Understanding and benchmarking the impact of GDPR on database systems

Abstract

e General Data Protection Regulation (GDPR) was introduced in Europe to o er new rights and protections to people concerning their personal data. We investigate GDPR from a database systems perspective, translating its legal articles into a set of capabilities and characteristics that compliant systems must support. Our analysis reveals the phenomenon of metadata explosion, wherein large quantities of metadata needs to be stored along with the personal data to satisfy the GDPR requirements. Our analysis also helps us identify the new workloads that must be supported under GDPR. We design and implement an open-source benchmark called GDPRbench that consists of workloads and metrics needed to understand and assess personal-data processing database systems. To gauge how ready the modern database systems are for GDPR, we modify Redis and PostgreSQL to be GDPR compliant. Our evaluations show that this modi cation degrades their performance by up to 5×. Our results also demonstrate that the current database systems are two to four orders of magnitude worse in supporting GDPR workloads compared to traditional workloads (such as YCSB), and also do not scale as the volume of personal data increases. We discuss the real-world implications of these ndings, and identify research challenges towards making GDPR compliance e cient in production environments. We release all of our so ware artifacts and datasets at h p://www.gdprbench.org

A Survey on Edge Performance Benchmarking

“…Benchmarking approaches from other closely related domains, such as cloud computing, can often be adapted or reused for edge environments. For example, there are large numbers of starting points for elastic scalability (38,60,(145)(146)(147)(148), availability (149)(150)(151)(152)(153)(154)(155), data consistency (45,46,144,(156)(157)(158)(159)(160), and security and privacy (54,(161)(162)(163)(164)(165)(166)(167). A more detailed discussion of additional quality dimensions for edge benchmarking is beyond the scope of this paper.…”

From WHOIS to WHOWAS: A Large-Scale Measurement Study of Domain Registration Privacy under the GDPR

“…Some recent works start to rethink the system design in the era of the GDPR or measure the cost of compliance. [92] showed that the performance of a GDPR-compliant database will scale poorly as the volume of personal data increases. Frictions between cloud-scale systems and the GDPR has also been discussed [93].…”

The Impact of Privacy Regulations on DB Systems

“…GDPRBench [Shastri et al 2020] is a benchmark suite built upon YCSB and proposes to evaluate the impacts on performance of making a DBMS GDPR compliant. Without any major changes, aiming only to evaluate the impact of fulfilling the requirements, modifications were made to Redis, a key-value storage and PostgreSQL, a relational DBMS.…”

“…GDPR Compliance by construction [Schwarzkopf et al 2019] provides the removal of a user shard as a solution for the delete guarantee, however, while it highlights that the underlying views must be aware of this removal, it does not discuss a mechanism ensuring this awareness. GDPRBench [Shastri et al 2020] evaluates this impact by adding a time-to-live attribute to data, and using a daemon or adding this functionality to the DBMS to periodically probe the data in search of TTL violations, as well as deleting them when needed. [Kraska et al 2019] point out that when an entry is deleted in their system, the surrogate keys become dangling, rendering data access impossible.…”

“…Other cited works also have solutions for this component, be them explicit, such as Sypse [Deshpande 2021] personal information partition, or implicit, like SchengenDB [Kraska et al 2019] and GDPRBench [Shastri et al 2020], which embed the information within data. Although there is not a clear separation of user related data, it is retrievable through its unique identifiers.…”