The EU has always undertaken to create wide legal coverage for member country citizens and also to amalgamate the laws in which they operate under whenever commonage is found. In the online world, there have been many aspects that have expanded over time and with that the need to expand the laws which encompass them have been created. Broadly speaking, data privacy in the EU is covered under the General Data Protection Regulation and the ePrivacy Regulation. Understanding the differences between the GDPR and the ePrivacy regulation is important to businesses and consumers alike. The following is an explanation of what each regulation covers and an identification of the main differences between them. The aim of the regulation is to align the online standard of privacy with the level that is covered under the GDPR. The same authority is responsible for the GDPR as is responsible for the ePrivacy regulations.
The European Union ePrivacy regulation has been published to broaden the scope of the current ePrivacy Directive and align the various online privacy rules that exist across EU member states. The regulation takes on board all definitions of privacy and data that were introduced within the General Data Protection Regulations, and acts to clarify and enhance it. In particular, the areas of unsolicited marketing, Cookies and Confidentiality are covered in a more specific context.
The regulations now include any type of communications, including emails and text messages, to be consented to before being used. Marketers will not be able to send emails or text without prior permission from each email or mobile account holder.
Cookies will now be tracked within software and the user's browser within settings that each user can change to their needs. This will do away with the litany of banner pop ups that request consent for use of cookies on individual websites. This changes previous regulations which made each website request the ability to use cookies from each user.
Since the ePrivacy regulations are an add on to the existing ePrivacy directive, one aim was to broaden the scope to include online communications providers under the same requirements as traditional telecommunications providers. In this regard, companies including Gmail, Skype, Facebook Messenger and WhatsApp are now required to provide the same level of customer data safety as bricks and mortar providers. Providers of any electronic communication service are required to secure all communications through the best available techniques. This creates a need for websites to stay technologically in sync with the best safety features available on the market.
The new provisions create the necessity for metadata to be treated the same as the actual content of the communication that it is facilitating being sent. It prohibits the interception of any such communication except where authorized by an EU member state specifically under law (such as within a criminal investigation).
The General Data Protection Regulation (GDPR) was created to align the data privacy laws across all EU countries. The GDPR came into effect in replaces the Data Protection Directive 95/46/EC. A major update within the GDPR is that the processing of any EU citizens information is now protected, regardless of whether the information processing is done within the EU or not, and regardless of where the retailer originates from. Any retailer around the globe that sells to an EU citizen is bound by law to protect their private data.
The idea of traffic data has been expanded in the GDPR to include all metadata that derives as a result of the communications. The GDPR also strengthens the area of consent to how a user's personal information can be used or whether it can be shared. It also makes it easy for users to access their personal data and a requirement for all businesses and websites that take any information from any user to maintain the information and make it available to the user if requested.
An important "right to be forgotten" is regulated for under the GDPR and a right to data portability.
Under the GDPR, individuals have:
The right to access –this means that individuals have the right to request access to their personal data and to ask how their data is used by the company after it has been gathered. The company must provide a copy of the personal data, free of charge and in electronic format if requested.
The right to be forgotten – if consumers are no longer customers, or if they withdraw their consent from a company to use their personal data, then they have the right to have their data deleted.
The right to data portability – Individuals have a right to transfer their data from one service provider to another. And it must happen in a commonly used and machine readable format.
The right to be informed – this covers any gathering of data by companies, and individuals must be informed before data is gathered. Consumers have to opt in for their data to be gathered, and consent must be freely given rather than implied.
The right to have information corrected – this ensures that individuals can have their data updated if it is out of date or incomplete or incorrect.
The right to restrict processing – Individuals can request that their data is not used for processing. Their record can remain in place, but not be used.
The right to object – this includes the right of individuals to stop the processing of their data for direct marketing. There are no exemptions to this rule, and any processing must stop as soon as the request is received. In addition, this right must be made clear to individuals at the very start of any communication.
The right to be notified – If there has been a data breach which compromises an individual's personal data, the individual has a right to be informed within 72 hours of first having become aware of the breach.
The GDPR is the EU's way of giving individuals, prospects, customers, contractors and employees more power over their data and less power to the organizations that collect and use such data for monetary gain.
Each regulation was drawn up to reflect a different segment of EU law. The GDPR was created to enshrine Article 8 of the European Charter of Human Rights in terms of protecting personal data, while the ePrivacy regulation was created to enshrine Article 7 of the charter in respect to a person's private life. The private sphere of the end user is covered under the ePrivacy regulations, making it a requirement for a user's privacy to be protected at every stage of every online interaction.
It is important to remember that the ePrivacy regulation was created to complement and particularize the GDPR, so the rules of the GDPR are always relevant and an overall part of the legislative aspects of the ePrivacy.
The ePrivacy directive takes the broad online retail sector into account in terms of how personal information might be used and in this sense is what it adds to the overall regulations that make up the GDRP.
Treat personally identifiable data like kryptonite under GDPR.
The previous privacy regime defined personal data as name, picture, email address, phone number, physical address or personal ID numbers, like a bank account number or social security number.
But GDPR broadens the definition to include "identified" and "identifiable" data. That means personal data is now any information that could be used to identify a person, including location data, mobile device IDs and, in some cases, IP address. (Biometric and genetic data is considered to be "sensitive personal data").
Pseudonymous data, which is personal data that's been hashed, encrypted or anonymized in some way using a technological method, is a potential compliance tripwire. Data that can be re-identified with reasonable effort by combining it with additional data points is also considered personal data.
Personal Data | Special Categories of Personal Data |
---|---|
Name | Race |
Address | Religion |
Email address | Political opinions |
Photo | Trade union membership |
IP address | Sexual orientation |
Location data | Health information |
Online behaviour (cookies) | Biometric data |
Profiling and analytics data | Genetic data |
The previous Data Protection Directive already gave EU citizens the right to ask a company to delete their data if it's being processed unlawfully or is no longer needed for its original purpose.
GDPR expands the right of erasure, also known as the right to be forgotten, by requiring data controllers to take reasonable steps to ensure that the data is also deleted by any third parties it's been shared with.
Data subjects will also have the right to data portability between online platforms; the right to not be subjected to automated data processing, such as profiling; and the right to obtain a copy of their processed personal data for free and in electronic form upon request, including where it's being used and for what purpose.
Data controllers and any subcontractors must maintain written records of their data processing activities, including why they're processing the data and how long they plan to keep it. This information must be made available to data protection authorities upon request.
Although GDPR doesn't address accountability in practical detail, data controllers must clearly document all of the actions they're taking to comply. GDPR calls this "data protection by design and by default". If regulators ask for proof of compliance, companies must be able to easily supply it.
Organizations whose core activities involve systematic data monitoring or processing of people on a large-scale – like hospitals, insurance companies and banks – must appoint a DPO. How broadly "systematic monitoring or processing will be interpreted under the law remains an open question.
The DPO is meant to help companies comply with GDPR, reporting directly to the C-suite while remaining fully autonomous. Some ad industry insiders believe having a DPO is also a show of good faith that may keep the regulators at bay.
GDPR infractions come with significant penalties of up to 20 million euros or 4% of global annual turnover for the previous year, whichever is greater – per violation.
Supervisory authorities can consider mitigating factors when setting a fine. A company that makes an effort to comply and reports any violation as soon as possible will likely be punished less harshly than willful violations.
Regardless, the possible size of these fines could mean curtains for smaller companies, and there's no small irony in that.
Either they'll go out of business, or they'll get gobbled up. We'll end up with a cleaner ecosystem but also less competition. Facebook and Google, which are under so much scrutiny by the European Commission, could actually win by accident.
The GDPR is a really great thing when you look at it from the perspective of the users. When a user signs up for a free or paid service, for an app or else, and provides their personal data, the provider of the service has to notify them explicitly how their personal data will be used before they complete the registration. Whether that use is for marketing and profiling, or if there is a possibility of the data to be subject of sale or transfer to third-parties, it has to be explicitly stated in advance. Users will be able to say NO to certain types of usage and will have to give consent - opt in - to the Terms of Service and Privacy Policy of the provider, thus making an informed choice. So, big win for the users - more control over their data, less invasion of their privacy, less spam and less intrusive advertising overall!
The GDPR by design has been aiming to regulate activities of the big companies like Google and Facebook that process insane amounts of personal data and are using it to generate significant gains, but at the end of the day it affects everyone - every small business that works with any personal data. Even if a company uses data in a completely legitimate way, the new regulation requires specific modifications like rewording its Privacy policy to state explicitly what kind of usage there is, making automations in how the user can access their personal data, and more. Unfortunately, this effort to comply comes costly in both legal fees, time and deviations from standard business operations so one can focus on the GDPR with high priority.
GDPR establishes different rules for data controllers and data processors.
Data controllers determine why and how personal data may be processed, and are required to establish a legal basis for processing data. The law states that data processors process personal data on behalf of the controllers.
Processors must do their processing legally and responsibly, and controllers must ensure that their processors are doing a proper job.
Although the rules governing controllers are more stringent, both controllers and processors are on the hook under GDPR. Unlike the previous privacy regime, processors are subject to enforcement actions and could be liable for big penalties if they don't comply.
Companies can process data if they have a legal basis for doing so. Insurance companies, for instance, have to process customer data in order to carry out the terms of a contract. Banks have to process data to comply with the law.
But there are two legal bases that marketers should know: legitimate interest and consent.
Companies that are able to demonstrate a "legitimate interest" can in certain cases lawfully process personal data without consent: if the data was collected legally, if there is a justifiable reason for its use and if the processing was done responsibly.
Establishing legitimate interest requires the data controller to conduct an exercise called the "balancing test", in which it weighs its own interests against the rights of the data subject, including the individual's reasonable expectations about how his or her data is processed and whether the controller has the right safeguards in place.
Examples of legitimate interest include crime prevention, fraud detection, cybersecurity, conducting employee background checks and the like. "Direct marketing" is also specifically called out within GDPR as a legitimate use of personal data, but with certain caveats.
Personalized communications, targeted advertising, aggregating analytics to create trend reports and track ad performance, post-click tracking and audience measurement are all potentially okay under GDPR, as long as the controller ensures that users can easily opt out at any time.
Consent has always been a cornerstone of European privacy law, but GDPR raises the bar considerably.
Data controllers – the parties that decide how personal data is used – must get "unambiguous" consent for each purpose they plan to use the data for. In other words, a company can't get consent to do one thing and then turn around and use that data for something else.
Consent must be freely given and specific.
Opt-out models (aka pre-checked boxes) will not fly. Neither will what's known as an informed consent model, which is when a site loads tracking cookies at the same time as the page loads along with a brief notice, usually in pop-up form, alerting the visitor that the site uses cookies. Barrier pages, where content is blocked until a user agrees to enable tracking, won't work either.
The bottom line is that a consumer's action must be both affirmative and informed. The data protection authorities in the UK, France and Germany all agree that consumers can signal consent to processing by ticking a box on a website, but only if they've been shown a clear notice with straightforward language beforehand.
Evidon is taking a different tack via a universal consent platform for GDPR compliance that claims to provide consumers with an ability to opt in to data collection, get visibility into what's being collected and modify what's being tracked.
But not everyone's convinced that middlemen can thrive under GDPR.
The third-party ecosystem is not going to hold up in a GDPR world. GDPR is about first-party relationships.
Marketers and publishers are potentially accountable for mistakes made by third parties, which means they're about to get a heck of a lot more choosy about who they work with. GDPR therefore ups the ante on the importance of due diligence and vendor management.
And consent is not the silver bullet for GDPR compliance. Having obtained it, you have to make sure nobody in the chain who might get data you share will misuse it and expose you to legal hazard.
The Regulation includes provisions that promote accountability, so the DPC advises organisations to make an inventory of all the personal data they hold and examine it under the following questions:
Why are you holding it?
How did you obtain it?
Why was it originally gathered?
How long will you retain it?
How secure is it, both in terms of encryption and accessibility?
Do you ever share it with third parties, and on what basis might you do so?
Although GDPR gets all the headlines, ePrivacy, aka the Cookie Directive, is potentially more impactful for marketers. In broad strokes, GDPR deals with the handling of personal data, and ePrivacy covers privacy as it relates to electronic communications.
If you've visited a European website and been served a pop-up banner warning you that by visiting this site, you accept the use of cookies, then you've experienced ePrivacy in action.
That's been the norm since 2002, when the directive was passed. But soon basic cookie notices aren't going to cut it.
European regulators are updating ePrivacy to make it more consistent with GDPR and simplify cookie compliance, which has devolved into a deluge of consent requests. Regulators hope to finalize ePrivacy and bring it into force by May to coincide with the official rollout of GDPR.
However, if both ePrivacy and GDPR include statutes to handle the same situation, then the ePrivacy rules prevail. And therein lies the rub: The ePrivacy draft currently under review doesn't include legitimate interest as a legal basis for processing, which leaves consent as the only likely legal basis for marketers processing data come May. (The performance of a contract could possibly work as a legal basis in certain situations.)
It's highly unlikely that the revamped ePrivacy rules will be approved by May – it took four years to pass GDPR, and the ePrivacy draft has only been under review since January – and that's creating uncertainty.
We need to make sure that the Cookie Law allows for legitimate interest and doesn't disrupt innovation, but there's still a gray area in terms of how ePrivacy is going to work and how Europe will operate under the ePrivacy Directive if the ePrivacy Regulation doesn't come into force when GDPR does.
Especially considering the potential penalty for noncompliance. The fines laid out in the draft ePrivacy regs hew closely to those within GDPR: up to 20 million euros or 4% of global annual turnover.
At the top of the list of wrongheaded GDPR ideas: Companies that aren't in Europe don't have to worry about GDPR.
Not true. GDPR has jurisdiction over the personal data of EU citizens, regardless of where it's processed.
GDPR may have been born in the EU, but it applies to any company in the world that targets its services at a European audience, that collects personal data in a meaningful way or that regularly monitors information about Europeans. That's a big change compared to the previous regime, where you had to be present on the ground in order to be subject to a data protection directive.
They're not being proactive, and that's a bad business strategy, especially when publishers and brands are already having conversations with their digital supply chains and modifying their agreements to indemnify themselves in case they're penalized due to the third party's transgression.
But companies are starting to get the hint. According to a joint annual governance report released by the International Association of Privacy Professionals and Ernst & Young in October, 95% of respondents – 75% of which are located outside of the EU – believe that GDPR applies to them, and 50% of US firms say GDPR compliance is driving their privacy program.
Based on how standard operations are organized, EU users' data may be transferred to and processed by our US entity as well, for example you may choose to host your site in our US data centers. In accordance with the GDPR, we need to ensure that our US entity offers the same level of protection of the EU data, as guaranteed in the GDPR, even though it is subject to the US jurisdiction. The way we regulate this is through Standard Contractual Clauses*, which will be included in all contracts between our entities to guarantee the transfer of data is compliant with the GDPR requirements.
Additionally, we are working on a certification under the EU-US and Swiss-US Privacy Shield with the Department of Commerce that we adhere to the Privacy Shield Principles regarding the collection, use, and retention of personal information from European Union member countries and Switzerland, respectively, so we can lawfully host EU user' data on our US servers when that's needed. We are moving it forward as a second-tier compliance mechanism after the Standard Contractual Clauses.
The Privacy Shield is the EU-US data transfer agreement that replaced Safe Harbor. It passed its first annual review in mid-October, which means European officials believe it provides an adequate level of cross-border data protection. Self-certifying under Privacy Shield before May 2018 is one way for US companies to ensure they have a valid mechanism to transfer personal data between the EU and the US.
By the same token, Privacy Shield only applies to international data transfers and doesn't ensure compliance with other key tenets of GDPR, including obtaining consent, conducting privacy impact assessments and appointing a data protection officer, among other provisions.
*The Standard Contractual Clauses are standard terms provided by the European Commission that can be used to transfer data outside the European Economic Area in a compliant manner.
This new data protection regulation puts the consumer in the driver's seat, and the task of complying with this regulation falls upon businesses and organizations.
In short, the GDPR applies to all businesses and organizations established in the EU, regardless of whether the data processing takes place in the EU or not. Even non-EU established organizations will be subject to GDPR. If your business offers goods and/ or services to citizens in the EU, then it's subject to GDPR.
All organizations and companies that work with personal data should appoint a data protection officer or data controller who is in charge of GDPR compliance.
There are tough penalties for those companies and organizations who don't comply with GDPR fines of up to 4% of annual global revenue or 20 million Euros, whichever is greater.
Many people might think that the GDPR is just an IT issue, but that is the furthest from the truth. It has broad-sweeping implications for the whole company, including the way companies handle marketing and sales activities.
The conditions for obtaining consent are stricter under GDPR requirements as the individual must have the right to withdraw consent at any time and there is a presumption that consent will not be valid unless separate consents are obtained for different processing activities.
This means you have to be able to prove that the individual agreed to a certain action, to receive a newsletter for instance. It is not allowed to assume or add a disclaimer, and providing an opt-out option is not enough.
GDPR changes a lot of things for companies such as the way your sales teams prospect or the way that marketing activities are managed. Companies have had to review business processes, applications and forms to be compliant with double opt-in rules and email marketing best practices. In order to sign up for communications, prospects will have to fill out a form or tick a box and then confirm it was their actions in a further email.
Organizations must prove that consent was given in a case where an individual objects to receiving the communication. This means that any data held, must have an audit trail that is time stamped and reporting information that details what the contact opted into and how.
If you purchase marketing lists, you are still responsible for getting the proper consent information, even if a vendor or outsourced partner was responsible for gathering the data.
In the B2B world, sales people meet potential customers at a trade show, they exchange business cards, and when they come back to the office, they add the contacts to the company's mailing list. In 2018, this is not possible anymore.
Companies will have to look at new ways of collecting customer information.
A key component of the GDPR legislation is privacy by design.
Privacy by design requires that all departments in a company look closely at their data and how they handle it. There are many things a company has to do in order to be compliant with GDPR. If you have yet to to take the next step towards compliance, here are just a few ways to get started.
Map where all of the personal data in your entire business comes from and document what you do with the data. Identify where the data resides, who can access it and if there are any risks to the data. This is not only important for GDPR, but will help improve Customer Relationship Management.
Don't keep more information than necessary and remove any data that isn't used. If your business collects a lot of data without any real benefit, you won't be able to do this in a GDPR world. GDPR will encourage a more disciplined treatment of personal data.
In the clean-up process, ask yourself:
Why exactly are we archiving this data instead of just erasing it?
Why are we saving all this data?
What are we trying to achieve by collecting all these categories of personal information?
Is the financial gain of deleting this information greater than encrypting it?
Develop and implement safeguards throughout your infrastructure to help contain any data breaches. This means putting security measures in place to guard against data breaches, and taking quick action to notify individuals and authorities in the event a breach does occur.
Make sure to check with your suppliers also. Outsourcing doesn't exempt you from being liable. You need to make sure that they have the right security measures in place also.
One of the biggest challenges that the GDPR presents to organisations is its data breach notification requirements. Organisations must report data breaches to their supervisory authority within 72 hours of discovery, and provide them with as much detail as possible.
Whilst there is no specific requirement under GDPR to install a SSL certificate on your website, it is good practice to do so. Including a SSL certificate on your website ensures that the browser no longer displays a 'this website is not secure' message and any data submitted into a web form is encrypted as it is being sent to the server, protecting the individuals personal data during transmission. Under GDPR you have an obligation to store the individual's personal data securely and the method in which the data is inputted is the first step in this process. So, whilst GDPR doesn't expressly require you to install an SSL, we strongly recommend that you do.
Under GDPR, individuals have to explicitly consent to the acquisition and processing of their data. Pre-checked boxes and implied consent will not be acceptable anymore. You will have to review all of your privacy statements and disclosures and adjust them where needed.
As we mentioned earlier, individuals have 8 basic rights under GDPR.
You will need to establish policies and procedures for how you will handle each of these situations.
For example:
How can individuals give consent in a legal manner?
What is the process if an individual wants his data to be deleted?
How will you ensure that it is done across all platforms and that it really is deleted?
If an individual wants his data to be transferred, how will you do it?
How will you confirm that the person who requested to have his data transferred is the person he says he is?
What is the communication plan in case of a data breach?
One of the headline-grabbing changes is that under GDPR, firms can be fined up to €20 million ($28m) or four percent of group worldwide turnover, whichever is greater. There is a lot of fear and scare-mongering around this element – I came across a warning recently that the threat of insolvency or even closure as a result of GDPR penalties will soon be very real for all businesses.
However, the likelihood of a company being fined to this extent is miniscule, even in the face of a serious breach.
While the GDPR financial penalties are terrifying on paper, businesses that issuing fines "will always been and will continue to be, a last resort".
The role of Data Protection Officer (DPO) becomes "mandatory" under GDPR. However, not every organisation will need to rush out to appoint one. DPOs are only a pre-requisite at public authorities, and businesses where data processing and monitoring are done on a large scale.
The GDPR states that the DPO must not be conflicted by having a dual role of governing data protection while also defining how data is managed. In practical terms, this means that an IT manager, IT director, CTO or security manager are not the best choices for your DPO. The marketing manager might also have a conflict of interest, while sensible options could be your head of finance, risk or legal. Your DPO doesn't need to be someone within the organisation, and so it could be easier to appoint a lawyer or external expert.
The ability to collect personal data and contact individuals is the lifeblood of the charity sector and its ability to fundraise. However, under GDPR, charities will have to abide by the same rules as every other organisation, explaining clearly why they are collecting personal data, how it will be used, and if it will be made available to third parties.
While consent is required in many cases to process personal information, it can be bypassed if there is a "lawful basis" for the processing activity. This information should be noted and included in your privacy notice. Local authorities processing council tax information, banks sharing data for fraud protection purposes, insurance companies processing claims information – for each of these, there is a different lawful basis for processing personal information that is not consent.
Consent is not required for all forms of direct marketing, either – letters can be sent and phone calls made to numbers not registered with the telephone preference service, provided they fall under a "legitimate interest" condition. However, people will still need to be given the opportunity to opt out of this type of contact. And a legitimate interest – for example, a charity aiming to further its cause – must not override the rights of the individual.
GDPR clarifies that pre-ticked opt-in boxes are not indications of valid consent, so these will need to be exorcised from your business. You also have to make it easy for people to withdraw consent, and use clear and plain language when explaining consent. If you think your organisation might fall foul of any of these elements, any data you currently have on file must be refreshed – meaning contacting your current database to ask them to opt in again – if you want to keep in touch with them after 25th May.
Firms need parental consent to process children's data. A child is classed as anyone under 16, but member states can lower this to 13.
If you collect data from children under 18 years old there are specific rules under GDPR. Under the GDPR, you must have a legal basis to process all data, including a child's personal data. While consent is a basis, due to the inherent vulnerability of children, it's harder to prove whether this consent is freely given and it's advisable in some circumstances to rely on another legal basis.
If you are relying on consent as your lawful basis for processing personal data, when offering an online service directly to a child, only children aged 13 or over are able provide their own consent. For children under this age you need to get consent from whoever holds parental responsibility for the child - unless the online service you offer is a preventive or counselling service.
Audit your existing website / service. Even if your service is not overtly, or exclusively aimed at children under the age of 18 it may be designed to be intentionally attractive to children and incorporate various factors which demonstrates this. For example, children's cartoon characters or child celebrities.
Run a risk assessment to determine:
Consider whether you can offer the services of your website without collecting or processing data which is identifying or makes the user identifiable, e.g. a free online game that does not require user registration or the input or collection of any personal data to use the service.
In low-risk situations, it may be appropriate to require an individual to disclose their year of birth or to fill out a form stating they are (not) a minor eg: I confirm that I am over the age of 13.
If doubts arise you should review your age verification mechanisms and consider whether alternative checks are required. Any data collected by organisations to this effect, and which is not required for evidential purposes and has no other function, should be immediately deleted following verification, to ensure compliance with the principle of data minimisation.
Audit any data that you currently hold to determine the lawful basis on which you are holding it. If you have no lawful basis you must delete it.
Smaller firms – those defined as having 250 employees or less – do not have to comply with all GDPR rules as standard. If your organisation falls into this band, there's no need to have documentation of why personal data is being collected and processed, the information you're storing or how long for. Smaller firms are not required to maintain a record of processing activities unless this carries a risk to the rights and freedoms of data subjects, it is a regular occurrence, or it relates to certain data like criminal convictions and offences.
Personal data breaches need to be reported to the relevant data protection agency – the Information Commissioner's Office for UK organisations – within 72 hours. Individuals will also need to be notified if there is a high risk their data has been breached. However, if the breach "is unlikely to result in a risk to the rights and freedoms" of people, the reporting element is not required. And firms also have a slight get-out clause here with the insertion of the "where feasible" phrase attached to the 72-hour limit.
Under GDPR you have an obligation to keep data secure and, if the breach is likely to result in damage to a person's reputation, financial loss, loss of confidentiality, or major financial or social disadvantage, you should notify the ICO within 72 hours of you becoming aware of a breach. Check with your hosting provider to see what monitoring / software is in place to track and detect any attempts to hack your website, inject malware or to detect any potential compromise of the data and ensure you have a plan in place with the actions you will take in the event of a breach.
Appoint a data controller - someone who has overall responsibility for the data you process and store.
Perform an audit to identify any data that you process or store that has the potential, in the event of compromise, to be considered a serious breach.
Determine whether you have a lawful basis to continue to store this data.
Where you have no lawful basis you must delete this data and update your online forms accordingly.
Where you have a lawful basis, run a risk assessment to determine where and how the data is stored.
If your website currently stores sensitive or confidential data (or documents) we do not recommend that it is stored within the content management system of your website. Instead you should investigate with your web developer how such forms and documents can be automatically purged after they have been received / downloaded.
Decide where (and for how long) you are going to store confidential or sensitive data going forward. To minimise the risk of a data breach this should be offline or in a secure place designed for such a purpose.
Document how you are going to process, store and retain data going forward (add, where applicable, to your privacy policy) and ensure you regularly audit the process for compliance going forward.
In the event of you becoming aware of a serious data breach ensure you have a clear procedure for notifying the ICO within 72 hours.
Tip: To minimise the risk of data breaches from your website, regularly purge data and documents stored within the content management system your website.
Organisations should review their IT systems and procedures to check they comply with GDPR requirements for privacy by design, ensuring only the minimum amount of personal data necessary is processed. Privacy Impact Assessments (PIAs) should be completed when using new technologies and the data processing is likely to result in a high risk to individuals.
Organisations should adopt a privacy-by-design approach to data protection. To do this, they will need to conduct a data protection impact assessment (DPIA) before undertaking new projects or initiatives.
DPIAs help organisations see how changes to the business will affect people's privacy, and their results can be used to anticipate and mitigate problems well in advance.
Under the GDPR every user could request "to be forgotten", meaning all their data has to be deleted and never used again, except in certain circumstances, which may include having to keep processing your personal information to comply with a legal obligation. An example of such obligation is the requirement to keep a copy of all invoices to comply with financial and tax legislation. We are now developing a functionality that allows our users to delete their profiles after all services have been deactivated.
Individuals are given extended powers over the data you retain about them under the new rules. They have an automatic right to be forgotten, so your company must have processes in place to permanently delete all of an individual's records from their systems. Individuals can also request a copy of their data, so you need to develop a way to gather and export this data to present to users in a clear, simple format. There will not necessarily be a flurry of requests, but you need to be prepared.
The GDPR restricts the transfer of personal data to countries outside the European Economic Area (EEA) that are deemed by the EU to not provide an adequate level of protection, such as the US. Make sure any international data-sharing is covered under agreed rules, such as the EU – US Privacy Shield.
Just tagging this one on the end, in case there is still any uncertainty around this. Even though after Brexit, the UK government would technically be able to implement its own data protection laws, the government has clearly stated that it will maintain GDPR as a national law. So don't hold off working through the new rules in the hope that Brexit will give you a perfect excuse for non-compliance. It won't, and you might just end up being the first GDPR breach test case.
Data subjects have a number of rights pertaining to the way organisations collect and hold their data. These include:
The right to be informed.
The right to rectification.
The right to erasure.
The right to restrict processing.
The right to data portability.
The right to object.
The right to access.
Most of these rights are similar to those in current data protection laws, but there are some significant changes. It's important to familiarise yourself with those changes and plan accordingly.
You're not the only one who needs to know about data subjects' rights. When collecting personal data from staff, users or service users, you need to inform them of their rights.
Organisations need to prove that they have a legal ground to process data. Most organisations currently use consent by default, but the GDPR toughens the rules for getting and keeping consent.
There are five other lawful grounds for processing data:
A contract with the individual.
Compliance with a legal obligation.
Vital interests.
A public task.
Legitimate interests.
Organisations should learn when these grounds can be sought and adjust their data collection policies appropriately.
There will be times when consent is the most appropriate lawful ground, so you need to know how it must be sought. The GDPR lists specific requirements for lawful consent requests.
The GDPR says we have to inform users what data we collect about them and legitimize how we use it afterwards. The good news is that we collect only the minimal set of personal data that is required to deliver the hosting service. For example, we collect your physical address for invoicing and tax purposes. We collect your credit card data because we need to bill you upon purchase. We collect your email because we need to contact you regarding your orders, the status of the services, important functionality updates and, where you have consented to receive such communications, contact you with newsletters and promotions. We use cookies because they help us show relevant content to our website visitors and advertise based on these interactions. We don’t use any of the data collected for profiling or other secondary purposes and we do not sell it to anyone.
As per the GDPR requirements, our new Privacy Policy will fully describe why and how we collect and process personal information and any user, existing or new, would be able to validate that we handle this information carefully and sensibly.
The following questions should be considered when writing a privacy notice:
Who is collecting the information?
What information is being collected?
How will it be used?
Who will it be shared with?
How will it be used for marketing purposes.
Where will the data be stored.
What security measures are in place to protect the data.
How does an individual request access to see or request deletion of the data you hold about them.
How your website uses cookies.
How to contact you.
Making sure that your partners adhere to data protection obligations and responsibilities to the protection of your data the same way we do. This happens by adding annexes to your contracts with these providers where we define their responsibilities as per the GDPR.
All your operations are designed following the "security and privacy by default" and least privilege principles. What we are doing in line with the GDPR is auditing and enhancing the security levels and adding new procedures where it is required by the new regulation. For example, we are strengthening your personnel background checks and extending your confidentiality agreements. We enhance your security and incident management procedures with new ones that are in tune with the breach response requirements of GDPR. Another new procedure we introduced is working only with partners that are GDPR-compliant.
The GDPR says you need to assign a Data Privacy Officer to make sure you are compliant with the regulations and handle complaints. You are assigning a DPO and we educate a small team of people who will be able to assist with inquiries and data protection issues.
Your new Privacy Policy will provide you with full details about how we process your personal data. As a user you should also be able to see what data we store about you, update it and, where we rely on your consent for processing the data, you can withdraw your consent to that use. All your users could currently see their personal information in the My Details section of their User area and they are able to correct it. Our use of your personal information is necessary to perform your obligations under any contract with you. We rely on your consent only to send you marketing information and promotional offers and we have introduced new preferences which enable you to control your consent for this usage of your data. We should also be able to provide you with a copy of any data which we hold about you. For this, we are working on allowing you to easily export it if needed.
Many of your users operate with their personal data - they take orders, they collect emails through sign up forms, they process credit cards and more. The user controls the data and how that data gets collected and used, but store it on our servers hence take part in its processing. The new data processing agreement will regulate our processing of that data only for the purposes of delivering the hosting service and resolving technical inquiries and no other secondary functions, which has always been the case. Providing the agreement to our customers we guarantee we are a trusted partner, committed to the principles of transparency, and we meet our obligations under GDPR adequately.
The Privacy and Electronic Communications Regulations (PECR) is designed to give people specific privacy rights in relation to electronic communications. The regulations overlap with GDPR when it comes to cookies and email marketing. If your website uses cookies (a small text file that is downloaded onto "terminal equipment" eg a computer or smartphone, when the user accesses a website), it allows the website to recognise that user's device and store information about the user's preferences or past actions. Most websites use cookies. If your website has Google analytics, Social media pixels or tracking code installed, then you are using cookies. Under the GDPR and PECR regulations you must:
Tell people that your website uses cookies.
Explain what the cookies are doing and why.
Get the person's consent to store a cookie on their device.
There are two main types of consent methods:
A Cookie Wall = This blocks the users from seeing your content on your website until they accept the consent. This is a very bad method, gives a bad User Experience and also will give your website a Penalty under Search Engines like Google who use a Interstitial Penalty system. We do NOT use this Method.
A Cookie Banner = This shows the user a small banner with several options for the user to give consent. This is a much better method to give consent and gives a better User Experience, however there are some important things to note such as: Google's Interstitial Penalty and Better Ads Standards but state that the total number of Banner's on a webpage must be less than 30% of the total viewable height! We have tried to make the plugins Banner as small as possible!
Pop-up ads.
Auto-playing video ads with sound.
Prestitial ads (appear before content is loaded) with countdown.
Large sticky ads (ads that stick to the edge of a page).
Pop-up ads.
Prestitial ads.
Ad density higher than 30 percent.
Flashing animated ads.
Auto-playing video ads with sound.
Prestitial ads with or without countdown (blocks entire content).
Positial ads with countdown (that cannot be dismissed) - These are ads that spawn after a link is clicked, that prevents a user from reaching another web page.
Full-screen Scrollover ads - These are ads that force a user to scroll past it to get to the content. They usually block about 30% of the browser viewport.
Large sticky ads - These are ads that take up more than 30% of a screen and is persistent. It does not go away no matter what direction a user scrolls, obscuring the content and resulting in a poor user experience.
Our plugin passes all current GDPR and ePrivacy Laws, below we will explain the Requirements and the Plugins Banner.
The Law states that the banner should have the following features:
Accept
Reject
Dismiss
Show
When the user clicks on the button "Accept" they are ticking all the options in the advanced setting page.
When the user clicks on the button "Reject" they are un-ticking all the options in the advanced setting page.
The user does not have to decide straight away! They can decide at any time they choose. This would be simply a close button on the banner to hide it.
The user does not have to decide straight away! They can decide at any time they choose. This would be simply a show button to show the banner again. OR THE WEBMASTER COULD CREATE A LINK IN THE FOOTER FOR EXAMPLE TO THE ADVANCED SETTINGS WEBPAGE.
We recommend the Webmaster creating a link in the footer linking to their Advanced Settings location with the Anchor Text saying "Update Consent", below is a code example:
<a href="https://www.example.com/privacy-and-cookie-policy">Update Consent</a>
Note: The above example has the "Advanced Settings" found at: privacy-and-cookie-policy
When adding New Scripts, Modules or New Cookies to your Admin Control Panel Back-end.
You do NOT need to re-show the Banner to Users again who have already given consent previously!
We recommend creating a link in the footer linking directly to the "Advanced Settings" webpage - as described in the above Section Titled Show.
The Reason for NOT re-showing the Banner would be because it's very annoying to the User-Experience and not necessary with regards to ePrivacy and GDPR Laws! Also the user process flow would be like this: A User would not edit the "New Options" in the Banner! They would edit the "New Options" from the chosen "Advanced Settings" webpage options. Therefore there is no point in re-showing the Banner for a second time after the initial consent has been given! To fully pass the Law just create a permanent link in the footer linking directly to the "Advanced Settings" options webpage.
When adding new scripts, modules or cookies to the back-end you will be changing the Privacy Policy or Cookie Policy etc. You will need to do an extra thing to pass the Law.
To keep User's informed to any updates or changes made to your Policies you should either Date them and/or also have them archived.
Below is an example of Archiving all the Policies:
Below is an example of Dated Policy Update:
Below is another example of Dated Policy Update:
Below is an example of an International Privacy Policy setup:
Below is a Checklist for OctoberCMS Users and Developers to Follow:
What personal data and sensitive data we collect/hold?
How is it collected?
Where did the data come from?
Where is it stored?
Who has access?
Who do we share the data with?
How is it used?
When is it used?
What are our obligations?
How are we communicating awareness of GDPR across the business to existing staff and new joiners?
How much is personal data?
How much is sensitive data?
Do we need it? – what can we stop collecting, if any and why?
How are our systems secured?
Are our policies and procedures adequate? – who will confirm this?
Is the processing we do legal?
How would we respond appropriately if a customer triggered their rights?
Do we have the right contractual relationships with our partners whom we share data with?
What could go wrong?
What will we do if there is a breach?
How would we detect, report and investigate a breach?
To manage effective & efficient investigation: Assess which types of data are held. The document which types fall within the notification requirement and the process to be followed if there is a breach.
How would we erase an individuals' data?
What is our process for correcting individuals' data?
Can we manage/remove consent for direct marketing and automated decision making?
How would we provide data electronically in a common format?
What will we do if a customer exercises their rights?
How would we handle a request?
What processes & policies do we have in place should we plan to refuse a request?
What will our partners whom we share data with the need to do?
Do we have confidence that these partners are compliant and would not put our subjects data at risk?
How will we seek, obtain and record consent – the record must be auditable?
What changes are needed to processes to manage consent?
Do we have any children (under16's, or 13s, if your member state so determines) if so, how will we seek consent from their parent or guardian?
What systems will we have in place to verify individuals ages?
How will we identify when children reach 16, as they will need to provide their own consent?
How would we implement an assessment in our organization?
Who would carry it out?
Would it be run centrally or locally?
Do we need to designate a DPO, if not who will the responsible person be?
Where does that person sit in the governance structure?
How will this be communicated?
If we are an international based organization, which supervisory authority do you come under?
What changes do we need to make to our current privacy notice?
Who and how will we write, obtain management approval and publish your privacy notice?
Look at the various types of processing we carry out, identify our legal basis for carrying out the processing.
Document the identified legal basis.
Be able to explain our legal basis for processing in a subject access request and our privacy notice.
Use Data Protection Act as guidance for what is a legal basis.
Do we have a data retention policy?
It is down to the board of directors to decide what that retention policy is, when and how will this approval be received? – data must not be kept for any longer than is deemed necessary.
How will we manage change while honoring our obligations?
Who is responsible for what?
Do they understand the risks?
How could we stop things going wrong?
Can we demonstrate:
Control over processes that collect and use personal data?
Appropriate measures?
Ability to respond?
Records of what we do?
A published Privacy Notice
Consent and individual rights management.
Wishing every OctoberCMS user good luck with their GDPR strategy and operations!