In addition to copyright laws, it is important to observe the personal data protection laws, GDPR, LGPD and CCPA. In this way, it is mandatory to perform the anonymization of data sets that have personal data processing. I suggest that the InterSystems DPO participate in the application approval process, because InterSystems can be classified as a data processor because it hosts the applications that handle this data.

COS language don't have null type, so null is converted to "". It is possible set a parameter, see: 

parameter %JSONNULL;

If %JSONNULL is true (=1), then unspecified properties are exported as the null value. Otherwise the field corresponding to the property is just skipped during export.

See it: https://community.intersystems.com/post/set-null#comment-138976