The GDPR from A to Z: the concrete steps you need to take to comply

The GDPR, the strictest European regulation on personal data protection, takes effect on May 25, 2018, and many businesses in Romania are still not quite sure how they should prepare for it.

The new regulation will replace Directive 95/46/EC and, with it, the provisions of Romanian Law no. 677/2001, introducing a series of new rules covering every activity in which information is processed, regardless of sector or field.

This means every website or business, both online and offline (as long as it processes data), must comply with the GDPR’s provisions, which are neither few nor easy to follow.

The GDPR in numbers

The full text of the GDPR can be read here.

In Romania, the regulation will be enforced by the National Supervisory Authority for Personal Data Processing (ANSPDCP).

How does the GDPR define data processing?

Under the GDPR, data processing means any of the following operations:

• collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.

It is very important to remember that the regulation applies whether or not the data is processed by automated means. This means the GDPR is equally mandatory for an online store that asks for certain information for a newsletter subscription, for example, and for the representatives of a company running a street raffle that requires filling in a coupon with personal data.

What counts as personal data under the GDPR?

The new European regulation states that “personal data” means any information relating to an identified or identifiable natural person.

More specifically, this data refers to:

• a name;
• an identification number;
• location data;
• an online identifier (IP addresses, cookie identifiers or other identifiers such as radio frequency identification tags);
• factors specific to a person’s physical, physiological, genetic, mental, economic, cultural or social identity.

What should online stores keep in mind about this personal data?

With this new definition of “personal data”, the GDPR actually expands the list of the types of information websites ask users for when they subscribe to a newsletter, create an account, go through a shopping session and so on.

For example, under the rules still in force, online identifiers and location information are not considered personal data. From May 25, 2018, however, they will fall under the new regulation.

So websites will need to take this into account when preparing for the GDPR and, going forward, when complying with its rules.

What changes do websites need to make?

Because the GDPR places strong emphasis on transparency toward internet users and on holding data controllers accountable for how they process the information collected from them, it is very important for websites to implement a series of measures that replace “implied consent” with the new “affirmative action”.

This means updating the Terms and Conditions page, the Privacy Policy, the subscription wording and so on.

From May 2018, users’ consent to the processing of their personal data should be given “by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication“.

One of the most common website notices becomes illegal

The regulation states that, to give consent, a person visiting a website will need to tick a box, choose technical settings for information society services, or make any other statement or take any other action that clearly indicates their acceptance of the processing of their personal data.

In addition, the GDPR stresses that “silence, pre-ticked boxes or inactivity should not therefore constitute consent“.

So notices such as “This site uses cookies! By continuing to browse, you accept their use” will no longer be legal and will most likely have to be replaced by pop-ups that require the user to physically act to give consent, without even pre-ticked boxes in these messages.

The right to be forgotten

Websites will also be required to inform their visitors from the very beginning that they have the right to withdraw their consent at any time.

More precisely, according to Article 7(3) of the regulation, “The data subject shall have the right to withdraw his or her consent at any time. (…) Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent“.

The last sentence clearly shows the need to place a message within easy reach about the user’s option to withdraw their consent to the processing of personal data.

The regulation also provides for the user’s right “to be forgotten” (Article 17), which states that “the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay“.

First steps toward GDPR compliance

Besides the technical measures that will have to be implemented on the website, every business will need to take inventory of the data it has collected over time, and it is very important, first of all, to establish what type of consent was requested and given for processing that data.

This is because Article 171 of the GDPR provides that, where the data processed so far was collected on the basis of consent given in line with the new conditions, there is no need to ask the user/ data subject for new consent.

Otherwise, it is easy to see that any entity holding a database of email addresses, names, physical addresses, personal identification numbers (CNP), company tax IDs (CUI) and so on will have to ask the people concerned for explicit consent to keep and process this information.

This can be done by sending an information email that gives recipients, in completely unambiguous wording, the option to stay in or leave the database.

What’s more, every website will be required to tell its visitors which third parties may also receive the data collected from them (for example, hosting, cloud, payment, email marketing or targeting service providers), so it is important for the information email sent to users to cover these points as well.

How do you make sure your business complies with the GDPR?

Because the technical and organizational measures needed to comply with the GDPR can be quite hard to implement, especially for online stores or other businesses with fairly large databases, the regulation suggests appointing a DPO (Data Protection Officer).

The regulation states that the data protection officer may be a member of the controller’s staff or may fulfil the tasks on the basis of a service contract, provided they are designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices.

What counts as a security breach?

Under the GDPR, a “personal data breach” means a breach of security leading to the accidental or unlawful:

• destruction of data;
• loss of data;
• alteration of data;
• unauthorized disclosure of data;
• unauthorized access to the data collected.

What fines do those who fail to comply with the GDPR face?

While the provisions of the new European data protection regulation, and how exactly they should be implemented, are still a mystery to many online entrepreneurs, the fines for breaching the GDPR have certainly reached everyone’s ears.

Fines can reach up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.

The general conditions for imposing administrative fines are set out in Article 83 of the regulation.

Conclusions

To comply with the GDPR, websites and online stores must:

• inform their visitors transparently and as clearly as possible about who they are, what data they collect, why they collect it and how long they will keep it;
• inform visitors about the third parties that also receive that data;
• obtain users’ clear consent for data collection, in ways that let them express their own wishes;
• give users access to their data and let them download, update and delete it whenever they want;
• inform users when there has been a breach of the data collected from them;
• check whether the third parties the data might be sent to transfer the information outside the EU;
• adopt a code of conduct on data protection.

These measures involve some technical changes, such as:

• Updating the Terms and Conditions page;
• Updating the Privacy Policy so that users know: Who you are; What data you collect; Why you collect that data (invoicing, emailing news/ promotions, marketing, targeting and so on); How long you will keep the data collected; What other third parties will have access to that data (Google, MailChimp, etc.); How they can access their own personal data collected; How they can request deletion of their personal data from the database (by email, by contacting the DPO, or automatically, by ticking an option to that effect); How you can be contacted about issues regarding the personal data collected.
• Updating all subscription/ account creation/ contact/ review forms, etc.;
• Changing some settings in Google Analytics so the app can keep collecting the data needed for reports and analyses of the website’s performance (details and steps to follow here).
• Changing the Google Analytics setting for how long collected data is retained before it is automatically deleted (the options are 14 months, 26 months, 38 months, 50 months or do not automatically expire). This setting is also very important for reporting, and to avoid the unpleasant surprise of losing important analyses, the best option is the one with no expiry (steps to follow here).