On this page (6)
Access to data in the entry log is decided by two independent things: permission and visibility scope. A permission says what a user can do: open the log, issue a pass, download a report. The scope says whose data they see while doing it: the whole site, one location, one organisation. Mixing up these two concepts is the most common reason why someone sees data they should not, even though the permissions were granted sensibly.
Why a permission on its own is not enough
A security officer at the gate needs the answer to one question to do the job: may this vehicle come in now? So they are given permission to use the entry log, because without it they cannot do their work.
The permission on its own, however, says nothing about how much they get to see. Without a scope restriction, the same officer can:
- look through the visit history of any driver going back a year,
- download a report of all entries to all locations,
- see the document scans collected at registration.
None of these is needed to raise the barrier, and every one of them is processing of personal data that goes beyond its purpose.
Who sees what: the gate, management and administration
Security at the gate sees what concerns the visit in progress: who has arrived, whether they have a booking and whether there are any warnings. They do not see the history and do not download summary reports.
The site manager and the logistics manager see reports and history within their area of responsibility. They need aggregated data, without document scans.
Administration, meaning IT and the data protection officer, sees the configuration, the audit trail and who accessed the data. This layer is the one most often forgotten, and without it there is no way to answer the question ‘who looked at this driver’s data?’, which comes up in every incident.
Access audit: who saw a driver’s data
The audit log answers the question of who saw a driver’s data. Before implementation the conversation is about who can see it; after the first incident the question becomes who did see it. Without an audit trail, the only answer is a list of people who could in theory have done so, and an answer like that gets you nowhere.
An example split of roles and scopes
| Role | Permission | Scope |
|---|---|---|
| Security at the gate | entry log, gate operation | current visits, no history or reports |
| Site manager | entry log, reports | the whole site |
| Logistics manager | bookings, traffic reports | own area |
| Tenant in a logistics park | entry log, reports | own organisation only |
| Data protection officer | audit, retention | configuration, with no need to see the content |
The split of roles and scopes has to be configured, because the default settings do not include it. Scopes are set when the roles are created and checked at acceptance, ideally by logging in to a test account for each role and looking at the system through its eyes. Mistakes show up on the user’s screen; reviewing the list of permissions in the configuration will not catch them.
Decisions that belong to the data controller
TraxSystem does not decide who should have which scope. That is the data controller’s decision, following from the purposes of processing and the structure of the organisation, and the system reflects it.
The system does not make you GDPR compliant on its own. It provides the mechanisms needed for compliance: roles, scopes, an audit trail, retention and anonymisation, while the policy belongs to the controller. Nor does it keep the record of processing activities or generate GDPR documentation.
The system mechanisms described here are not legal advice. Confirm the split of roles with your data protection officer.
Questions and answers
How many permissions are there to divide up?
217 permissions in 24 groups. They are granted to roles, not to individuals, and they are deliberately fine-grained, so you can give access to the log without access to the scans.
Can the scope be limited to one location?
Yes. Filtering data by the scope that comes with the role also applies to reports, so a user with a local scope downloads a report that is narrowed automatically, without having to remember to do it.
Will a security officer see that a driver has a warning?
Yes, because it is information they need for the job. Neither a warning nor a ban blocks the barrier on its own, though: the system shows the information and the operator makes the decision.
See also: Driver data at the gatehouse: how long to keep it and what to delete · A logistics park with tenants: how to separate traffic and data between companies · A site ban for a driver: how to actually enforce it