GDPR Action Items

General Data Protection Regulation, EU Law. Compliance required by May 25, 2018. All EU citizens, even retroactively, must have special protections in place to guard their data privacy. This applies to anyone who might have an EU citizen’s data stored in their email marketing, ecommerce, subscriber/comments databases, etc. Fines for non-compliance are potentially up to €20 million or 4% of annual global revenue. Here is the actual law: https://gdpr-info.eu/


Email Marketing


  • Make it clear to people what they are opting in for. 

    • You need to ask them if they want to receive regular mailings about x,y,z topic. They need to check a box or opt in in some very clear way. You can’t offer them a Content Upgrade and just put in small print (oh, and we’ll also email you from time to time). Pre-checked checkboxes are a violation.

      • It’s not clear to me, but saying “Sign up for my regular mailing list, and you’ll also receive…” might comply?

    • For Mailchimp: They now have GDPR compliant form options. 

      • These are only certain form types, not embedded or pop-up.

      • They also have a Data Privacy addendum to their agreements that let you legally transfer data from EU citizens to MailChimp US: Fill out here.

      • Will probably not integrate yet with Opt-in Monster or other Pop-up plugins we’re using

    • For Active Campaign

      • They are taking a more manual approach. Encourage users to:

        • Use double-opt-in

        • Know how to export and delete data if asked

        • Reach out to existing subscribers before May 25 for permission

        • Include content blocks on forms specification data usage policies

        • You can request to use their Data Process Agreement by filling out this form: https://ac.activehosted.com/f/2176

    • This is retroactive: consider deleting EU subscribers if you’re not sure you collected their addresses in a compliant manner. 

      • If no address data, possible to tell by IP of subscription? Of course, EU citizens can subscribe from anywhere so this is not foolproof.

      • Or, before the end of May, email everyone and ask for consent. Can use MailChimp GDPR forms for this.

    • Make sure we use double-opt-in. This is a big protection for you because it’s a clearer record of consent.

  • Ensure people have a clear option for both unsubscribing and updating their personal information In mailings.

  • Ensure people who unsubscribe are fully deleted from the list so you never accidentally mail them again.

  • If you sign people up manually, make sure you keep the physical records that indicate they consented to your list.

  • Have a Privacy Policy. Make sure:



Websites



Enforcement of GDPR:

  • EU authorities can fine US companies through existing methods of international law

  • Fines for non-compliance are potentially up to €20 million or 4% of annual global revenue

  • There are already precedents using pre-GDPR EU privacy laws

  • No one knows how hard-line of a stance various EU countries will be in enforcing the GDPR for countries in the US accidentally taking EU data

  • Source


Global String Consideration:


If a client is collecting EU data incorrectly using tools that are under String memberships or licenses, could string be accountable? Perhaps we need some sort of “hold harmless” clauses in contracts for data privacy practices of clients that refer specifically to GDPR if we don’t have something that already covers that.