GDPR, will you be ready on May 25th?

Thursday, May 17, 2018

DISCLAIMER : First of all, please take note that we are not lawyers nor law specialists, so we highly recommend you talk about the GDPR with your lawyers to make sure you understand all the implications it has. This article is simply our interpretation of the GDPR. 

With these new regulations that come into effect on May 25th, you have to be ready to enforce it for all the citizens of the European Union. Even if you don't have European customers, it's possible that a European citizen is subscribed to your newsletter or previously made an information request. In that case, if you collect a European citizen's name, e-mail or phone number, the GDPR affects you and you have to take it into account or else you might get a hefty fine...

What is the GDPR?

Basically, the GDPR (General Data Protection Regulation) is legislation passed by the European Union to protect their citizen's personnal data.

It gives guidelines you need to follow that should allow their citizens to gain access to their data, be allowed to make changes and the right to be forgotten. It also proposes ways to secure their data and what a company needs to do if it's data was compromised.

What do I need to do?

In Canada, with our C-28 anti-spam legislation, we already have a couple of elements that should theoretically already be implemented (for example, not checking by default the box that asks them if they want to subscribe to our newsletter).

Same thing goes for when you send those newsletters, you need to make sure you have their consent that they really want to receive that information (so don't subscribe someone who just wants to get your latest news to your promotional newsletters).

Besides that, you basically have to make sure that you:  

• Are able to send a user all of his or her data;
• Are able to delete all trace of a user from your system;
• Are able to make corrections to a user's data if asked to;
• Explain exactly how you use their data;
• Are able to limit how you use a specific user's data if he asks you to;
• Get your user's consent for how you use their data and only use their data for what he gave you his consent;
• Inform every user who was affected by a data leak once it's detected.

If you're able to do all of this, the GDPR shouldn't be a problem for you. That being said, as we mentioned earlier, don't hesitate to talk about it with your lawyer!