We’ve received feedback on last week’s post about backing up and archiving Slack and other web-based tool interactions, files, and metadata. First and foremost - this is NOT legal advice, NOT regulatory compliance advice, NOR any complete recommendations – SEE YOUR LEGAL DEPARTMENT. To lots of comments:
Yes, it is also important (with shared permissions, channels, and other stored elements) for Slack to backup the ‘metadata’ (who’s permitted, when things were set up, was the backup a full backup, etc) that applies to all of the events. For Slack, unless you have ‘Corporate Backup’ status (and even then some metadata on shared files/linked files isn’t backed up) you won’t be able to do a full backup. Some metadata your enterprise legal may require may not be in these backups. (Check with Legal!)
The CCPA (California Consumer Privacy Act) has specific provisions relevant to California related consumers, customers, and data owners. For example, if you are using Slack, have you reviewed and determined if you need to execute the “U.S. Specific Data Processing Addendum Form”? At this writing, this is a 19-page form that is non-negotiable in normal situations.
The GDPR (General Data Protection Regulation) is the EU directive that governs online data in many situations. There are specific rules and provisions that affect public, private channel, and other archival/permanent storage. For Slack, current provisions list Ireland as the contact address outside the US and Canada, but BREXIT may change the legal status of how these rules and provisions are applied for UK customers.
In addition to the external legal, regulatory, and insurance rules that must be followed each enterprise IT, or legally responsible end-user group that initiated use, must have process & named people who can administrate certain functions. In many cases, such as Slack, the “Workspace Owner” or “Admins” are necessary to request/process certain types of requests (such as to have particular backup, delete profiles, or other functions). As many people set up these workspaces with ‘click-thru’ acceptance of Terms and Conditions there can be problems (such as what happens when the email that established and administers a workspace belongs to someone who departs). Setup your rules and name people TODAY if you are using these tools, and make sure that there are backups procedures in case of personnel changes.
Is it really this complicated to use a ‘free’ / ‘freemium’ tool? YES! The same kinds of actions need to be applied to Slack competitors: Microsoft Teams, Chanty, Fleep, Flock, Ryver, Glip, Hangouts, and more – and remember these rules also apply in different ways if you ‘self-host’ FOSS in your own inhouse platforms.
Comments