The Privacy Management project, also known as the GDPR project, began in 2017 and went live in 2018. It uses a system called Prima to deliver and save consents given by users, or default consents when no active consent can be found. The project follows the principles of the GDPR law and stores information such as the user’s choice (opt-in/opt-out), the length of time the consent is active, and the type of consent. Additionally, an event mechanism is in place to inform consumers within the company of changes to consents, and a subscription system allows clients to manage which updates they receive. The project must keep consents for at least 5 years and a future project will enable the deletion of expired consents. A business rule engine also allows frontend applications to check if they can request consent from customers. Future plans include splitting the application into smaller microservices for better management.

Rights Management is a tool designed to act as the Policy Evaluation Endpoint (PEP) for all APIs. When an application calls an API, it will first go through a gateway. The gateway will check for the credentials of the call, and if found, it will send a request to the PEP containing the credentials, the API being called, and context information. The PEP will then validate the credentials and check if the calling party has access to the API. If accepted, the gateway will let the call proceed and add a user propagation token (UPT) to the call. The project consists of multiple microservices, one of which is a UI for managing data used by the PEP, another is for syncing OAuth clients to the authentication server. The future of the project is to industrialize it on a companywide level, which may involve refactoring to use a standardized information model.