Legal, Security, and Data Storage

GDPR—Best Practices for Memsource Users (Project Managers)

With the introduction of GDPR on 25 May 2018, users asked us for guidance on how to use Memsource and Memsource Editor in a way that will be GDPR-compliant.

In this document, we explain how the key concepts of GDPR apply to the way in which you use Memsource and how you can comply with the rights of data subjects defined by GDPR, for example, the right for rectification and erasure of personal data.

Disclaimer: Although we would like to make sure that this document provides useful information for our users, it cannot be assumed to constitute any legal advice.

Introduction

GDPR defines the data privacy rights of individuals within the EU. It gives individuals the right to access and control the use of any of their personal data that could be used to identify them. GDPR should therefore not be understood as a regulation that deals with the protection of confidential data, for example, financial or business-related data, but strictly as a law addressing the processing of data from which the data holder will be able to directly or indirectly identify specific individuals. 

GDPR defines the following key concepts:

  • Data subjects: In the context of your use of Memsource, this would include two areas (a) data about individuals contained in the translated content, typically the identification of a person in a contract or an official document, and (b) data about people working within Memsource—administrators, project managers and linguists—translators.  
  • Data controllers: As a customer of Memsource, you most often act as a data controller of personal data required to create and configure user accounts in Memsource.
  • Data processors: As a customer of Memsource, you most often act as a data processor of the personal data contained in the translated documents, translation memories, term bases and reference files—all the content you are asked to translate on behalf of your customers.

Data Processing

As explained in the first bullet point above, content and data stored in Memsource can be divided into two areas:

  • Translated content

Translated content is stored in project files, i.e. the original files, the completed translations, reference files and bilingual MXLIFF, DOCX and TMX files used for the actual translation in native Memsource Editor and externally.

Translation memories, i.e. databases containing the translated content as pairs of originals and translations, with metadata referring to who translated or revised each segment and when.

Term bases, i.e. glossaries of terms, usually created manually during the translation process and not likely to contain any personal data.

  • Identification of Memsource users

In Memsource, all users are identified by a unique ID, username, first name, last name, and email address. The ID is the only part that remains constant, while the rest of the identifiers can be changed anytime if needed.

Note on machine translation: Machine translation is another type of “resource” supporting translators in their work, in addition to translation memories and term bases. Memsource does not provide machine translation on its own but instead enables users to connect to various MT service providers from within their Memsource account. This means, therefore, it is your responsibility to make sure that your MT solution is GDPR compliant, for example when it comes to storing customer content submitted for translation and used for the engine training. The role of Memsource is to send content for translation to the MT provider of your choice, and then receive and display the results.

Best Practices for Personal Data Protection

As data controllers and/or data processors, you should understand that personal data contained in the content imported for translation in Memsource will be stored in the project files and translation memories as described in Art. 2 (a) above.

Projects are subject to project life rules defined in our Data Storage Policy. Projects and project files are automatically deleted after 12 months. In addition, they can be deleted earlier by project managers. If deleted manually, they will be moved into a recycle bin for 30 days before being deleted permanently.

Translation memories are not subject to any automatic deletion, except if an account expires and is not renewed within 6 months, in which case Memsource deletes all account content. After they are deleted, translation memories are also moved to a recycle bin for 30 days before being erased permanently.

 

Anonymization and Pseudonymization—Best Practice to Prevent Storage of Personal Data

If you or your customers are concerned about the processing and storage of their personal data in Memsource projects, project files, and translation memories, the best advice Memsource can give is to erase any personal data from the original documents before they are actually processed in Memsource.

There are two ways in which this can be done—anonymization and pseudonymization.

A document will be anonymized if all personal data are replaced with, for example,  a [●] character and there is no way to restore the original personal data replaced. On the other hand, a document will be considered pseudonymized if personal data are replaced with placeholders, such as {1}, {2}, {3}, {4}, and there is a separate database which enables the mapping of such placeholders to the corresponding data and the restoration of the personal data back to the document once it is translated.

Rights of Data Subjects

Data subjects may at any time request that their personal data are listed, edited, or erased. In the context of Memsource, the following scenarios are likely to occur:

  • Your customer asks you to erase or rectify their personal data

Project Files

As “client” is one of the metadata available for the identification of projects, it should be fairly easy to get a list of projects relating to the customer in question, using the search bar at the top of your project list page.

You can then access each project, delete the file or files in question, fix the original, and then reimport the new version into Memsource for processing if needed.

GDPR1.png

Translation Memories

Translation memories include a search function:

GDPR2.png

With this, you can search for any content, modify it (double click inside the text box), or delete whole translation units.

Also, there is a tooltip available from the “i” icon next to the TM result (see screenshot below) which includes the name of the project and the name of the job (file) from which this translation originates. This means you can go to the project or file and handle it as needed (delete, re-import a new anonymized version, etc.).

GDPR3.png

An alternative to modifying the translation memory content manually is exporting your translation memories into TMX and/or MS Excel, modifying them externally, and re-importing the content back to update your translation memories in Memsource.

  • Your translator is concerned about others being able to see their name in translation memory metadata (as the authors of reference translations)

GDPR4.png
If this is the case, the easiest way to solve this is to change the first name, last name, and username in a way that protects the individual’s identity.

Also, Memsource offers an option that enables you to control the visibility of such metadata, so these data can be excluded from the metadata section. 

  • Your translator wishes to stop working with you and asks to be deleted from your system.

If you delete a user from your Users section, you, your project managers, and anyone else using your account will not be able to see that user’s identity anymore. However, the data will remain in the background, accessible by authorized Memsource staff. For a full deletion of the user, please contact the Memsource Support team.

Linguist users should primarily contact the admin/PM of their organization if they wish their user account to be deleted. If such linguists' requests are not fulfilled within a reasonable period of time (approximately two weeks), the linguists in question can contact the Memsource Support team directly and request their deletion by the authorized Memsource staff.

Erasure of Organization Data in General

In accordance with our data storage policy, we will delete all translation memories and term bases from accounts in which the subscription is not renewed for 6 months after their expiry (for paid editions) or which have not been accessed for 6 months (for the free Personal edition). If you wish to have your organization data removed earlier or immediately, please make sure that you delete all your projects, translation memories, and term bases manually, then go to the recycle bin and click Empty Recycle Bin.

You can also contact the Memsource Support team and request the deletion of your organization all data related to it. Before you place your request, please make sure to check that there are no projects/jobs, TMs and TBs shared with or used by any other organizations. After your organization is deleted, these resources will no longer be accessible.