Collection of personal data in application server logs

Personal information, such as user names or IP addresses, may be recorded in log files created by WFM. Data controllers must consider the logs produced by WFM when developing policies and processes to meet GDPR requirements for data collection, consent, access restriction, and timely erasure. Tools and processes used to archive or backup server logs must also be considered with these requirements in mind. Information stored in log files cannot be erased or anonymized by the data erasure tool. This makes it critical to clearly understand and document which personal information is stored in log files and the policies for storing and retaining log files.

These WFM logs record personal information that could identify users of the application when combined with information stored in the WFM database. The error log records the identities of users that encounter errors using WBU_NAME from the WORKBRAIN_USER table. The audit log, which is disabled by default, records the identities of users that are members of the SYSTEM ADMIN security group or that perform actions on admin maintenance forms. The identity values recorded by the audit log come from WBU_IDENTITY2 from the WORKBRAIN_USER table in Infor OS Portal or Infor Ming.le environments.

In non-Infor OS Portal or Infor Ming.le environments, users are identified using WBU_NAME. Additional logs that are created by other WFM components, such as the job scheduler and the platform software used to host the WFM application and data, may include IP addresses or other personal data.

See the Infor Workforce Management Installation and Configuration Guide for more details on configuring application logs.

In general, logs should record the minimum amount of data required to allow debugging and satisfy auditing and other legal requirements. When the information collected in a log does not satisfy these requirements, it is recommended to disable the collection of the log altogether. Self-hosted customers can directly enable or disable the logs recorded by WFM and the application platform. Cloud customers may contact Infor support for configuration help or information on the logs recorded in your deployment.