Client success: ENGIE’s SAP system becomes compliant with data privacy and GDPR

My name is Ronan Menou, and I'm working for ENGIE Retail France. It's a French utility company. ENGIE France Retail is really focusing on delivering supply of energy for electricity and gas and services towards their ten million customers and plus, we are having something like around seven thousand end-users in our system. So it's one of the biggest CRM and IS-U systems in Europe. We started the journey something 2019, if I remember correctly by implementing the Data Retain and Data Redact solutions; because the thing that, as you know, privacy is one of the key topics that needs to be addressed from the different companies to really keeping the data inside your company, completely closed and really forgetting the data from the past. It's really important for ENGIE. In Production, so it anonymized completely the data from all customers like prospects or customers that are no longer with us. So that's a huge number of data because the market is moving fast. As part of the regulation, we need to get rid of this information, personal information. And for the non-production of data, we need to randomize them in order to make sure that if there are leaks, that we are not spreading out the information of real customers throughout the world. So that's why the complexity of the implementation of GDPR is not only about anonymizing the system, but also archiving a lot of data that is present in the system because we have a huge system of 80TB, with 60TB on the SAP IS-U system and 20TB on the SAP CRM system. Our system is fifteen years old, so that means that a lot of things happened during those fifteen years, so you need to go back and look at your data. And secondly, in terms of performance, we had a lot of discussion with EPI-USE. And of course, it was implemented correctly at the right moment at the right time according to what the regulator was asking us.

ENGIE’s data privacy and security challenges

Utilities giant ENGIE’s SAP IS-U system contains the data of millions of clients; and an important part of their strategy is ensuring they are compliant with data privacy regulations. As many of their clients are located in Europe, this includes compliance with the GDPR (the European Union’s General Data Protection Regulation).

During an audit of ENGIE’s assets by CNIL (Commission nationale de l’informatique et des libertés – the French National Regulator for GDPR), ENGIE’s major residential customer platform was reviewed. To meet required anonymisation criteria, ENGIE had to prioritise their Production data, followed by non-production data, in line with the recommendations from CNIL’s evaluations. ENGIE’s first step was to identify and analyse the Personally Identifiable Information (PII) in their 15-year-old 80TB SAP system. They had to remove Production data, and anonymise non-production data.

Implementing the Data Privacy Suite for SAP solutions

ENGIE and EPI-USE Labs worked together to address ENGIE’s data privacy compliance, including implementing EPI-USE Labs’ Data Privacy Suite for SAP solutions.

Technical workshops helped to identify which data needed to be addressed. As EPI-USE Labs has mapped the SAP data model for Utilities, this make it quicker to identify which data is personal, and which is not (for example, the field for BP name is personal data, and the POD number is not, whereas meter reading results are).

EPI-USE Labs implemented three components of the Data Privacy software suite:

Data Secure™: With Data Secure, ENGIE was able to anonymise all the personal and sensitive data in their non-production system, and thus reduce the risks
Data Redact™: To address the challenge of the ‘Right to be Forgotten’ principle as outlined in the GDPR, EPI-USE Labs redacted field data from the Production system, without removing any transactions or business data. This was done quickly and seamlessly without affecting referential integrity
Data Retain™: Using Data Retain, EPI-USE Labs was able to proactively highlight sensitive data suggested for redaction based on pre-determined flexible business rules.

Compliance with GDPR

After working closely with the EPI-USE Labs technical specialists, ENGIE managed to address all their project needs. Having implemented Data Secure, Data Retain and Data Redact, they were able to anonymise the sensitive and personal data within their non-production system, ensuring compliance with the GDPR. They could also redact data from their Production system to adhere to the GDPR’s ‘Right to be Forgotten’ where applicable.

These actions not only secured their critical information, and the safety of their client’s data, but significantly mitigated risks to the system.

About ENGIE

ENGIE is a global benchmark group in low-carbon energy and services. With their 96,000 employees, customers, partners, and stakeholders, they are committed every day to accelerate the transition to a carbon-neutral world, through reduced energy consumption and more environmentally friendly solutions. Inspired by their purpose, they combine economic performance and positive impact on people and the planet by relying on their key business (gas, renewable energies, services) to offer competitive solutions to their customers.