I totally agree with you @ademoss . I will say, though, that IP address is personal data according to the GDPR so it makes sense that it would be included with other examples of personal data.
1 Like
The ambiguity of GDPR is the fault of European lawmakers and not Atlassian. However, I feel like the privacy & security tab conflates two different concepts:
- Information security
- Personal data protection
I would rather not have the GDPR question in there, because effectively, every app is a data controller, no matter how you design it.
2 Likes
Actually, there are really two types of data we need to pay attention to:
- personally identifiable information (PII), which can identify a user, such as names, phone numbers, IP addresses, etc.
- user-generated content (UGC), which can include⊠well, in the case of Jira issues or Confluence content, just about anything, including PII (since the app doesnât control and cannot know whatâs contained in Jira or Confluence data
This means that as soon as your app starts to access Jira issues or Confluence pages (which is UGC), it is potentially processing PII.
Hi @ademoss and @JuliaWester - We want to provide a bit more context for you to explain where weâre coming from re: helping you define data types. Hopefully this clarifies things a bit.
We designed the new tab to provide answers to the questions our customers most commonly want to understand about their apps.
One almost universal concern we hear from our customers is about what apps are doing with their data - for example, is it being sent outside of the Atlassian apps and infrastructure theyâve already evaluated for further processing and/or storage?
This concern is broader than just what you might think of as âpersonal dataâ - for instance, a company might use Confluence to store financial data, roadmap plans, legal advice or other information that may be extremely sensitive, even if it doesnât include any personally identifiable information.
Thatâs why we use a broad definition for âEnd-User Dataâ that encompasses any data, content or information of an end user that is accessed, collected or otherwise processed by you or your app rather than a narrower or more limited definition that would still leave our customers with questions about what might be happening with their data.
@ademoss - weâd love to be able to give you and other partners specific and personalized guidance. The problem is not that Atlassian canât be bothered to do so, itâs that as a matter of legal ethics our lawyers canât offer legal advice about how you should interpret the defined terms that come from the contracts youâve signed with Atlassian.
Fortunately, from the example in your post it sounds like you have already arrived at an understanding of âEnd-User Data,â but weâd be happy to hear any feedback if thereâs something specific in the definition that still seems ambiguous.
Understanding that this definition is quite broad, we also give you the opportunity in the questionnaire to specifically list the End-User Data types that your app processes and/or stores, so you can give customers the full visibility that they often request, and share in detail your interpretation of âEnd-User Data.â
@MaggieNorbyAdams any chance we can get guidance on the user entity properties?
Hi @danielwester - Yes, apologies for the delay. Weâve seen your question and weâre working on it 
Weâll have a response for you by the end of this week.
cc - @SeanBourke @SushantBista
Hi @danielwester, apologies for the delay. We were discussing some of the nuances here to determine what would be the most appropriate option. As a general rule, the first option (âYes. App stores End-User Data exclusively within Atlassian products and services which support data residency options, as outlined here.â ) is the most appropriate response if your app stores data exclusively in Atlassian products, including entity properties.
That said, itâs important to note that user/profile info is not pinned as part of âin scope dataâ for Atlassian data residency. In the customer facing UI where we provide your response, we do link out to Atlassianâs definition of âin-scope dataâ for Atlassian data residency, so we do explain this publicly in our documentation which will be linked from your response.
Please be aware of the definition of âin scope dataâ so that you are prepared to respond should a customer ask for more details.
Thank you @SeanBourke. this is very helpful. In discussions with our TPM yesterday we talked about how what âthe appâ does and what we as a company do with information surrounding their subscription are not the same. (ie, we get marketplace data from the company, we have support case data, etc. - none of which come from the app). So, I think the tab should be explicitly clear to the reader, as well as us, what the scope of the questions really is. That we may handle more of their company data outside of the app but that information isnât in scope and they should refer to our provided links for more information about those aspects.
2 Likes
When we look at the definitions of a âData Controllerâ and a âData Processorâ in the link provided as a helpful resource on the new privacy & security tab (https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controllerprocessor/what-data-controller-or-data-processor_en) they make it clear that both of those terms relate to Personal Data.
The data controller determines the purposes for which and the means by which personal data is processed
The data processor processes personal data only on behalf of the controller
Personal Data is not any user-generated content or end-user data as explained here - What is personal data?
However, when we fill out the new form, we are asked about the âEnd-User Data with respect to which your app is a data processor/data controllerâ
Isnât this question fundamentally wrong? If data controllers and data processors are by definition limited to personal data, what end-user data are we supposed to provide here?
Looking for some guidance as we are stuck on those questions. If the app doesnât process personal data should we just check âNot applicable - App is not subject to the GDPR.â?
Best,
Sebastian
2 Likes
Hi Julia - thanks for the feedback. It sounds like what youâre looking for is more specific clarity at the question or section-level on whether the information refers to an app or to a company (ie: the Marketplace Partner who runs the app).
Weâve taken note of this as something to consider for future updates to the questionnaire.
Please note that the tab will also have a feedback button at the bottom so we can track whether customers are similarly confused about the information theyâre seeing.
Hi @sbrudzinski - thanks for your question.
The definition of âEnd-User Dataâ is âany data, content or information of an end user that is accessed, collected or otherwise processed by you or your app in connection with use of the Atlassian Marketplace.â
This definition is broad enough to include data types that would constitute âpersonal dataâ under the GDPR. So if the GDPR applies to your processing activities (for example, if you process personal data relating to European Economic Area (EEA) residents), you should specify the personal data (which is a type of data covered by the umbrella definition of âEnd-User Dataâ) over which you are a controller. If youâve determined that the GDPR does not apply to you, you can answer "Not applicable - App is not subject to the GDPR.â
Hope this helps clarify.
Hi @sbrudzinski ,
you are right about the GDPR definition of Data Controller and Data Processor. It only applies to Personal Data.
However, as soon as your app manipulates user-generated content that is readable (any text really), it can actually unknowingly be manipulating Personal Data. For example, the issue summary or description could contain Personal Data because the user put it there. But it can be more tricky: a project name or key, a Component name, a Version name, etc., could also contain Personal Data, and you have no way of determining that and avoiding access to this potentially Personal Data.
So the only case where you are not manipulating potentially Personal Data is if you only access numerical or otherwise opaque entity IDs (not an issue key but an issue ID for example). Which is probably very rare amongst apps.
Just my two cents,
David
1 Like
Hi all! Dropping in to flag this latest update: Privacy & Security tab improvements: new PATCH API and adjustments to Data Residency and Disk Encryption response options
2 Likes
I have just submitted responses to one of the apps. However, I have noticed a bug in showing DPA question answer:
The answer is
Yet it shows
Hi @RaimisJ 
Many thanks for reporting this issue. I confirm that this is indeed a bug, I was able to validate this on my test app. We will update this thread, once the issue is fixed.
âDoes your app process and/or store logs outside of Atlassian products and services?â
Whatâs the appropriate answer, if we âkeepâ logs for 1 month in Cloudwatch and then AWS Cloudwatch deletes them for good via log retention settings?
- Does this relate to End-user-data?
- Is temporary retention for debugging classed as storing?
1 Like
1 Like
Hi Ulrich - The goal of the question is to let customers know if your app stores logs in general. There is a separate question for End User Data access via logs where you can clarify how your logs relate to EUD. For this question, if your app stores logs, the answer is yes.
Weâve added a note to look into providing more opportunities for you to clarify a temporary retention period for log storage in the event that this is the only data your app stores. This is something weâll explore for the next iteration of the questionnaire.
2 Likes
- Does this question:
Does your app log End-User Data?
Include Google Analytics connected to our apps, or is this strictly about application logs?
- According to Atlassian, is this âend-user dataâ?
- email address
- saved app configurations (app settings)
- translations/proper names
- JQL saved by app provided by end-user
- any data entered into text fields of forms provided by our apps
- user accountId
Hi @RadoslawCichockiDevi - Please see our response above on this subject. You should see a space to specify the data your app stores so you can clarify this for prospective customers.