Don’t Get Tripped up by These 6 GDPR Myths

11th Mar 2018 –
Here’s what the ICO (UK’s data regulatory body) recommends you confirm before you decide to process data….
As a marketer, this is the GDPR condition that makes me want to tear my hair out.
While it may (momentarily) leave you a little bit of breathing room for some types of cold emails—it’s not as useful as marketers might hope.
In general, it seems SMEs who process your standard types and amounts of data, for marketing purposes, can get by with some solid legal advice, and a thorough dedication to data transparency.
We recommend:
These are the 6 big lies folks believe about GDPR that folks get wrong, and that we all need to get right by May 25th.

Myth #1: This only affects the EU.

But, as they say…
It’s a headache. And it’s a bummer, to lose some of those contacts you’ve fought hard to win.
It applies to all your existing data.
So here.
But beyond that, GDPR matters to anyone deals with the data of EU citizens.

Myth #2: I can justify my cookies/cold emails/etc. because of “legitimate interest.”

GDPR advices some companies to appoint a Data Protection Officer, to oversee the transition, and their data security moving forward.
The amount of blog posts and Quora answers I’ve seen littered with green lights, that should be RED—is astounding.
And the powers that be have pretty clear that public authorities should appoint one. And companies whose primary function includes processing data, or systematically monitoring it. And if you regularly process special categories of data—like health data, or religious and political affiliations—you probably should have a DPO on your team.
Right now, there are some exceptions for cookies in the “performance sector.” These are the types that only collect information about website usage, for the benefit of the website operator. They don’t identify visitors—rather, they rely on aggregate data.
We humbly present this helpful table:
You can find a deep dive on how GDPR will regulate cookies here.

• We have checked that legitimate interests is the most appropriate basis.
• We understand our responsibility to protect the individual’s interests.
• We have conducted a legitimate interests assessment (LIA) and kept a record of it, to ensure that we can justify our decision.
• We have identified the relevant legitimate interests.
• We have checked that the processing is necessary and there is no less intrusive way to achieve the same result.
• We have done a balancing test, and are confident that the individual’s interests do not override those legitimate interests.
• We only use individuals’ data in ways they would reasonably expect, unless we have a very good reason.
• We are not using people’s data in ways they would find intrusive or which could cause them harm, unless we have a very good reason.
• If we process children’s data, we take extra care to make sure we protect their interests.
• We have considered safeguards to reduce the impact where possible.
• We have considered whether we can offer an opt out.
• If our LIA identifies a significant privacy impact, we have considered whether we also need to conduct a DPIA.
• We keep our LIA under review and repeat it if circumstances change.
• We include information about our legitimate interests in our privacy notice.

GDPR has expanded the scope of personal data, from what was previously acknowledged as “Personal Identifying Information.”

Myth #3: I need to appoint a Data Protection Officer.

No! That’s bundling. You have to ask for consent for separate processes, separately. You can’t just throw “monthly newsletter” subscriptions in with event sign ups.
This being…
Meaning, if you’ve been collecting emails, or running cookies, or messing with any personal data in a way that’s not GDPR compliant—all of that stored data becomes a problem come May 25th.
So if you want to rely on legitimate interests—you have to confirm these things. And you have to document your process. And you have to decide you’re processing with the legitimate interests condition ahead of time. It can’t just be your fall back because you asked for consent incorrectly.

Myth #4: This is an okay way to ask consent.

Data is, more and more, a valuable form of currency. Which makes data legislation, more important than ever.

The important thing is: consent rules ain’t what they used to be.

“This industry standard behavior is now bad,” it says. “YOU HAVE TO WARN THEM.”

Even if your company is based elsewhere—if you have web visitors that are EU citizens, and you track them with cookies—you’re expected to apply with GDPR. If you collect the emails of European data subjects, if you store their IP address, if you interact with their data at all—you’re bound to the same new rules as anyone with an EU-based server.

Sometimes things fall apart so better things can fall together and also data privacy is important so we should all follow the law.
To back up a bit—GDPR outlines 6 different legal conditions for data processing. The two relevant ones for marketers seem to be: data-subject consent, and “legitimate interests.”
But these conditions aside, honestly, there’s no strict rule as to when your company is big enough to mandate hiring a DPO. Or when  he data you manage is complex enough for you to need one. 250 employees is one, oft-tossed-around rule of thumb.
One of the most ambitious things about GDPR is how it expands the legislative scope of data privacy policies. Now, there’s one overarching piece of legislation setting the rules across the EU.

Myth #5: That’s not personal data.

It applies retroactively.
And the nuances go on.

Personal Identifiable Data (PII)

Personal Data

Full name (if not common) Home address Email address National identification number Passport number Vehicle registration plate number Driver’s license number Face, fingerprints, or handwriting Credit card numbers Digital identity Date of birth Birthplace Genetic information Telephone number Login name, screen name, nickname, or handle

Full name (if not common) Home address Email address National identification number Passport number Vehicle registration plate number Driver’s license number Face, fingerprints, or handwriting Credit card numbers Digital identity Date of birth Birthplace Genetic information Telephone number Login name, screen name, nickname, or handle Soliciting consent requires you meet all sorts of conditions—it has to be active, unambiguous, affirmative, etc. IP-address Unique identifiers like Device IDs, UserID, TransactionID, CookieID Pseudonymous data (thats unrecognizable data + key on different spot to make it readable again)

No! Consent needs to be active. You can’t leave your boxes pre-checked.
The legitimate interest condition is….complicated.
No! Name your third parties or it doesn’t count!

Myth #6: As long as I update my processes by May 25th—I’m in the clear.  

      +
If only.

Comparatively, “legitimate interests” seems like a walk in the park. But the intention of this clause wasn’t “I legitimately thought they were interested…so, I can send them whatever I want right?”

1. Whether your site’s cookies are running on a 3, 6, or 12 month lifespan—it’s a good idea to start those over, and clear any of the personal data they’ve stored.
2. Run a re-permissioning campaign, to try and salvage your existing email list.

Nope—persistent cookies need explicit, active consent now. As in, someone has to click a thing or check a box that says “I consent.” They don’t give it just by continuing to browse.
The big ones of note here are cookies—which are a little complicated. Exactly what types of cookies will be considered personal data, will be established with the new ePrivacy Regulations.