Skip to main content

A BUSKLAW Newsletter Aside: Is Your Website Compliant with the European Union's GDPR?


Effective 25 May 2018, the EU's General Data Protection Regulation goes into effect. The GDPR is a big deal and quite complicated. There are 99 articles and 173 recitals defining the privacy rights of individuals and data controllers’ and data processors’ obligations. 

Are you a U.S.-based data controller or data processor subject to the GDPR? You are a “data controller” if you, alone or jointly with others, determine the purpose and means of “processing” personal data of EU individual customers or businesses. The threshold is that you offer goods or services to customers or businesses in the EU (including the UK, despite Brexit) and collect their personal data. But even if you don’t sell goods or services to EU customers but engage in marketing or monitoring activities involving EU individuals’ personal data, you are covered by the GDPR. 

You are a data processor if you “process” personal data on behalf of a “data controller,” i.e., a data controller contracts with you to process personal data that the controller collects from individuals. “Process” or “processing” means any operation or set of operations that are performed on personal data or on sets of personal data, whether or not by automated means, such as data collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
 
 

Personal data includes one or more of the following: IP addresses, names, birth dates, physical addresses, email addresses, customer photos, billing information, customer identification numbers, any other information that can be used alone or with other data to identify a person, and sensitive data such as genetic data and biometric data that could be processed to uniquely identify an individual. 

Perhaps you're already in compliance with the GDPR. It's been in the works for the last two years. But if not, read on:  

For compliance purposes, you should consider giving priority to the following:

  • Updating your customer-facing websites and mobile app privacy policies to comply with the GDPR. These existing policies may be deficient in the following areas:
    • The customer doesn’t expressly consent to the privacy policy (and you don't keep a record of customer consents);
    • The privacy policy isn’t written in plain English;
    • The privacy policy doesn’t:
      • provide that the customer has the right to have inaccurate personal data rectified;
      • explain that the customer has the right to have their personal data deleted, i.e., the “right to be forgotten;”
      • explain that the customer has the right to receive their personal data;
      • explain that the customer has the right to object or restrict the processing of their data;
      • explain that the customer has the right to at any time revoke its consent to the processing of their data;
      • explain that the customer has the right to the secure storage and transfer of their data; and
      • explain that the customer has the right to have their outdated data erased.
  • If you are a data controller, make sure that you have suitable contracts with your data processors, and data processors should do the same with their data controllers. The GDPR includes specific content requirements for these contracts.
  • Making sure that you understand the cost of complying with the GDPR. Apart from legal fees, there will likely be considerable internal compliance costs, including (1) creating the necessary infrastructure to support the required website and mobile app privacy policy changes; (2) establishing more robust data security; and (3) adopting practiced and repeatable data breach notification policies and procedures. Even apart from GDPR compliance, if you haven't already done so, consider appointing a data protection or chief privacy officer (that role can be combined with another senior manager such as CFO or CIO) who reports directly your President or CEO.
  • If you have or process personal data, you should consider having Cyber Risk Liability insurance that may respond to penalties resulting from non-compliance with the GDPR. Cyber Risk policies have become more affordable in recent years, but you must carefully review the exclusions because fines or penalties levied by government authorities may be excluded from coverage. 
  • You should also consider having Directors and Officers Liability insurance because a company’s failure to properly secure personal data or timely report data breaches may lead to D&O liability to shareholders or outside parties. Again, you should carefully review the coverage exclusions.
Penalties for non-compliance with the GDPR are stiff: up to four percent of the violating data controller’s global annual revenue per violation or $20 million Euros – whichever is greater. Also, the data controller (and its data processor if any) may be prohibited from processing EU customers' personal data.

I've prepared questionnaires for data controllers and data processors to help determine if they are subject to the GDPR. If you would like a copy (at no charge), email me! 
____________________________________
If you find this post worthwhile, please consider sharing it with your colleagues. The link to this blog is www.busklaw.blogspot.com and my website is www.busklaw.com. And my email address is busklaw@charter.net. Thanks!

Comments

Popular posts from this blog

The BUSKLAW June Newsletter: Forcing Business Behavior Changes Through Buried Contract Provisions: Salesforce and Camping World

As reported by  The Washington Post , business-software giant Salesforce  recently instituted a policy barring its retailer customers from using its technology to sell semi-automatic weapons, including the AR-15 used in numerous mass shootings. One such customer is  Camping World , whose Gander Outdoors division sells many "AR" and other semi-automatic rifles .  Rather than approach Camping World/Gander, a "leading" Salesforce customer, and negotiating the termination of their semi-automatic rifle sales in exchange for some benefit (such as a software discount), Salesforce was tricky. They buried a provision barring the sale of semi-automatic rifles in the acceptable-use policy  ("AUP") binding on Camping World/Gander: Salesforce wants to force Camping World/Gander to make a major change to its business model via an addition to their AUP that is irrelevant to their customer's licensed use of Salesforce software. And although sneaky, I bet tha

The BUSKLAW Halloween 2022 Post: Stephen King's Asides on Poor Writing in Fairy Tale

  Having just read  Stephen King's Fairy Tale in time for Halloween, it's appropriate to examine his asides on poor writing included in the book. (BTW, Fairy Tale is a good read with King's typical well-executed character development, plot, and a great finish to the story. But you have like the whole Grimm fairy tale genre before you read his take on it.)  Stephen King doesn't tolerate anything less than crisp prose. When the story's hero, Charlie Reade, tries to read a book about the origins of fantasy and its place in the world matrix ("what a mouthful"), he can only scan it because: It was everything I hated about what I thought of as "hoity-toity" academic writing, full of five-dollar words and tortured syntax. Maybe that's intellectual laziness on my part, but maybe not. Later on, Charlie tries to focus on a particular chapter in the "origins of fantasy" book about the story of Jack and the Beanstalk but is put off by "t

The BUSKLAW April Newsletter: A Force Majeure Clause for the New Millennium

(Author’s Note: I originally wrote this post for Y2K, but I’ve updated it using plain English.  Happy April Fool’s Day 2016!)             A standard force majeure contract clause, where "Acts of God" excuse one party from performing their obligations without that non-performance being a breach of contract, are so 20th Century. So what if fire, flood, hurricane, snowstorm, or riot excuse contractual non-performance. Those events are too mundane to contemplate! Contract lawyers desperately need a force majeure clause for the clear and present dangers of the new(er) millennium! So, as a public service to the legal profession, I’ve assumed the heavy burden of drafting a "new age" force majeure clause for my colleagues to freely use: Either party's non-performance of this agreement will be excused to the extent that it is caused by the occurrence of any of the following events or circumstances: (i) Alien abduction, alien invasion, alien cerebral possession,