By Roger Matus, Vice President of Global Marketing, and
   Ed Barbeau, Vice President of Product Management

                                  If you have a website with a form or an email list that
                                  includes European customers, the new European General
                                  Data Protection Regulation (GDPR) will require you to
                                  be able to access, delete, and make corrections to all of
                                  your data about any EU individual, even if you don’t have
                                  offices in Europe. This paper outlines six steps that will
Golden Master                     help prepare your customer record management system to
Records help                      handle the demand.
companies to
                                  GDPR, which goes into effect on May 25, 2018, applies
quickly find, edit,               to anyone in the world who offers goods or services to
or delete all the                 European Union (EU) individuals or monitors the behavior
information they                  of EU individuals. (In June 2017, the United Kingdom
have about any EU                 confirmed that GDPR will form a part of UK law, even after
                                  Brexit. Therefore, for this document, the term EU is meant
individual at any                 to include the UK.)
time, as required by
GDPR.                             Unlike previous privacy directives, GDPR applies to
                                  companies even if the company does not have a physical
                                  presence in the EU. Many companies, including Internet-
                                  only companies, that had never concerned themselves with
                                  the handling of EU personal data must do so now.
                                  The penalty for a failure to comply could mean a fine of up
                                  to 20-million Euros (about US$24-million) or four percent of
                                  worldwide revenues, whichever is greater.

 Global-Z International   |   www.globalz.com   |   t: +1.802.445.1011   |   gdpr_info@globalz.com
“Personal data” is defined by the Euro-          • The Right to Rectify: Individuals
                pean Commission as “any information                may require companies to correct
                relating to an individual, whether it              inaccurate data and may object to
                relates to his or her private, professional        any profiling that may result in
                or public life. It can be anything from a          discrimination.
                name, a home address, a photo, an email
                address, bank details, posts on social           This list covers only a small subset of
                networking websites, medical informa-            the rights and regulations in the GDPR,
                tion, or a computer’s IP address.” Al-           which consists of 99 articles and 173
                most anything collected on a website,            recitals over 261 pages in English.
                including behavioral activity, related to        Finding All The Data
                an EU person is regulated.
                                                                 To meet these GDPR requirements, it
                An “individual” includes both citizens           will be necessary for organizations to
p2              and residents of any EU member state.            be able to quickly find and modify all of
                                                                 the information about an individual on
                GDPR gives EU individuals meaningful
                rights over the personal data you collect,
                including the following:                         The most effective way to do this is to
                                                                 create a searchable record management
                • The Right to Consent: Individuals
                                                                 system with a Golden Master Record for
                  must explicitly consent for you to use
                                                                 each customer containing both the most
                  their personal data. Opt-outs and
                                                                 recent information and a key that lets
                  pre-checked opt-in boxes are no longer
                                                                 you find all of the source records.
                  sufficient. In addition, the uses for the
                  data must be disclosed at the time of          However, building a Golden Master
                  collection. Consent may be withdrawn           Record from multiple sources for each
                  or limited to specific purposes at any         customer is not simple because the data
                  time. You must be able to prove that           in different databases or even differ-
                  they have given consent.                       ent records in the same database rarely
                                                                 match exactly. (See Finding Data Exam-
                • The Right to Access: Individuals               ple on the next page.)
                  may obtain a copy of the information
                  held about them. They also have the            For global organizations, the challenge
                  right to know where the information            of accurately matching a name increases
                  is stored, who can access it, how they         when a name is written in a different
                  access it, and the reasons for access.         character set in one country (e.g., Cyril-
                                                                 lic or Greek) than another (e.g., Latin/
                • The Right to Be Forgotten:                     Roman/Western). When an EU resident
                  Individuals may request that any or all        of Greece writes his or her name and
                  information be deleted.                        address in Greece, he/she may use the

 Global-Z International   |   www.globalz.com   |   t: +1.802.445.1011   |   gdpr_info@globalz.com
Resolving Identity
                              FINDING DATA EXAMPLE
                                                                        The solution to the problem of making
                    If the famous footballer (soccer player)
                                                                        accurate matches is to use as many cus-
                    Therese Sjögran asked for a copy of all of
                                                                        tomer attributes as possible and to estab-
                    the personal data your company main-
                                                                        lish a tolerance level for each attribute
                    tained about her, would your system know
                                                                        to accept a match. Local knowledge is
                    if the names listed below belong to Ms.
                                                                        critical to do the matching properly be-
                                                                        cause the significance of each attribute
                                      Therese Sjögran                   may vary by location.
                                      Thérèse Sjögran
                                                                        The best practice followed by those who
                                       Teresa Sjogren
                                                                        specialize in customer identity resolu-
                                        Terry Sjogran
                                                                        tion is to take the following six steps:
                                          T. Sjögran
p3                                       KIT Sjögran                    1. Gathering the data
                                     Theresa Sjogrann
                                                                        2. Data parsing
                                       Kirstin Sjögran
                              Kerstin Ingrid Therese Sjögran            3. Postal address hygiene
                                                                        4. Email address, phone number, and
                    The answer is that any of these could be               other data hygiene (if available)
                    Ms. Sjögran, whose real name is Kerstin In-
                                                                        5. Matching and merging (reconcilia-
                    grid Therese Sjögran. The name she might
                    submit on a Right To Access request might
                    not match all of the names used in all of her       6. Metadata management
                    transactions with your organization.                These steps are explained below in more
                    Greek character set, which is different
                    from the way it would be written in the
                    rest of Europe. Generally, matching                 1. Gathering The Data
                    systems use transliterations of names
                    for matching when character sets are                The first step in the process of resolving
                    mixed. However, since transliterations              a person’s identity is to gather all of the
                    vary, a matching system cannot rely on              person’s data. Taking an inventory to
                    exact matches across countries.                     determine where personal data is stored
                                                                        often involves large parts of an orga-
                    However, a system that is flexible in one           nization to identify all of the potential
                    country could incorrectly match differ-             source files. Examples of places where
                    ent people in countries where names are             personal data may be found are the fol-
                    common. For example, according to The               lowing:
                    Economist, one in five South Koreans
                    have the surname Kim.

     Global-Z International    |   www.globalz.com     |   t: +1.802.445.1011   |   gdpr_info@globalz.com
• Marketing: Website forms, email lists,           2. Data Parsing
                      tradeshow leads, etc.
                                                                       Simple approaches to matching will not
                    • Accounting: Billing, receiving, credit           work because the same address may be
                      reports, etc.                                    entered differently in different source
                    • Shipping / fulfillment records                   systems. For example, “23 David Street,
                                                                       St. Helier” may be the same address as
                    • Sales: CRM systems, contact lists, etc.          “Avon House, David St., Saint Helier,
                    Proper data governance and data stew-
                    ardship include collecting and keeping             The best practice is to parse the informa-
                    track of this source information so that           tion into its component attributes. For
                    when requests are made from individu-              example, a street address may be broken
                    als the proper actions can be taken on             down into building number, directional
p4                  the source files.                                  (e.g., north or east), street name, and
                                                                       street type (e.g., street or avenue). When
                                                                       building a system for global use, it is

                                                    DATA PARSING EXAMPLES
                    ORIGINAL:                                          PARSED:
                    23 DAVID PLACE                                     Number:            23
                    ST HELIER JE2 4TE                                  Street:            David Place
                                                                       City:              St Helier
                                                                       Postal Code:       JE2 4TE

                                   PARSING EXAMPLE WITH NON-ROMAN CHARACTER SET
                    An individual may write an address for billing in Japan as follows:

                    The source information in the Japanese             The same address would Romanized for a
                    system would be parsed as follows::                European copy of the database:

                    Block Sequence:     3-3-1                          Block Sequence:    3-3-1
                    Area Name:          北二十四条東                         Area Name:         Kita-24 Johigashi
                    District:           東区                             District:          Higashi-Ku
                    City:               札幌市                            City:              Sapporo-Shi
                    State:              北海道                            State:             Hokkaido
                    Postal code:        065-0024                       Postal Code:       065-0024

     Global-Z International   |   www.globalz.com    |   t: +1.802.445.1011   |   gdpr_info@globalz.com
important to create a consistent data            • Determine or validate the country
                structure that can be used across coun-
                tries. While parsing resolution varies by        • Match to Postcode Address File (PAF)
                geography, data usually may be parsed              reference data for the specific country,
                in the following way: Unit/Apartment/              which includes officially licensed
                Flat, Premises, Number, Street, City, Dis-         sources such as the country’s postal
                trict, Town, Postal Code, and Country.             authority, other government agencies,
                                                                   and third parties.
                3. Address Hygiene
                                                                 • Correct and standardize identified
                The same address may be entered into a             components
                database in a variety of ways, as shown
                in the example on the next page. There-          • Append/insert missing components
                fore, the next step is to validate and           While licensed and up-to-date PAF data
p5              standardize addresses.                           may cost more than other sources, they
                Validation involves comparing a parsed           can vastly improve accuracy and quality.
                address with official records and mak-           It is a good idea to ask vendors whether
                ing corrections. In some countries, a            they use officially licensed sources.
                location may have multiple designations          In large urban areas with multistory
                or even names. Best practice would be            buildings, such as Hong Kong, there
                to perform the following operations:

                                             ADDRESS HYGIENE EXAMPLE
                The original records appear as the user entered them into various on-line forms:

                FirstName LastName Address1              Address2              Address3 City           Postcode
                                                         23 DAVID PLACE,
                CHRISTIANE     GELLESCH   AVON HOUSE     ST. HELIER                        JERSEY      JE2 4TE
                                                                               ST HELIER   CHANNEL
                CHRISTIANE     GELLESCH   AVON HOUSE     23 DAVID PLACE        JERSEY      ISLANDS     JE2 2TE
                CHRISTIANE     GELLESCH   AVON HOUSE     23 DAVID PLACE, ST. HELIER        JERSEY      JE2 4TE
                CHRISTIANE     GELLESCH   43 DAVID PLACE AVON HOUSE                        ST HELIER   JE2 4TE

                The parsed address is validated and standardized as follows:
                   			                          Building:      Avon House
                   			 Number:                                 23
                   			Street:		David Place
                   			District:		St. Helier
                   			City:		Jersey
                   			                          Postcode:      JE2 4TE

 Global-Z International   |   www.globalz.com   |   t: +1.802.445.1011     |     gdpr_info@globalz.com
may be apartment buildings in which              • Remove illegal characters.
                    many people have the same name
                    within the same premises. Sub-premises           • Identify or insert country code and
                    detail, such as floor numbers or build-            local area code.
                    ing information, adds significantly              • Validate against reference database.
                    to the confidence in matching. Small
                    towns may use building names or route            • Format phone number.
                    numbers without more specific address
                                                                     With the postal address, email address,

                    4. Email Address and Phone Number                        EMAIL HYGIENE EXAMPLE
                                                                     In this example, the customer’s email
                    Email addresses and phone numbers                address in the database is as follows:
p6                  may add valuable information when
                                                                                 Christiane @ yaho.couk
                    used with names to resolve an individu-
                    al’s identity. As with postal addresses, a       • Recognize that “.couk” is not a proper
                    critical step is hygiene.                          top-level domain.
                                                                     • Parse the top-level domain and identify
                    The following steps may be used to
                                                                       that “uk" is a proper country code top-
                    cleanse customer’s email address:
                                                                       level domain for the United Kingdom.
                    • Check the email format for compliance          • Alter the domain to “@ yaho.co.uk”.
                      with internet standards (RFC 2822).
                                                                     • Check that the domain “yaho.co.uk”
                    • Parse email address into user and                exists using the available DNS records. In
                      domain.                                          this case, it does not.
                                                                     • Recognize common errors, such as
                    • Correct common domain errors.
                                                                       typing “yaho” instead of “yahoo”.
                    • Search Domain Name System (DNS) to             • Alter the domain to “@ yahoo.co.uk”
                      confirm that the domain exists.
                                                                     • Validate the domain “yahoo.co.uk” using
                    • When even greater confidence is                  the available DNS records.
                      required, send a test message to see if        • For even higher accuracy, send a
                      the message is accepted by the server            message to the email to see if the
                      to validate the specific email address.          message bounces or use a third-party
                    Phone numbers may be similarly cor-                service to validate the user mailbox.
                    rected using the following steps:                The standardized address would be as
                    • Parse phone number to identify                 follows:
                      components.                                                christiane @ yahoo.co.uk

     Global-Z International   |   www.globalz.com   |   t: +1.802.445.1011   |   gdpr_info@globalz.com
and phone number fields cleansed,                 5. Matching and Merging (Duplicate
                standardized, and verified, it is now                Reconciliation)
                possible to compare records with each
                other for matching and reconciliation,            Simple attribute matching is not enough
                which is the key to identity resolution           to retrieve all customer records because
                and building the Golden Master Record.            even standardized records rarely match

                                            PHONE NUMBER HYGIENE EXAMPLE

                The same phone number may be entered into a database in the following ways:

                                                      +44 7509312345
                                                       07509 312345
                                                       0 7509312345
                A check of the address record would determine that the phone number is likely to be in the
                Channel Islands, which is part of the UK. If the incoming number has a +44 at the beginning,
                it can be matched to the country code for the UK. If it does not begin with a +44, the country
                can be postulated from the country field of the address. The remaining digits can then be
                parsed for a known UK pattern. Once properly parsed, the area code can be used to identify
                the phone type, as follows:

                			 Country code: 		 +44
                			NDD Prefix:		0
                			 Area code: 		    7509
                			 Local number: 		 312345
                			Phone type:		Mobile

                The final result can then be shown in the correct formats. The domestic format would be
                07509 312345. The international number format would be +44 7509 312345.

                Validating using known patterns for a particular country adds confidence that it was correctly
                entered into the system and parsed. Here are some ways in which invalid phone numbers
                may be identified:

                Country        Data Found        Problem
                Australia      26621764          “26621” numbers must have exactly nine digits
                Germany        5188547213        Numbers in Germany may not start with “5188”
                                                 Numbers may not start with “498” and “89250” numbers
                Germany        0114989250        must have seven digits
                France         3.33600E+11       Exponential notation caused by corruption

 Global-Z International   |   www.globalz.com   |   t: +1.802.445.1011   |   gdpr_info@globalz.com
exactly. Personal data is always chang-          An important technique known as
                    ing. People move. Individuals may pro-           “cascading” helps to confidently build
                    vide a work phone number during one              a complete Golden Master Record even
                    interaction and a mobile number during           when some attributes disagree and to fill
                    another interaction. Many people also            in incomplete information. An example
                    have multiple addresses (e.g., primary           of cascading is described below.
                    and vacation homes), multiple phone
                    numbers (e.g., fixed landline and mo-            For cascading to work, matching toler-
                    bile), and multiple email addresses (e.g.,       ances must be established individually
                    personal and work).                              for each attribute. The match tolerance
                                                                     for any given attribute may differ based
                    Systems must be able to build a Golden           on the geography. As mentioned earlier,
                    Master Record even when the informa-             in some densely populated locations,
                    tion is incomplete or disagrees. Without         such as Hong Kong, sub-premises detail
p8                  that capability, a customer could ap-            is important. The weight placed upon
                    pear multiple times. Therefore, a search         those address components in Hong
                    would not retrieve all of the customer           Kong would be higher than in a smaller
                    data required during a GDPR request.             city.

                                        CASCADING: A KEY MATCHING TECHNIQUE
                    Cascading uses all of the customer informa-    However, with cascading, Record 3 can be
                    tion available across multiple records to      matched. Because Record 1 and Record 2
                    increase the probability of a match. Con-      are known to match, there is knowledge
                    sider the example of three records:            about the customer’s identity gained from
                                                                   the combination of the records: name, ad-
                    • “Record 1” contains a name, postal
                                                                   dress, email address, and phone number.
                      address, and phone number.
                                                                   This new combined knowledge can be
                    • “Record 2” contains a name, postal           used for matching. The email address in
                      address, phone number, and email.            Record 3 matches the combined knowl-
                                                                   edge of Record 1 and Record 2.
                    • “Record 3” contains a name, email, and a
                      different phone number.                      As more data is compared the knowledge
                                                                   cascades. In addition to the name, address,
                    Record 1 and Record 2 match because the        email address, and phone number attri-
                    name, address and phone number match.          butes, some valuable information used in
                                                                   cascading includes gender, social media
                    Record 1 and Record 3 considered in isola-
                                                                   handles and identification numbers.
                    tion would not be a match because the
                    phone number differs and there is other
                    useful data to match to Record 1 alone.

     Global-Z International   |   www.globalz.com   |   t: +1.802.445.1011   |   gdpr_info@globalz.com
                    The following illustration shows a Golden Master Record with the most accurate consolidated
                    information about the customer after successful matching with cascading:

                    Attribute          Record 1          Record 2            Record 3            Record 4          Master
                    First Name         Christiane        Christiane          Chris               Christiane        Christiane
                    Last Name          Gellesch          Gellesch            Gellesch            Gellesch          Gellesch
                    Building                             Avon House                              Avon House        Avon House
                    Number             23                43                  23                                    23
                    Street             David Place       David Place         David Place                           David Place
                    District           St. Helier        St. Helier          St. Helier          St. Helier        St. Helier
                    City                                 Jersey              Jersey              Jersey            Jersey
                    Postcode           JE2 4TE           JE2 4TE             JE2 4TE             JE2 4TE           JE2 4TE
                    Country            Channel Islands   Channel Islands     Channel Islands     Channel Islands   Channel Islands
                    Country Code                         +44                 +44                 +44               +44
                    Local Area Code                      0                   0                   0                 0
                    Area Code                            7509                7509                7509              7509
                    Local Number                         312345              312345              312345            312345
                                       Christiane@yahoo. Christiane@yahoo.                       Christiane@yahoo. Christiane@yahoo.
                    Email              co.uk             co.uk                                   co.uk             co.uk

                    The art in the process of matching is                          individual grants the use of an address,
                    to understand the importance of each                           the permission would apply equally to
                    attribute in a particular geography and                        all of the address attributes: building,
                    to set the match threshold accordingly.                        number, street, district, and city.)
                    Significant local knowledge and experi-
                    ence are required to get this right.                           Best practice is for the metadata for each
                                                                                   attribute or group of attributes to in-
                    6. Metadata                                                    clude the types of permissions granted
                                                                                   and the date of the grant. The date is
                    Because GDPR allows individuals to                             critical because permissions can change
                    grant and change permissions for each                          and it is necessary to know the current
                    attribute, it is important that the Golden                     permissions. For example, it is possible
                    Master Record contain additional infor-                        that an individual will grant the use of
                    mation (“metadata”) for each attribute or                      an address for any purpose in January,
                    group of attributes about these permis-                        limit that purpose for credit card noti-
                    sions. (An example of a group of attri-                        fications in March, and then allow it for
                    butes would be a person’s address. If an                       sale notifications in June.

     Global-Z International      |   www.globalz.com         |    t: +1.802.445.1011       |   gdpr_info@globalz.com
As the Golden Master Record is cre-                                    Conclusion
                 ated, it is also best practice to create
                 and maintain a link back to the source                                 To meet European General Data Protec-
                 records. This is especially important as it                            tion Regulation (GDPR) requirements
                 is necessary to change or delete a source                              a customer identity resolution process
                 record when requested.                                                 becomes critical. While there are many
                                                                                        other requirements for GDPR compli-
                 The source databases must be consid-                                   ance, it is necessary to be able to find,
                 ered when building the metadata for the                                edit, and potentially delete any personal
                 Golden Master Record as well. A large                                  data about any EU individual.
                 conglomerate may want to have a Gold-
                 en Master Record that covers the entire                                Creating Golden Master Records with
                 conglomerate. However, an individual                                   links to find the original source records
                 may grant permission to one subsidiary                                 are critical to accomplishing this goal.
                 or brand, but not another subsidiary                                   Deep international experience with an
                 or brand. This may mean that the con-                                  understanding of data in each country
                 glomerate does not have the permission                                 greatly increases the chance of success.
                 to use the attribute in any place other                                If you would like to know more about
                 than where the permission was granted.                                 Golden Master Records, this process or
                 Master record management requires                                      how they would apply in your circum-
                 knowing the source of the permissions                                  stance, please contact Global-Z at
                 and the applicable entity.                                             gdpr_info@globalz.com.


                                                      Copyright 2018 by Global-Z International. All Rights Reserved.
                  This article is for informational purposes only and should not be considered legal advice. You should seek appropriate counsel for
                 your own situation. Global-Z International is not liable for the information provided herein. Global-Z International is not responsible
                    for errors and all information is subject to change without notice. Global-Z and the Global-Z logo are trademarks of Global-Z
                                                International. All other marks are the property of their respective owners.

  Global-Z International     |    www.globalz.com              |     t: +1.802.445.1011            |   gdpr_info@globalz.com
You can also read
Next slide ... Cancel