBM confirmed that a fter activation, each login runs through this platform. This website is used for the initial authentication/authori s ation before requests are routed to the customer’s tenant. The website is the entry to the DBAoC SaaS and is hosted in Dalla s, US. IBM keeps a central database behind this website that is synchronized with the user accounts from the tenants to redirect the users to their own environment. Only after this analysis was done, IBM mentioned that the tenant can also use its own, opti onally self - hosted, system for Identity and Access management (IAM).

But even when using this IAM, f or account activation and for logging on to the tenant, IBM processes the account information in the US and keeps a full database of all users per tenant in the US. The provisioning of the tenant is done by IBM staff in Germany or US/Canada. Staff members could access Diagnostic Data and perform actions on these data (add, delete, modify, add/delete users, change roles or passwords, etc.) without any involvem ent from the government organisation’s staff . IBM staff members are not allowed to do this but some have these rights in case of emergency. IBM has assigned system access rights to staff members worldwide so that it can provide 24/7 support. IBM does not assign staff to a dedicated region (GEO) or country only. Access to the platform and the tenants is limited to DBAoC OPS staff members. Not all staff members have access to all layers or components. Access by OPS is password protected.

Nevertheless, for su pport purposes IBM may process Diagnostic Data or Content Data anywhere in the world. Table 5 - Locations per processing activity Processing activity Location Content Data storage EU Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 60 of 99 Provisioning Germany/US/Canada Support Worldwide Furthermore , this umbrella DPIA has demonstrated in paragraph 1.2 that commercial parties place and read tracking c ookies when logging in. IBM has indicated that one of those processings of personal data takes place in Ireland and that each of the other processings is done in multiple locations. All of these included the US. IBM does not take responsibility for any transfers to non - EEA countries and offers no Standard Contractual Clauses or other legal mechanisms to legitimise these. This implie s that the governmental organisation implementing CP4BAaaS will be responsible for providing a valid legal context for any transfers of personal data.

The GDPR contains special rules for the transfer of personal data to countries outside the EEA in article s 44 to 49. In principle, personal data may only be transferred to countries outside the EEA if the country has an adequate level of protection. That level can be determined in several ways through a Data Transfer Impact Assessment. Since the BD does not a ctively implement CP4BAaaS at the time of this umbrella DPIA, such a DTIA was also not required. 8. Techniques and Methods of the Data Processing 8.1 Big data As a global provider of cloud services, IBM potentially, if not in fact, processes the data of millions of people through CP4BAaaS. CP4BAaaS also offers services connected to IBM’s artificial intelligence system Watson. These services are not within the scope of this umbrella DPIA. For the purposes of this umbrella DPIA the processing cannot be considered to be a Big Data processing.

If a specific government organisation wishes to use data collected or processed in CP4BAaaS for Big Data processing, an additional DPIA will be required. 8.2 Automated decision making CP4BAaaS is potentially capable of automatically making diverse decisions but was not configured to do so for the purposes of this umbrella DPIA. Government organisations wishing to use CP4BAaaS for automated decision making should note that the required DPIA would need to examine these algorithms for ad ditional risks to the rights and freedoms of data subjects. 8.3 Profiling CP4BAaaS does not by default perform any profiling of the primary data subjects or of the secondary data subjects. It was not setup in a way that allows for profiling in the context of t his umbrella DPIA. If a government organisation wishes to use CP4BAaaS in this way, the risks associated with profiling would need to be part of the implementing DPIA. 9.

Additional Legal Obligations 9.1 E - Privacy Directive ( Telecommunications Act ) This section only describes the additional obligations arising from the current ePrivacy Directive and (possible) future ePrivacy Regulation. In view of the limited scope of Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. this umbrella DPIA , other legal obligations or frameworks (for example in the area of information security, such as BIO) are not included in this report. Certain rules from the current ePrivacy Directive apply to the storage of information on, and retrieval of that stored information from, browsers with pixels and cookies and similar technologies such as tracking pixels and unique identifiers sent through URL parameters. Article 5(3) of the ePrivacy Directive was transposed in Article 11 ( 7a ) of the Dutch Telecommunications Act. Consent is required prior to the retrieval or storage of information on the devices or browsers of end users, unless one of the legal exceptions applies.

Three exceptions are available: • When the use of local storage or retrieval is necessary for the technical transmission of the data, or • When the use of local s torage or retrieval is necessary to deliver a requested service, or • To get information about the quality and effectiveness of a requested service, as long as this has no significant impact on the privacy of the user. According to the ePrivacy Directive, i t is possible for organisations to read information from end user devices without asking for consent if the access to the information is strictly necessary to provide the information society service requested by the subscriber or user . 19 IBM provides infor mation on the different settings and accompanied types of cookies. The explanation per setting is linked to functionalities. IBM should give an explanation why these cookies would be strictly necessary. If IBM cannot satisfactorily explain this , the govern ment organisation has to assume consent is required.

Consent cannot be obtained silently, for instance by a failure to change a default setting. 20 The consent requirement for at minimum tracking cookies will likely continue to exist in the future ePrivacy Regulation. As it is not likely that EU Member States will soon find agreement and adopt the ePrivacy Regulation, IBM will have to comply with the current ePrivacy Directive rules for the foreseeable future. 19 As implemented in the Netherlands in the Telecommunications Act, Art. 11.7a, third paragraph, under b, first part of the sentence. 20 See Recital 32 of the GDPR: “Silence, pre - ticked boxes or inactivity should not therefore constitute consent.” Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 62 of 99 Figure 8 - Implementat ion path of the new ePrivacy Regulation IBM uses several cookies via the website that the users visit when activating their account.

When selecting the default option (full functionality) during the account creation phase, over seventy cookies by over th irty parties were detected during this umbrella DPIA (see Figure 2 and Figure 3 ) . Many of these cookies were placed before the data subject had consented to their placement. For strictly functional cookies, an exception on the consent requirement applies. However, IBM used the header ‘functional cookies’ for the medium level of cookie settings. This setting includes more than strictly functional cookies. The minimum level (only necessary or mandatory cookies) should in principle only include functional coo kies that are strictly necessary to deliver the service that is offered via this website, namely the account activation. The minimum level still includes several IBM domain cookies (IBM ) , Security Intelligence Blog (from IBM), a cookie for consent manageme nt (TrustArc), and two third - party trackers (Kaltura for video content players, and Tealium for Customer Data Collection). 10.

Retention Periods Retention periods for Content Data are defined in IBM’s Data Processing and Protection Datasheet. 21 Content Data that are stored in CP4BAaaS will be retained in the form of production data and in backups. IBM retains the data for ninety days after termination or expiration of the Cloud service. Backups are retained for seven days, so after termination a nd the retention period of ninety days, some data may still be available for up to seven days in backups. The government organisation can make a copy of its Content Data at any time prior to the termination or expiration of the Cloud Service via the use of self - service options available within the Cloud Service. Also, CP4BAaaS can be configured to automatically delete certain types of documents after a specified time. Furthermore, the 21 See: https://www.ibm.com/software/reports/compatibility/clarity - reports/report/html/softwareReqsForProduct?deliverableId=6207A810166F11E8873F3D2319B 8F34B , last accessed December 1st 2021.

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. government organisation may also request removal of Content at any time prior to termination or expiration of the Cloud Service. The retention terms for the audit logs are adjustable for the administrator. The application logs must be enabled and deleted manually by the system administrators. IBM did not provide any informati on on the retention terms of the server request logs. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 64 of 99 Part B. Lawfulness of the data processing 11. Legal Grounds To be permissible under the GDPR, processing of personal data must be based on one of the grounds mentioned in a rticle 6(1) GDPR. Essentially, for processing to be lawful, this article demands that the data controller bases the processing on the consent of the user, or on a legally defined necessity to process the personal data.

The grounds mentioned in a rticle 6(1) GDPR are as follows: “Processing shall be lawful only if and to the extent that at least one of the following applies: a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes. b) processing is necessary for the performanc e of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. c) processing is necessary for compliance with a legal obligation to which the controller is subject. d) processing is necessary in order to protect the vital interests of the data subject or of another natural person. e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controll er. f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protect ion of personal data, in particular where the data subject is a child.”

This umbrella DPIA will examine the processings found in part A for a legal purpose. Since the government organisation implementing CP4BAaaS will have a legal purpose that depends on t he context in which they operate, a complete DPIA will have to answer questions that relate to the legal ground, such as the way consent is documented, or the specific task in the public interest the organisation will be processing personal data in CP4BAaa S for. 11.1 Consent Article 6(1)(a) GDPR reads: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” . If a data subject has freely given consent for the processing, such consent can be used as the legal ground for the processing of the data. This does require that the data subject has freely given consent, after having been informed about the scope and potential risks associated with the processing.

It also requires that the data subject can choose to withdraw their consent, without consequence. After withdrawal of consent, the controller must cease all processings with the data collected or created during the period in which it had the consent. Government organisations cannot rely on consent for pr ocessing data of primary data subject, or of any other type of data subject, given the inherent dependencies in their relationship. If the user is required to use CP4BAaaS to perform their tasks, for Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. instance, they would not be able to withhold consent. Th e same is true of citizens whose data will be processed in order for them to obtain a subsidy, for instance. Any consent given therefore cannot be valid, except in very specific cases where the government organisation can demonstrate that the consent was f reely given.

Insofar as IBM processes personal data under as a data controller, IBM can also not rely on the consent of the user since the user will not be in a position to freely give such consent. The only place where consent is actually asked within CP4 BAaaS is in the acceptance forms for cookies. Here, consent is asked by IBM for the acceptance of one of several levels of cookies, placed by itself as well as by ad networks. For functional and strictly necessary cookies, such consent is not required unde r the ePrivacy Directive. For the placement of any other type of cookie, the ePrivacy Directive demands the consent of the user, unless one of the available exceptions applies . S ince the primary data subjects are employees of the governmental organisation, they are not in a position to freely consent to the placement of tracking cookies. The conditions for free and informed consent, as described in art 7 GDPR cannot be met under these circumstances .

Therefore, no cookies may be placed lawfully while using C P4BAaaS, that are not strictly necessary for the functioning of the system. Consent cannot be a valid legal ground for either the government organisation or IBM. Ad networks and other commercial affiliates of IBM are also unable to lawfully obtain consent for the processing of personal data under these conditions. 11.2 Processing is necessary for the performance of a contract Article 6(1)(b) GDPR reads: “processing is necessary for the performance of a contract to which the data subject is party or in order to t ake steps at the request of the data subject prior to entering into a contract.” While it is true that the primary data subjects (government employees) entered into an employment contract with the government organisation, this contract is unlikely to quali fy as a valid legal ground for processings in CP4BAaaS. The only processings that may be covered under the legal basis of performance of contract are those that are directly related to and necessary for the performance of that contract.

The administration of employee contracts could qualify, whereas the collection of Diagnostic Data by a system that is used as a professional tool is not. The government organisation therefore cannot rely on the legal basis of performance of a contract with the data subject w hen processing data in CP4BAaaS. Secondary data subjects will be very unlikely to have a personal contract with the government organisation. Therefore, this legal basis is also not valid for the processing of data of secondary data subjects. The login pag e to CP4BAaaS contains links to IBM’s privacy policy and IBM’s terms for use for end users. The latter of these documents states that by using the website, the user is entering into a binding contract with IBM: “ The following are the terms of an agreement between you and IBM. By accessing, or using this Web site, you acknowledge that you have read, understand, and agree to be bound by these terms and to comply with all applicable laws and regulations, including ex port and re - export control laws and Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 66 of 99 regulations.

If you do not agree to these terms, please do not use this Web site. ” 22 Since the primary data subjects are required to use CP4BAaaS as part of their professional tasks, they cannot avoid entering into this personal contract with IBM. It appears from the text that this contract only covers the login page, and not the use of CP4BAaaS after logging in, but this is not completely clear from the text. It is likewise unclear whether a contract that is created in t his way is in fact legally binding under Dutch law. IBM indicated 23 that they were not aware of this contract and the terms of use as shown on the login page. IBM also reserves the right to change the terms of the contract without notifying the user specif ically. The purpose of the contract is to allow the user to access the information on the website, while IBM protects its intellectual rights: “IBM grants you a non - exclusive, non - transferable, limited permission to access and display the Web pages within this site as a customer or potential customer of IBM provided you comply with these Terms of Use, and all copyright, trademark, and other proprietary notices remain intact.” 24 In the Privacy Statement, linked on the same login page, IBM states that it may process the user’s personal data for several purposes under the legal basis of performing a contract with the data subject.

"We rely on this legal basis when we need to process certain personal information, such as your contact details, payment details, and shipment details, to perform our obligations or to manage our contractual relationship with you.” The examples IBM provides are: “ - If you intend to purchase a product or ser vice, we require your business contact information to enter into a contract with you or you may need to create an IBMid (see Your Account ) to access a purchased product online . - When fulfilling a contact, you may need to receive support services , for which we will need to collect your contact information. - We need personal information to consider job applicants or manage the pension entitlements of retirees (see Recruitment and Fo rmer Employees ). ” 25 IBM clearly considers this list non - limitative. The phrasing suggests that IBM can add to these purposes at any time, without amending the privacy statement.

The list of purposes also does not seem directly tied to the contract that is created in the Terms of Use. Privacy Company considers the creation of this implicit IBM - data subject contract unnecessary for the purposes of the government organisation, whether the contract is legally valid or not. IBM cannot use this contract as a valid basis for the proc essing of personal data of primary data subjects, because the contract does not in fact require any data processing on the part of IBM, except providing the login page functionality. This login functionality should be part of the contract the government or ganisation has with IBM. Privacy Company strongly suggests that government 22 URL: https://www.ibm.com/ie - en/legal (Irish version, hyperlinks removed, last visited 21 February 2022) 23 During a meeting on 12 April 20 22. 24 Ibid. 25 URL: https://www.ibm.com/privacy , last visited 21 February 2022) Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. organisations may wish to object to the presence of the IBM Terms of Service as they apply to their employees.

Other commercial parties involved in the processings through CP4BAaaS, including the ad networks, have no valid direct contract with each data subject of any type. Therefore, t his legal basis is not valid for any of their processings in CP4BAaaS. 11.3 Processing is necessary to comply with a legal obligation Article 6(1)(c) GDPR reads: “processing is necessary for compliance with a legal obligation to which the controller is subject” There is no legal obligation to use cloud services such as CP4BAaaS or to process Diagnostic Data via these services. Therefore, this legal ground ca nnot be valid. 11.4 Processing is necessary for a task in the public interest or for the legitimate interests of the controller or a third party Article 6(1)(e) GDPR reads: “processing is necessary for the performance of a task carried out in the public interes t or in the exercise of official authority vested in the controller” .

Article 6(1)(f) GDPR reads as follows: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests ar e overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” Governments and public organisations are excluded from relying on legitimate i nterest when processing personal data for purposes of public service, for which they can instead rely on tasks in the public interest. The last sentence of a rticle 6(1) of the GDPR adds: “ Point (f) of the first subparagraph shall not apply to processing ca rried out by public authorities in the performance of their tasks. ” This excludes the application of the legitimate interest ground for processing carried out by public authorities in the performance of their tasks.

However, the choice to use a specific pr oductivity solution is secondary to the performance of public tasks by public authorities and can therefore also be considered as a task primarily exercised under private law , for which the legitimate interest of the organisation can be a valid legal groun d for processing. As explained in Recital 47 of the GDPR, the legal ground of necessity for the legitimate interest ( a rticle 6(1)(f)) is more likely to exist where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. Both legal grounds require an assessment of the necessity of the personal data processing, of the proportionality and availability of alternative, les s infringing means to achieve the same legitimate purposes (subsidiarity). The legal ground of legitimate interest also requires that the controller assesses whether its interests are not overridden by the interests, rights and freedoms of the data subject .

Dutch government organisations may process a limited set of relatively harmless Diagnostic Data of primary data subjects on the basis of the necessity for their legitimate interest. This includes processing of Diagnostic Data by IBM as a data Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 68 of 99 processor t o determine what security updates to serve, and to provide a well - functioning product by troubleshooting and technical error fixing. This legal ground may also be relied upon for the (limited) use of some Diagnostic Data for analytics, as long as the right s and freedoms of the users and other data subjects do not prevail over this interest. Each government organisation implementing CP4BAaaS must independently assess whether their legitimate interests in fact are not overridden by the interests, rights and f reedoms of the data subjects in a Legitimate Interest Assessment.

Such an assessment would have to weigh whether the data subject can expect the processings to take place, and whether sufficient safeguards are in place to prevent the data from being used t o harm the interests of the data subject. IBM may also claim a legitimate interest in processing Diagnostic Data for its own purposes. This interest would also need to be weighed against the interests, rights and freedoms of the data subjects. Since the da ta subject is unlikely to be informed about such processings by IBM as a data controller, this umbrella DPIA finds that it is likely that IBM’s legitimate interests would be overridden by the interests, rights and freedoms of the data subjects, and would t herefore not be legitimate. Only in specific cases can IBM find a valid legal ground for the processing of Diagnostic Data, when it is strictly necessary to do so in order to fulfil the contract with the government organisation.

As was described in paragra ph 4.2 , IBM lists a number of specific purposes in the General Terms for Cloud Offerings for which it processes personal data: “IBM, its affiliates, and contractors of either require use of business contact information and certain account usage information. This information is not Content. Business contact information is used to communicate and manage business dealings with the Client. Examples of business contact information include name, business telephone, address, email, and user ID. Account usage information is required to enable, provide, manage, support, administer, and improve Cloud Services. Examples of account usage information include digital information gathered using tracking technologies, such as cookies and web beacons during use of the IBM Cloud Services.” For these processings of personal data IBM, as a controller, can only rely on its legitimate interests.

Most of these processings will be with its direct business contacts, which is not part of this umbrella DPIA. However, the pro cessing of “account usage information”, which means Diagnostic Data of primary data subjects, for the purposes of enabling, providing, managing, supporting, administering, and improving the Cloud Services does fall within the scope of this umbrella DPIA . I n the Privacy Policy that IBM makes available to the users through the login page, IBM states that it processes personal data of primary data subjects on the basis of its, or a third party’s legitimate interest “Legitimate interests relate to being able to conduct and organize business, which includes the marketing of our offerings, protecting our legal interests, securing our IT environment, or meeting client requirements. ” 26 IBM includes a non - limitative list of examples of how it processes personal data for legitimate interest: “ - We capture your use of, and interaction with our websites to improve them. - We process your IBMid (see Your Account) to manage access authorization of our services. 26 URL: https://www.ibm.com/privacy , last visited 21 February 2021 Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. - Where we have a contractual relationship with the organization that you are working for, we have a legitimate interest to process your personal information used to manage this contract. - We process your business contact information (see Your Account) in combination with other business - relevant information to tailor our interactions with you and promote our products and services.

We may process your contact information together with details of an IBM event you attended to develop Marketing and business intelligence. - We process the personal information of app licants based on our legitimate interest to source suitable talent (see Recruitment and Former Employees). - We have to keep our general business operations functional. To this end we may, for example, processes the login information of our IT systems and networks, or CCTV footage at IBM locations for security and safety purposes.” 27 While it is reasonable that IBM must process some Diagnostic Data for the purposes included in the General Terms for Cloud Offerings this umbrella DPIA , which each government o rganisation implementing CP4BAaaS must authorise, for its legitimate business purposes, the list above is too wide. The primary data subjects will not expect that IBM analyses the way they use their required business tools for marketing purposes, or busine ss intelligence development.

The legitimate interest assessment must fail in these situations at any time where IBM goes beyond what is strictly necessary for the execution of its contract with the government organisation. Other parties that process data t hrough CP4BAaaS, such as the ad networks, are even further removed from the data subject. They cannot claim a valid legitimate interest for the processing of cookies or Diagnostic Data, since their interests are clearly overridden by the interests, rights and freedoms of the data subjects. 11.5 Valid legal grounds Government organisations implementing CP4BAaaS can in almost all situations only rely on their legitimate interest for the processing of Diagnostic Data about primary data subjects. All other possible legal grounds are invalid for various reasons. Each government organisation must independently assess their legitimate interest against the interests, rights and freedoms of the primary data subjects.

The legal ground for the processing of Content Data wil l depend on the context in which the processing will take place. It is likely to be part of a legal obligation to process certain data, or of a task in the public interest assigned to the organisation. This umbrella DPIA cannot assess the validity of these legal grounds. IBM does not have a valid legal ground for processing any Diagnostic Data for its own purposes, except a limited number of situations that are authorized in the General Terms for Cloud Offerings. The creation of a legally binding contract b etween IBM and each individual primary data subject does not provide IBM with a valid legal ground for processing the data of these primary data subjects. For the processing of Diagnostic Data for marketing , product improvement, and business intelligence p urposes of IBM, no valid legal ground is available. 27 Ibid. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 70 of 99 For the additional processing following the data subject access request no valid ground is available either.

By searching for more information about the individual in public sources, IBM processed more in formation than was necessary about the data subject, without a clear legal basis, and without informing the data subject in advance of the processing, in violation with articles 5, 6 and 13 of the GPDR. The additionally collected background information on the requesting individual was not processed with the consent of the data subject, nor does IBM have a legitimate interest in collecting this information. The categories and types of data that are processed in this way can be very diverse, depending on what information is available online about a specific individual. 12. Special categories of personal data In the course of this umbrella DPIA , no processing of special categories of personal data was found in the Diagnostic Data. A government organisation can proc ess special categories of data as part of Content Data (documents) that are stored or otherwise processed with the use of CP4BAaaS.

The Diagnostic Data processed by IBM do not contain contents of these documents. The tests show that a n exception might occu r if the name of a file contains special categories of data and when such a filename appears in a log file. 13. Purpose limitation Article 5(1) (b) of the GDPR obliges data controllers to comply with the principle of purpose limitation. Data may only be “colle cted for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes.” Essentially, the above means that the controller must have a specified purpose for which he collects personal data and can only process thes e data for purposes compatible with that original purpose, unless the controller can meet additional requirements, that must be met before any further processing can take place. 13.1 Purposes of government organisations as controller Government organisations ca n make use of CP4BAaaS to set up their workflow management.

In order facilitate access to the IBM services, an accounts has to be created for each employee. With the accounts and access rights management, employees can fulfil the tasks they have to perform as part of their job. The processing of personal data of employees for creating and managing accounts as well as proper protection of the accounts and Content Data processed with CP4BAaaS are compatible with the original legitimate purposes of the govern ment organisation. No further processing of the data is taking place by the government organisation. IBM processes the personal data of government employees to create and maintain accounts and to provide secure access to the applications of CP4BAaaS. The processing of personal data for general security purposes are in line with the purposes of the government organisation. T herefore, these data are processed by IBM as a processor for the government organisation as a controller .

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. 13.2 Purposes for which IBM proces ses personal data as a controller The processing of IBM of Diagnostic Data for purposes beyond the direct performance of the contract with the government organisation lacks a valid justification on the basis of the purposes of the government organisation i n some situations . This is the case for instance with the use of Diagnostic Data to improve the service, or for marketing purposes, as IBM states it does in the General Terms for Cloud Offerings and the Privacy Statement . These purposes are not in line wit h the purposes of the governmental organisation, so IBM acts as a controller in these cases. 14. Necessity and proportionality Article 5(1)c GDPR requires that every processing must be limited to what is necessary to achieve the set purpose. It is therefore important to examine whether every processing is in fact necessary for the purposes for which the data controllers process personal data.

The concept of necessity is made up of two related concepts, namely proportionality and subsidiarity. The pe rsonal data which are processed must be necessary for the purpose pursued by the processing activity. First, it has to be assessed whether the same purpose can reasonably be achieved with other, less invasive means. If so, these alternatives have to be use d. Second, proportionality demands a balancing act between the interests of the data subject and the data controller. Proportionate data processing means that the amount of data processed is not excessive in relation to the purpose of the processing. If th e purpose can be achieved by processing fewer personal data, then the amount of personal data processed should be decreased to what is necessary. Therefore, essentially, the data controller may process personal data insofar as is necessary to achieve the p urpose but may not process personal data he or she may do without.

The application of the principle of proportionality is thus closely related to the principles of data protection from a rticle 5 GDPR. 14.1 Assessment of the proportionality The key questions that determine the proportionality of a processing are: are the interests properly balanced? And: does the processing not go further than what is necessary? To assess whether the processing is proportionate to the interest pursued by the data controller(s), the processing must first meet the principles of a rticle 5 of the GDPR. As legal conditions they must be complied with in order to make the data protection legitimate. Data must be ‘ processed lawfully, fairly and in a transparent manner in relation to the data subject ’ ( a rticle 5(1) (a) GDPR). This means that data subjects must be informed about the processing of their data, that all the legal conditions for data processing are met, and that the principle of proportionality is respected.

The Diagnostic Data processed by IBM are limited to what is necessary for purposes of providing and securing the services. The Diagnostic Data do not contain Content Data as such. Only in the event that a document name contains personal data, the data ma y be processed as part of the Diagnostic Data. IBM acts as a processor for the processing of the audit logs and the administrator from the government Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 72 of 99 organisation can adjust the settings for what data is to be included in the audit logs. These audit logs a re turned off by default. With regard to transparency, the documentation available and presented to the data subjects does not contain a clear and complete overview of the Diagnostic Data that is processed. So, IBM has to provide such information in more detail. The use of a tracking pixel in the email confirming the reception of a data subject request by IBM is disproportional.

There is no clear purpose for IBM that would require the inclusion of this tracking pixel. The use of tracking pixels in emails requires the use of the user’s computer, which means that the rules of the Telecommunications Act article 11.7a apply to these tracking pixels: consent is required, unless an exception applies. However, the consent could not be validly obtained as part of the process of a data subject request, since the employees are required to use the platform.This umbrella DPIA therefore finds that the tracking pixel is unnecessary and disproportional to the undisclosed purpose for which it is placed. 14.2 Assessment of the s ubsidiarity The key question is whether the same goals can be reached with less intrusive means. The processing of D iagnostic D ata by IBM in the course of providing services related to CP4BAaaS is limited to the necessary data. The D iagnostic D ata do in principle not contain personal data.

Only in case that a filename does contain personal data, this may be processed as part of th e D iagnostic D ata. The processing outside of the EU of the account information for every login to the tenant is however quite intrusive. This, together with the processing of data by several third parties via this login platform, makes the IBM services m ore intrusive than some of its competitors. There are several large - scale cloud providers that deliver similar types of services. However, all of them imply certain data processing activities and there are no reasonable alternatives for government organisa tions than those large - scale providers when offering integrated and scalable workflow management solutions to their employees. Processings that take place under a direct though implicit (because it is assumed that a contract is closed when the data subjec t uses the platform) contract between the primary data subject and IBM do not comply with the principle of subsidiarity: a less invasive procedure is clearly possible, where the primary data subject does not enter into a contract with IBM, and the controll ership for authentication remains with the government organisation. 15.

Rights of data subjects The GDPR grants data subjects a number of privacy rights. 15.1 Right to information First of all, data subjects have a right to information. This means that data control lers must provide people with easily accessible, comprehensible, and concise information in clear language about, inter alia, their identity as data controller, the purposes of the data processing, the intended duration of the storage and the rights of dat a subjects. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. The information provided about the processing of Diagnostic Data is incomplete. Moreover, IBM facilitates third parties to process personal data and makes use of subprocessors that are not included in the contractual framework. The right to inf ormation is not completely honoured. 15.2 Right to access Secondly, data subjects have a right to access personal data concerning them.

Upon request, data controllers must inform data subjects whether they are processing personal data about them. If this is the case, data subjects should be provided with a copy of the personal data processed, together with information about the purposes of processing, recipients to whom data have been transmitted, the period for which personal data are to be stored, and infor mation on their further rights as data subjects, such as filing a complaint with the Data Protection Authority. IBM offers a formal procedure for data subject access requests. IBM did provide an overview of the data processed on the test accounts in this u mbrella DPIA. After passing the deadline for responding, the information provided was not yet complete. Additional information was provided later on. IBM indicated that there was some unclarity internally due to the way the request for information in gener al was sent next to the formal route.

Ultimately, IBM responded well to the request as far as it concerns the environment dpia.automationcloud.ibm.com. No information was provided on the logs of the database that is keeping all user accounts for the login functionality. And no logs were provided on the domains www.automationcloud.ibm.com (the login page itself), ibm.com for IBM content delivery and subprocessors and ad netwo rks. The response to the data subject access request was thus incomplete for the logs that are generated outside of the specific test domain, but that are definitely directly related to this domain when it concerns the processing of personal data of the in dividual users. 15.3 Right of rectification and erasure Thirdly, data subjects have the right to have inaccurate or outdated information corrected, incomplete information completed and - under certain circumstances - personal information deleted or the processi ng of personal data restricted.

All of the content data can be rectified or erased by the system administrator of the government organisation as a data controller. If data is deleted from the contents in CP4BAaaS, the data is really deleted and is no longe r retained by IBM either. So, these rights can be fulfilled by the government organisation itself. 15.4 Right to object to profiling Fourthly, data subjects have the right to object to an exclusively automated decision if it has legal effects. In the course of using CP4BAaaS there is no profiling or automated decision - making taking place, so this rights is not applicable. Please note: the applications built upon CP4BAaaS may be setup to perform automatic decision making. 15.5 Right to data portability Employees also have a right to data portability, if their personal data are processed based on the necessity to execute the (labour)contract. This legal ground only applies to the processing of certain content.

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 74 of 99 Employees are allowed to take their personal data with them , provided that this does not cause a privacy breach with respect to other persons. Such a data transfer may also violate the confidentiality of (government) activities. In that case, the organisations can invoke the exception in article 23 (1) under i of the GDPR. The individual right to data portability is independent of the possibility that the government organisations themselves must have to move their processing and files collectively to another provider. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Part C. Discussion and Assessment of the Ris ks This part concerns the description and assessment of the risks for data subjects. This part starts with an overall identification of the risks to the rights and freedoms of data subjects as a result of the processing of metadata and content in the Diagn ostic Data.

The risks will subsequently be classified according to the likelihood they might occur, and the impact on the rights and freedoms of the data subjects when they do. 16. Risks Risks to the rights and freedoms of the data subject occur when processin gs of personal data violate a right given to the data subject in the GDPR or in other legislation. High risks usually occur when a processing violates a legal protection of one of the fundamental rights as described in the European Charter of Fundamental R ights, but violations of other rights given by Union or Member State law may also constitute a risk to the rights and freedoms of the data subjects. In this chapter, this umbrella DPIA will list all risks identified during the use of CP4BAaaS. Each risk wi ll be assessed based on the potential impact it has on the rights and freedoms of the data subjects, and on the likelihood the risk will in fact occur.

Some risks will automatically occur to some or all data subjects, others will have a high, medium or low likelihood of occurring. The severity of the risk and the likelihood are assessed based on the factual description in part A and B of this DPIA. 16.1 Assessment of risks Risk 1: Loss of control and unnecessary processing: users must activate IBM account and enter int o contract with IBM The authentication mechanism requires users to activate their account on a separate server with IBM, where they implicitly enter into a contract with IBM for the delivery of the ‘website’. IBM terms of use and the IBM privacy policy app ly to these processings. Primary data subjects are required to use CP4BAaaS and therefore to enter into a personal contract with IBM, or they are unable to perform their tasks as an employeer. The government organisation using CP4BAaaS is unable to verify if IBM handles data collected during the activation process, or during the use of CP4BAaaS after this fact as a controller.

IBM reserves the right to change the terms of the contract at any time, without specifically notifying the data subject. Since there is no need from the perspective of the government organisation to externalise the account authentication procedure, this also constitutes unnecessary processing, that is disproportional to the purpose of the government organisation and that does not conf orm to the principle of subsidiarity, since the alternative is straightforward: the full control of the authentication of users must lay with the government organisation and the necessary processings would remain under the exclusive control of the governme nt organisation. Unless IBM facilitates a path to keep the authentication and account creation processes as part of the CP4BAaaS instance of the government organisation, this issue will persist. The potential impact of this risk is high, since IBM will be able to engage the subject into contractual obligations that are not controllable by their employer, who requires them to use CP4BAaaS.

The data subjects do not have a free choice to enter or refuse the implicit contract. The likelihood that this risk wil l occur is 100%. Therefore, this is a high risk to the rights and freedoms of the primary data subjects. Risk 2: Violation of the principle of data protection by default The pop - up window that IBM presents on the login or account activation page for browsers that do not have any cookies present, asks for permission to set cookies. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 76 of 99 The option that is activated by default is not the option that is most protective of the righ ts and freedoms of the users. Instead, the most permissive option is preselected, and users must click through to a secondary page if they wish to choose a setting that is less invasive than the default ‘Personalization Cookies’ option. Selecting the most privacy friendly option by default is required in article 35(2) GDPR, that states that “The controller shall implement appropriate technical and organisational measures for ensuring that, by default , only personal data which are necessary for each specific purpose of the processing are processed” (emphasis added).

The default setting violates one of the principles of the GDPR and therefore violates the rights and freedoms of the data subjects. The potential impact of this risk is high, since IBM is seeking consent for the placement of tracking cookies, and for processings for its own purposes. The likelihood that this risk will occur is 100%. Therefore, this is a high risk to the rights and freedoms of the primary data subjects. Risk 3: Lack of transparency: list of cookies is incomplete IBM informs the user in the cookie policy on the website about the cookies it may place on the user’s computer. This list is not complete. In fact, even when choosing the ‘Required Cookies’ setting, with minimal options activated, IBM or its affiliates place several cookies that are not mentioned in the cookie policy. This is a violation of the right of the data subject to be informed of processings before they take place (article 12 - 13 GDPR), as well as of the ePrivacy D irective, which states that non - functional cookies must be placed with consent, unless an exception applies.

The potential impact of this risk is high, as IBM and its affiliates violate one of the core principles of the GDPR: the right to be informed of pr ocessings before they occur. The likelihood that this risk will occur is 100%. Therefore, this is a high risk to the rights and freedoms of the primary data subjects. This umbrella DPIA finds that some of the cookies IBM fails to disclose are unnecessary f or other reasons and therefore already in violation with the GDPR. The placement of these cookies will not become lawful by disclosing their placement in the cookie policy. Risk 4: Unnecessary cookies get placed before consent is given On the authentication page, IBM places some cookies without waiting for the user to express consent. Some of these are necessary cookies for which no consent is required, but other cookies get placed by third parties such as Adobe, that clearly require consent.

By placing these cooki es without giving the user the chance to withhold consent, IBM violates article 11(7a) of the Telecommunications Act and article 6 of the GDPR. The potential impact of this risk is high, as IBM shares personal data and access to the data subject’s computer with unauthorised third parties for commercial tracking purposes, without consent of the user. The likelihood that this risk will occur is high. Therefore, this is a high risk to the rights and freedoms of the primary data subjects. Risk 5: Loss of control: proc essings by undisclosed sub processors This umbrella DPIA has found several undisclosed processors in use by IBM. IBM is required to report the use of subprocessors to the controller under the terms of article 28(2) GPDR. This is not in itself a violation of the rights and freedoms of the data Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. subjects.

Nonetheless, the failure to disclose this information means that the government organisation is unable to fully inform the data subjects of their rights and creates a loss of control that leads to an infringem ent of the rights and freedoms of the data subjects. This situation also means that IBM de facto operates as a controller or joint controller for those processings. The potential impact of this risk is high, as the government organisation cannot guarantee a lawful processing and the data subject is not informed about the processing and cannot exercise their rights. The likelihood that this risk will occur is 100%. Therefore, this is a high risk to the rights and freedoms of the data subjects. Risk 6: Loss of contro l : Undocumented joint controllership with third parties IBM employs the use of tracking of user’s use of CP4BAaaS through ad networks and other third parties. These parties can use the data they collect through the tracking cookies for their own purposes: the creation of detailed user profiles that they can use for targeted advertising.

Potentially, these data can also be sold or used for other purposes, including providing access for surveillance by non - EU intelligence services. New trends, however, also show how intelligence agencies sometimes buy datasets from commercial entities. 28 The data may also be transferred out of the EU without the government organisation’s involvement. This means that some of the processings these third parties undertake likel y take place under the undocumented de facto joint controllership between the government organisation, IBM and the third parties. The fact that the documentation that is required under article 26 GDPR is missing, means that the government organisation is u nable to control the processing of personal data of data subjects. These data subjects also are uninformed of the joint controllership. This is a direct infringement of their rights under the GDPR. It also implies that the data subjects are unable to exerc ise their rights under articles 15 - 21 GDPR.

The potential impact of this risk is high, as the government organisation cannot guarantee a lawful processing and the data subject is not informed about the processing and cannot exercise their rights. Necessary documentation is missing and the qualificat ion of IBM as processor is incorrect. The likelihood that this risk will occur is 100%. Therefore, this is a high risk to the rights and freedoms of the primary data subjects. Risk 7: Unlawful transfer of data to the USA This umbrella DPIA has identified several i nstances where the IP address and sometimes additional data apparently get transfer r ed to servers in the USA. IBM’s authentication servers are located in the USA, transferring the IP - addresses and e - mail addresses of the users to the USA. This also concer ns cookies and IP addresses, to the used content distribution networks Akamai and Cloudflare , and to Google Fonts .

These data are not pseudonymized or anonymised. The structural transfer of the IP address and other personal data to the USA is not banned bu t does require specific technical and organisational measures before they can be considered lawful. In particular, a transfer mechanism is required, since the United States is not considered a country which adequately protects personal data to a degree tha t is in essence equivalent to th e protection offered by the GDPR. Either Standard Contractual Clauses or Binding Corporate Rules are required for the transfer, but as the European Court of Justice has emphasised in its Schrems - II ruling in July 2020, the e ffectiveness of 28 See: https://www.ctivd.nl/binaries/ctivd/documenten/rapporten/2022/02/08/rapport - 74/CTIVD+NR74+Toezichtsrapport.pdf . Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 78 of 99 the additional safeguards must be demonstrated.

This requires a data transfer impact assessment to be created by the controller, to assess whether the specific risk level associated with the actual personal data that will be transferred is not too high to allow for this transfer, given the measures that were taken to mitigate those risks. Such a data transfer impact assessment has not been provided by the Belastingdienstor by IBM and its affiliates. Therefore, the transfers must be consider ed unsafe and infringing on the rights and freedoms of the data subjects, even if the personal data that will be transferred are not particularly sensitive. A recent ruling 29 by the Austrian Data Protection Authority shows that even limited data transfers, such as those for the use of Google Analytics, cannot take place because of existing surveillance laws in the USA that require the recipient of those data to co - operate with intelligence agencies.

The potential impact of this risk is high, since the gover nment organisation is unable to prevent any data transfers to the USA and is unable to guarantee that the personal data will not be used for surveillance. This umbrella DPIA has not found sufficient safeguards, such as the pseudonymisation of IP addresses, that would mitigate the risks associated with these data transfers. The likelihood of this risk is 100%. Therefore, this is a high risk to the rights and freedoms of the primary data subjects. Risk 8: Unlawful processing of special categories of personal data in filenames This umbrella DPIA found that in some cases, file names can appear in the Diagnostic Data. This implies that it is possible that if a user chooses a file name that contains special categories of personal data, this information can also become pa rt of the Diagnostic Data and get processed for purposes for which the exceptions to the prohibition of the processing of these sensitive data do not apply.

Such processings would be unlawful. The scenarios in which something like this may occur are not im mediately clear, but this umbrella DPIA could not rule out the possibility. Special categories of personal data of secondary data subjects can in some cases end up in the filename of a document processed in CP4BAaaS. The potential impact of this risk is hi gh, since it would involve special categories of personal data in processings for which they are not necessary. The likelihood that this risk occurs is low. Therefore, this is a low risk to the rights and freedoms of the secondary data subjects. Risk 9: Incompatib le further processings for marketing, product improvement, and business intelligence IBM states in several documents, including in the General Terms for Cloud Offerings that it will process some data for its legitimate business purposes. Some of these are indeed legitimate and necessary for the performance of the contract with the government organisation.

However, the listed purposes of marketing, product improvement, and business intelligence go beyond what is necessary from the perspective of the governme nt organisation. The processing of these data is incompatible with the purpose for which the government organisation is collecting the data: the creation and management of workflows and connected purposes. The marketing of IBM is not connected to these pro cessings and in chapter 13 this umbrella DPIA has found these processings not legitimate for this reason. Moreover, 29 https://noyb.eu/sites/default/files/2022 - 01/E - DSB%20 - %20Google%20Analytics_DE_bk_0.pdf . Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. IBM states that it can unilaterally amend the general terms as well, which includes the option to add or change purposes. Since these purpos es are not legitimate, the continued use of the personal data by IBM for these purposes is a direct infringement of the rights and freedoms of the data subjects.

The potential impact of this risk is medium, since the Diagnostic Data IBM processes is relati vely harmless while at the same time, the use of these data qualifies as unlawful. The likelihood that this risk will occur is high. Therefore, this is a high risk for the rights and freedoms of the primary data subjects. Risk 10: IBM support staff worldwide can ac cess Content Data and Diagnostic Data IBM’s support staff can help solve issues in CP4BAaaS. The support staff is distributed across the globe, allowing IBM to offer support around the clock. This umbrella DPIA has shown that IBM allows the support staff to access the Content Data and Diagnostic Data processed by the government organisation and to view the data and modify or delete the data. This access from outside the EU and European Economic Area constitutes a data transfer, for which a data trans fer mechanism must be in place, if the European Commission has not issued an adequacy decision for that country.

This processing of personal data outside of the EU/EEA can therefore only be lawful if IBM has setup adequate safeguards with respect to the da ta transfer. IBM has not disclosed an assessment that shows that the specific technical and organisational measures taken satisfy the requirements of articles 45 - 49 of the GDPR. The potential impact of this risk is high, since the primary and secondary dat a subjects’ data may be transferred to areas where adequate protections do not exist. This may include sensitive data, including special categories of personal data about secondary data subjects. The likelihood that this risk occurs is medium, since only i n some cases will the data be accessed by support staff outside the EU/EEA. Therefore, this is a high risk to the rights and freedoms of the primary and secondary data subjects. Risk 11: Insufficient technical measures: Default settings allow for unencrypted email While CP4BAaaS offers the option to setup encryption of sent emails, this option is not enabled by default.

This does not violate the principle of data protection by default, as described in article 25(2) GDPR, since that principle is about offering data subjects the choice between more of less invasive processings. At the same time, the lack of encryption does mean that the government organisation and IBM may violate the principles of article 32 GDPR that states that the controller and the processor shall implement technical and organisational measures to ensure a level of security appropriate to the risk. The encryption of emails during transmission clearly has been a ‘best practice’ in IT security for a long time and is easy to implement – even if there are some challenges if the receiving server, that is under the control of some outside party, is not correctly configured to receive such emails. This has become very rare. The government organisation that accepts the lack of encryption would thereby creat e risks, including the possibility that important mails about sensitive issues may get intercepted by servers handling the transmission and may be read by any outside party.

The potential impact for this risk is high, since it is likely that in some cases special categories of personal data may be included in emails that have not been fully secured. The chance that this risk occurs is high if the government organisation does Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 80 of 99 not enable the option to encrypt. Therefore, this is a high risk to the rights and freedoms of the data subjects. Risk 12: IBM researches the background of data subjects who exercise their rights During this umbrella DPIA, a request was filed with IBM for all personal data generated or processed by the researchers. Under normal circumstances, suc h a request would have been handled by trained staff, but given that it concerned this specific umbrella DPIA, technical staff of IBM handled the request. As was described in paragraph 1.8 , one IBM staff member performed a background check on the researche r. This was revealed, when an email containing this information was accidentally forwarded to the researchers.

This background check is unnecessary and unlawful and violates the rights and freedoms of the data subject. While it is likely that this would n ot have happened during a normal data subject request, there is a chance that internal procedures do allow for such background checks. It is also possible that the difference in this case is that the background check got revealed to the data subject. IBM h as made assurances to the researchers this is not the case. For these reasons, this umbrella DPIA finds that this is a risk with a high potential impact on the rights and freedoms of the data subjects. There is a low chance that the risk will reoccur. Ther efore, this is a low risk for the rights and freedoms of the data subjects. Risk 13: Controller unable to fulfil data subject rights IBM has been unable to deliver a full overview of all personal data in response to the formal data access request during this umbrel la DPIA.

While IBM responded in a timely fashion to the request, not all data known to exist were included in the delivery to the data subject. This includes both data known to exist within IBM, and data known to exist with IBM’s subprocessors and affiliat es, including the ad networks. The details of the data access request have been described in paragraph 1.8 . In section 15, it is described what data was missing. The data subject rights described in articles 15 - 21 GDPR are one of the cornerstones of data p rotection. The failure of IBM to fully comply with the data subject access request is automatically a risk with a high potential impact to the rights and freedoms of the data subject. The likelihood of this risk is high, since there is no reason to assume that a more complete data set would be produced without changes in the internal IBM procedures, as well as with the agreements IBM has with its subprocessors and affiliates.

Therefore, this is a high risk to the rights and freedoms of the primary data subj ects. Risk 14: Tracking pixel in response email during data subject access request IBM confirms the reception of a data subject request by sending an email to the address provided by the requesting party. This email is sent through a mailing system that adds a trac king pixel to the email. This way, IBM can track when an email is read, if the mail client supports the automatic or manual opening of images in emails. The use of this tracking pixel falls under the requirements of article 11(7a) Telecommunications Act to obtain prior consent. This consent can however not be validly obtained under these circumstances, as part of the data subject request procedure. The three exceptions as mentioned in 9.1 do not apply either, as the tracking is not necessary to deliver the requested service, to technically facilitate the service, or to check the quality.

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. The potential impact of this risk is low, since the user has to enable the loading of the tracking pixel in most modern email clients and the fact that not accepting the tra cking pixel does not limit the data subject’s ability to exercise their rights. The likelihood that this risk will occur is low, given the low number of data subject requests, and the fact that most of these will run through the government organisation’s s taff, who will receive the confirmation email. Therefore, this is a low risk to the rights and freedoms of primary and secondary data subjects. Risk 15: Sending email contains mail address of data subject as ‘reply - to’ address When sending an external email, the em ail is recognized as sent from the CP4BAaaS instance in general. However, in the headers, the email address used to login to CP4BAaaS of the person who sent the email is displayed as the ‘reply - to’ address.

This implies the risk of unintentionally disclosi ng the email address of an internal employee. The potential impact of this risk is low, since these emails will often be internally used. Otherwise, there is only very limited impact in knowing the sender. This will often be the person with whom one has co mmunication going on. The likelihood of the risk occurring is high. Therefore, this is a low risk to the rights and freedoms of data subjects. Risk 16: Applications build on CP4BAaaS may create a disproportionate audit trail CP4BAaaS does, by default, not create an audit trail. Such an audit trail has to be created when building an application upon CP4BAaaS. In many cases an audit trail is necessary or even obliged. But, depending on the way the application is built, the application may log much more information tha n needed for this audit trail, resulting in disproportional data processing.

The impact of this occurring is high because it results in unlawful processing and this data can be used to track employees. The default settings for creating an audit trail when building an application on CP4BAaaS is ‘off’, so the chance of this occurring is low. Therefore, this is a low risk to rights and freedoms of data subjects. 16.2 Summary of risks This umbrella DPIA has identified 11 high risks to the rights and freedoms of the data subjects, and four low risks, before taking mitigating measures. When plotted in the matrix created by the UK Data Protection Authority IC O , the risks look like this: Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 82 of 99 Figure 9 - ICO - based risk assessment matrix Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Part D. Description of risk mitigating measures Part D describes the proposed (counter - )measures that are necessary to mitigate the high risks found in Part C. This part also contains an analysis of the residual risk after the implementation of the proposed measures, and a recommendation on whether the measures will be sufficient in reducing risk to an acceptable level. 17.

Risk mitigating measures The following section contains a table of the mitigating technical, or ganisational and legal measures that need to be taken by the governmental organisation or by the supplier in order to reduce risk for the data subjects. 17.1 Measures to be taken to mitigate high risks The following measures are necessary in order to minimize t he high risks found in part C of this umbrella DPIA. Table 6 - Overview of mitigating measures for government organisations and IBM Risk no. High risk Measures government organisations Measures IBM 1 Loss of control and unnecessary processing The authentication and account activation services must be provided as integral part of the business agreement for CP4BAaaS, with IBM acting as a data processor for the government organisation. Remove the creation of an implicit con tract between the user and IBM for using the authentication page. 2 Violation of data protection by default Change the default setting for cookies on the login page to required cookies only.

Place this option on the first page. 3 Lack of transparency (c ookies) Provide full information about the cookies necessary for the functioning of CP4BAaaS and any other cookies used. 4 No consent for unnecessary cookies For cookies that require consent of the data subject, these may only be issued after valid consent has been obtained (instead of directly when loading the page) Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 84 of 99 Risk no. High risk Measures government organisations Measures IBM 5 Loss of control: subprocessors Actively monitor and audit the use of subprocessors by IBM. IBM must provide information on all subprocessors in the public documentation or contracts a nd inform about their tasks. Furthermore, IBM must guarantee that the same requirements on data protection compliance apply to those subprocessors as apply to IBM. 6 Loss of control: joint controllership with third parties Third parties and ad networks m ust be excluded from CP4BAaaS.

Their presence is not necessary to provide the services. When these third parties are excluded, the joint controllership ceases to exist, and IBM acts as a data processor for the government organisation as a data controller. 7 Unlawful data transfers to USA As a data controller, the government organisation must provide a valid transfer mechanism for the structural transfer of personal data to the USA. The impact of the transfer must be assessed in a DTIA. IBM must host the Go ogle Fonts on their own servers to avoid transfer of personal data to Google. Data processings must be taking place in the EU/EEA only, unless adequate safeguards apply. 9 Incompatible further processing (marketing, etc.) Regularly audit IBM’s use of personal data of primary data subjects for its own legitimate business purposes to ensure that the data is not used for these purposes. The purposes of marketing, product improvement and business intelligence are purposes of IBM as a data controller.

These purposes must be excluded from the general terms and conditions, since IBM as a data processor is not allowed to determine own purposes for further processing the personal data it receives from the government organisation. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Risk no. High risk Measures government organisations Measures IBM 10 Worldwide access for support without transfer mechanism Optional: The government organisation may consider limiting support to local office hours and from within the EU/EEA only. (This requires that IBM can indeed limit support and access to regions) IBM must provide guarantees for t he protection of personal data according to the GDPR when providing support from establishments outside the EU/EEA. For instance, Binding Corporate Rules in combination with technical measures. Alternatively, IBM can limit support to regions. 11 Insuffici ent technical security measures in default email settings Turn on the encryption functionality in the setup of the email application.

Monitor that the setting remains set to encrypt. By default, enable the encryption settings for sending email. 13 Failure to fully comply with data subject access request Annually audit the data subject request procedures used by IBM and its subprocessors and affiliates. Review the internal data subject request procedures. Also: Audit and report on the internal data subject request procedures with subprocessors and affiliates. Several risks that this umbrella DPIA identified are classified as low risk to the rights and freedoms of the data subjects. The controller is not required to take any mitigating measures for t hese risks, but some optional measures would eliminate much of the possible remaining impact on the rights and freedoms of the data subjects involved. These are: Table 7 - Overview of low risks and suggested mitigating measures Risk no. Low risk Optional measures governmental organisation Optional measures IBM 8 Unlawful processing of special categories of personal data in filenames Provide guidance to users of CP4BAaaS to prevent inclusion of special categories of personal data in filenames 12 Data subject background check Tighten internal procedures to prohibit data subject background checks when processing a data subject request, including those that only use public sources.

Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Page 86 of 99 Risk no. Low risk Optional measures governmental organisation Optional measures IBM 14 Tracking pixel in response email Stop including tracking pixels in the confirmation email after a data subject request. 15 Email address unintentionally disclosed Adjust the configuration of the own email server 16 Applications build on CP4BAaaS may create a disproportionate audit trail Instruct application managers to minimize the audit trail 17.2 Assessment of risks after taking mitigating measures This umbrella DPIA has identified 11 high risks and 5 low risks to the rights and freedoms of individual data subjects. For each high risk, mitigating measures have been identified. The types of measures differ in their nature and some of the measures imply major changes to the way CP4BAaaS is provided by IBM. If all the measures can be taken, the risks will be mi tigated and only low risks remain.

Depending on the specific context in which a government organisation wishes to implement CP4BAaaS, additional risks may be present. If no additional risks are identified and all measures have been implemented, the use of CP4BAaaS by government organisations in the Netherlands would not require a prior consultation with the Data Protection Authority. Umbrella DPIA IBM Cloud Pak for Business Automation as a Service FINAL VERSION Alleen hoofddocument. Conclusion This umbrella DPIA assessed the risks for the rights and freedoms of data subjects that occur when a government or ganisation is using IBM CP4BAaaS. The focus of this umbrella DPIA was on the processing of Diagnostic Data, but some related risks have been identified as well. In total, 11 high risks and 5 low risks have been identified. A number of risks relate to the l ocation of processings outside the EU/EEA. Several risks concern the account activation and login pages that facilitate processing of personal data by third parties.

Another category of risks relates to the completeness of information as provided to data s ubjects or in the contractual agreements, in particular when it concerns the use of subprocessors. For all the risks mitigating measures have been proposed. When all these measures are taken by IBM and/or the government organisation, only low risks will re main. Unless additional risks are identified as a result of a specific context in which CP4BAaaS will be implemented and unless all measures have been implemented, the use of CP4BAaaS by government organisations in the Netherlands would not require a prior consultation with the Data Protection Authority. Appendix 1 – Technical research protocol Setup of the research systems • Windows 10, patch level current production • MITMProxy 30 installed for interception of HTTP and HTTPS traffic • Wireshark 31 installed for monitoring all traffic • Firefox 32 , patch level current production • Certificate for traffic interception with MITMProxy installed in OS certificate store • OS connected to public in ternet via NAT - router • Firefox setup with: • Clean profiles with empty cache and no cookies stored • Accept all cookies • ‘Do Not Track’ headers off • Proxy configured to use MITMProxy on localhost Analysis • Custom Python scripts for analysing traffic dumps created by MITMProxy, outputs to Excel, used for all tests mentioned here. • Firefox developer console for exploration and reference • mtr 33 for network discovery UC0: setting up an account Prerequisites: • Three invitation links for normal users In clean browser profil e: • Open first account activation link • Select default cookie settings (‘Personal) • Enrol, name: S. Ocial • Logout • Store browser profile for further testing In clean browser profile: • Open second account activation link • Select medium cookie settings (‘Functional) • Enrol, name: P. Ersonalizid • Logout • Store browser profile for further testing In clean browser profile: • Open third account activation link • Select minimal cookie settings (‘Oblidged’) • Enrol, name: M. Inimal • Logout • Store browser profile for furt her testing UC1: storing, retrieving and editing a document in Word Prerequisites: 30 https://mi tmproxy.org/ 31 https://www.wireshark.org/ 32 https://www.mozilla.org/nl/firefox/windows/ 33 https://en.wikipedia.org/wiki/MTR_(software) Appendix page ii of xi • Folders setup in document storage • Test documents on local storage • Document class with set retention period Additional checks during testing: • Diagnostic Data in communication between browser and server • Version control of document • Tags and metadata created with document • Results of setting a retention period on document • Possibilities to undelete a document • Is there an option to use geotagging of items?

For each test user created in UC0: • Check - in test document from local storage to folder • Check - out test document • Edit document • Check - in document • Check - out same document • Edit document • Check - in document • Download document • Delete document • Create document with retention period of 10 minutes • Try to delete document • Wait 10 minutes • Try to delete document UC2: searching for documents Prerequisites: • Folder “verzoeken ambtenaren” only accessibele to P. Ersonalized • Folder “taskforce” only accessibele to S. Ocial • Folder “OR” accessible to ev erybody • Document created by P. Ersonalized: − Name: “verzoek erkenning gewetensbezwaren homohuwelijk dhr. Witjes” − Contains the word “Kerkgenootschap” − Folder: “verzoeken ambtenaren” − Tag for document: “ontslagdossier dhr Witjes” • Document created by S. Ocial: − Name: “Verslag intern overleg taskforce afhandeling affaire” − Contains the word “M.

Inimal” − Folder: taskforce • Document created by S. Ocial: − Name: “Verslag OR 22 - 7 - ‘21” − Contains the word: “M. Inimal” − Folder: OR • Document created by S. Ocial: − Name: “Verslag OR 21 - 8 - ‘21” − Contains the word: “M. Inimal” − Folder: OR • Document created by S. Ocial: − Name: “Verslag OR 20 - 9 - ‘21” − Contains the word: “M. Inimal” − Folder: OR • Document created by S. Ocial: Appendix page iii of xi − Name: “Verslag OR 19 - 10 - ‘21” − Contains the word: “M. Inimal” − Fo lder: OR • Document created by S. Ocial: − Name: “Verslag OR 18 - 11 - ‘21” − Contains the word: “M. Inimal” − Folder: OR Additional checks during testing: • Does the search respect the permissions of the files? • Is it possible to see filenames of files a user does not h ave access to? • Is it possible to see content of tags of files a user does not have access to? • Does the search leak data to 3 rd parties?

For each of the three test users: • Search on “gewetensbezwaren” • Search on “Kerkgenootschap” • Search on tag content “ontsla gdossier dhr Witjes” • Search on “M. Inimal” UC3: performing a workflow with a handover of a document Prerequisites: • A workflow that requires another user to approve the document before proceeding Additional checks during testing: • Does the browser send Diagnostic Data to the server? • Any leakage of tags/metadata? For each of the three test users: • Create a new document in the workflow • Let the next user approve the document • Check the approval UC4: sending a document by e - mail Prerequisites: • A normal class d ocument in the storage • A document of the class ‘e - mail’ in the storage • SMTP server properly configured Additional checks during testing: • Data included in the mail headers For each three test users: • Send the normal document to another test user • Send the no rmal document to an external e - mail address • Send the e - mail class of document to another test user • Send the e - mail class of document to an external e - mail address Verification test Prerequisites: • Browser profile of M. Inimal test user • Cookies and cache cleared from browser profile Appendix page iv of xi Additional checks during testing: • Cookies detected by Firefox developers panel Test: • Open https://dpia.automationcloud.ibm.com • Select ‘ only required cookies’ • Log in with M. Inimal username • Download a document from the file navigator • Log out Appendix page v of xi Appendix 2 – Observed Traffic and Cookies Requests and cookies before consent Table 8 shows observed requests and set cookies when creating an accoun t and before consenting to any of the cookie preferences.

Domains controlled by IBM, based on the domain WhoIs register, are marked green. Third - party requests not setting cookies are marked orange, third - party requests that do set cookies are marked red. All sites setting third - party cookies have set at least one cookie that contained a unique identifier and that had an expiry date past the current session. Table 8 - Requests and cookies before consent Hostname Domain controlled by IBM? Sets Cookie(s)? 1.www.s81c.com Yes No analytics.twitter.com No Yes api.www.s81c.com Yes No c.bing.com No Yes cloud.ibm.com Yes Yes cm.everesttech.net No Yes consent.trustarc.com No No consent.truste.com No No consent - pref.trustarc.com No No consent - st.trustarc.com No No dpm.demdex.net No Yes fonts.gstatic.com No No ibm.demdex.net No No idsync.rlcdn.com No Yes login.ibm.com Yes Yes ml314.com No No prefmgr - cookie.truste - svc.net No No sync.mathtag.com No Yes tags.tiqcdn.com No No www.automationcloud.ibm.com Yes Yes www.ibm.com Yes No www - api.ibm.com Yes Yes Cookies set with default option (Personalized) Table 9 shows an overview of third - party cookies set during account activation and logging in when the default setting of ‘Personalized’ is used.

Note that some cookies set by third - party scripts may be listed at the wrong host of not be listed at all: Table 9 - Cookies set with 'default’ option Third - party host Cookie name Times set dpm.demdex.net demdex 9 dpm 6 Appendix page vi of xi Third - party host Cookie name Times set cm.everesttech.net everest_g_v2 1 everest_session_v2 1 sync.mathtag.com uuid 1 mt_mop 1 analytics.twitter.com personalization_id 1 idsync.rlcdn.com rlas3 4 pxrc 4 c.bing.com MUID 1 collect.tealiumiq.com TAPID 21 pixel.mathtag.com mt_mop 5 mt_misc 5 cm.g.doubleclick.net test_cookie 2 IDE 1 ib.adnxs.com uuid2 2 ad.sxp.smartclip.net uuid 2 dspuuid 1 psyn 1 mwzeom.zeotap.com zc 1 pixel.tapad.com TapAd_TS 2 TapAd_DID 2 TapAd_3WAY_SYNCS 1 ibm.demdex.net demdex 19 ibm 18 dsum - sec.casalemedia.com CMID 2 CMPS 2 CMPRO 1 CMRUM3 1 CMST 1 stags.bluekai.com bku 1 bkpa 1 id5 - sync.com cf 2 cip 2 cnac 2 car 2 gdpr 2 id5 1 callback 2 sync.search.spotxchange.com audience 2 ads.stickyadstv.com uid - bp - 529 1 UID 1 sessionId 1 x.bidswitch.net tuuid 2 c 2 Appendix page vii of xi Third - party host Cookie name Times set tuuid_lu 2 sync.go.sonobi.com HAPLB5S 1 uip.semasio.net SEUNCY 2 simage2.pubmatic.com KRTBCOOKIE_27 1 PugT 1 PUBMDCID 1 aa.agkn.com ab 1 ih.adscale.de uu 2 cct 1 tu 1 loadm.exelator.com EE 2 ud 2 sync.crwdcntrl.net _cc_cc 2 _cc_dc 1 _cc_id 1 _cc_aud 1 pixel.advertising.com APID 2 i.liadm.com lidid 2 _li_ss 1 d.agkn.com ab 1 u 1 beacon.krxd.net _kuid_ 1 ups.analytics.yahoo.com A3 2 B 2 IDSYNC 1 APID 1 APIDTS 1 onetag - sys.com OTP 1 track.adform.net C 1 uid 1 i6.liadm.com lidid 1 uipglob.semasio.net SEUNCY 2 match.adsrvr.org TDID 2 TDCPM 2 Requests and cookies with ‘obliged’ cookie settings Table 10 shows the requests made and the cookies set during the verification test.

Domains controlled by IBM, based on the domain WhoIs register, are marked green. Third - party requests not setting cookies are marked orange, third - party requests that do set cookies are marked red. All sites setting third - party cookies have set at least one cookie that contained a unique identifier and that had an expiry date past the current session. Appendix page viii of xi Table 10 - R equests and cookies with ‘obliged’ cookie sett ings Hostname Domain controlled by IBM ? Sets cookies? dpia.automationcloud.ibm.com Yes Yes www.automationcloud.ibm.com Yes Yes 1.www.s81c.com Yes No fonts.gstatic.com No No www.ibm.com Yes No api.www.s81c.com Yes No tags.tiqcdn.com No No cloud.ibm.com Yes Yes login.ibm.com Yes Yes consent.truste.com No No dpm.demdex.net No Yes consent.trustarc.com No No ibm.demdex.net No Yes consent - pref.trustarc.com No No cm.everesttech.net No Yes sync.mathtag.com No Yes idsync.rlcdn.com No Yes consent - st.trustarc.com No No analytics.twitter.com No Yes c.bing.com No Yes ml314.com No No prefmgr - cookie.truste - svc.net No No www - api.ibm.com Yes Yes 1.www.s81c.com Yes Yes login.ibm.com Yes No Table 11 shows the third - party cookies set during the verification test.

These third - party cookies were set while using the most restrictive cookie settings. Note that some cookies set by third - party scripts may be listed at the wrong host of not be listed at all: Table 11 - T hird - party cookies set with obliged cookie settings Third - party host Cookie name Times set dpm.demdex.net demdex 6 dpm 5 cm.everesttech.net everest_g_v2 1 everest_session_v2 1 sync.mathtag.com uuid 1 idsync.rlcdn.com rlas3 2 pxrc 2 Appendix page ix of xi Third - party host Cookie name Times set analytics.twitter.com personalization_id 1 c.bing.com MUID 1 ibm.demdex.net ibm 1 dexoo 1 Appendix page x of xi Appendix 3 – Architecture of CP4BAaaS Appendix page xi of xi