Did you know that on May 25th the European Union’s General Data Protection Regulation (GDPR) goes into affect? Data Regulation is here and coming soon to US! Businesses, large and small, are in the midst of preparing for compliance with the European Union’s (EU) new data privacy laws. Here’s a brief summary of what that means:
The GDPR is very broad in scope and can apply to businesses both in and outside of the EU. Businesses that don’t comply with the GDPR could face heavy fines. It was passed by the European lawmakers to create a harmonized data privacy law across all the EU member states. Its purpose is to:
- support privacy as a fundamental human right;
- require companies that handle personal data to be accountable for managing that data appropriately; and
- give individuals rights over how their personal data is processed or otherwise used.
What Defines personal data?
GDPR defines personal data as “any information relating to an identified or identifiable natural person.”
In addition to the kinds of information you might think about – name, address, email address, financial information, contact information, identification numbers, etc., personal data can in some cases be information related to your digital life, like an IP address, geolocation, browsing history, cookies, or other digital identifiers. It can also mean information about a person, including their physical, mental, social, economic or cultural identities.
In short, if information can be traced back to or related in some way to an identifiable person, it is highly likely to be personal data. You can find out more about the GDPR here.
GDPR provides rights to individuals
There are several rights an individual may exercise under the GDPR, including:
- Right of access: Individuals can ask for a copy of the personal data retained about them and an explanation of how it is being used.
- Right to rectification: Individuals have the right to correct, revise or remove any of the personal data retained about them at any time.
- Right to be forgotten: Individuals can ask to delete their personal data.
- Right to restrict processing: If an individual believes, for example, that their personal data is inaccurate or collected unlawfully, the individual may request limited use of their personal data.
- Right of portability: Individuals have the right to receive their personal data in a structured, commonly used and machine-readable format.
- Right to object: Where an individual decides that they no longer wish to allow their personal data to be included in analytics or to receive direct marketing emails or other personalized (targeted) marketing content at any time, the individual may opt out of use of their data for these purposes.
Note that these rights are not absolute, and limitations/exceptions may apply in some cases. (Note: you should consult your own legal counsel to determine if you are subject to the requirements of GDPR.)
If you are using an Email Marketing tool, it likely is compliant with much of the new GDPR. You may want to use a custom template to meet their double opt-in requirements and to create a record of your subscriber’s express consent. You can find templates already in your Constant Contact account. If you need a Constant Contact account, try one free or get a paid account using this link.
For more help navigating your email and digital marketing or social media marketing efforts, contact us for a private review of your strategy or call 310-791-6300.
Liz Harsch is a media planner and trainer for small business owners with Constant Contact, SCORE, SBDC, SBA, Cities and MWD and County outreach partners, APICS plus many Chambers of Commerce since 2008. She owns Tailor-Made Advertising in Torrance, California and provides marketing, training and consulting to identify marketing and media alternatives for business owners. She can be reached at 310-791-6300 or by email at liz@adteamla.com. You can also view her workshop schedule here.
