Understanding and Benchmarking the Impact of GDPR on Database Systems

TL;DR

This paper analyzes GDPR's impact on database systems, introduces GDPRbench for benchmarking compliance, and evaluates the performance of modified systems, revealing significant scalability and performance challenges.

Contribution

It provides a systematic translation of GDPR requirements into database capabilities, introduces GDPRbench benchmark, and assesses real-world system performance under GDPR constraints.

Findings

Metadata explosion significantly affects storage requirements.

GDPR-compliant systems show poor performance on workloads.

Performance degrades as personal data volume increases.

Abstract

The General Data Protection Regulation (GDPR) provides new rights and protections to European people concerning their personal data. We analyze GDPR from a systems perspective, translating its legal articles into a set of capabilities and characteristics that compliant systems must support. Our analysis reveals the phenomenon of metadata explosion, wherein large quantities of metadata needs to be stored along with the personal data to satisfy the GDPR requirements. Our analysis also helps us identify new workloads that must be supported under GDPR. We design and implement an open-source benchmark called GDPRbench that consists of workloads and metrics needed to understand and assess personal-data processing database systems. To gauge the readiness of modern database systems for GDPR, we follow best practices and developer recommendations to modify Redis, PostgreSQL, and a commercial database system to be GDPR compliant. Our experiments demonstrate that the resulting GDPR compliant systems achieve poor performance on GPDR workloads, and that performance scales poorly as the volume of personal data increases. We discuss the real-world implications of these findings, and identify research challenges towards making GDPR compliance efficient in production environments. We release all of our software artifacts and datasets at http://www.gdprbench.org