GDPR: Is Your Website Compliant?

How Does This Affect Your Website?

You’ve probably heard all about cookies, but did you know they could represent a major breach from a legal point of view, when considering GDPR?

Cookies are small files that are automatically left on computers as the web is being browsed. Normally these are harmless bits of text that are locally stored and can be easily viewed and deleted.

However, these cookies can give an in-depth insight into the activity of the user and their preferences. This means their identity can be identified without their consent.

As data technologies grow more and more sophisticated, the user’s privacy is increasingly compromised. Although cookies don’t usually originate from the websites the user has visited, third parties can track the users for marketing purposes.

And although not all cookies can be used to identify the users, normally those that are most useful to the owners of the website will be subject to GDPR. Cookies used for analytics, advertising and functional services, such as survey and chat tools, are all examples of cookies that can identify users.

Below is information on how to make your website and your business GDPR compliant:

Legitimate Interests

Legitimate interests refers to the limitations that a company has when it comes to processing personal data. This may imply a benefit inherent in processing for that company itself or perhaps for wider society. It’s important to ensure that the legitimate interests ‘must be real and not too vague’. The Data Protection Network state that “an ‘interest’ can be considered as ‘legitimate’, as long as the controller can pursue this interest in a way that complies with data protection and other laws”.

Check that the legitimate interests is the most appropriate lawful basis for processing.

Ensure you have explained how or why you need an individual’s personal data when you collect it.

Check that you use a layered privacy notice/policy – A layered privacy notice puts the most important information upfront and then there is a more detailed privacy policy underneath it.

Ensure that individuals are well informed of what you plan to do with their data when you collect it.

Always give individuals the option to refuse marketing and that it’s explicitly stated and easy to exercise that right.

Only collect the minimum data necessary and delete records after use – You can keep data needed for a suppression file and you need a valid reason to process an individual’s personal data using your legal legitimate interests.

So How Does This Affect Websites?

You can be subjected to controls and be required to account exhaustively for the data processes that are going on in connection to your website. This is obviously easier said than done, as most websites have a large number of third-party cookies flowing through their system. A compliant cookie policy must give the user a clear and accurate picture of how cookies are used on the website at any time. And it is required that the cookie policy is written in a plain and understandable language.

Direct marketing is recognised as a legitimate interest in GDPR recital 47. For example, an individual may have bought a product from a business so that business can market similar products to the customer.

Strictly Neceassary

Some interests are likely to be legitimate because they are ‘strictly necessary’ for corporate governance or related legal compliance issues, particularly where there is no legal obligation to comply with, but the processing is essential to ensure the controller meets external or internal governance obligations. Whether you rely on consent or legitimate interests for your marketing, you need to do similar things to make sure you are GDPR compliant:

1. Be clear with individuals about why you need their data at the point of collection.
2. Always use clear and concise language appropriate for your target audience.
3. Give individuals control over their data. They should be able to decide whether to share their personal data with you or not.
4. Under the GDPR principle accountability you should be able to demonstrate that you are compliant. This means recording the legal grounds for processing an individual’s personal data.

For an in depth account of what exactly legitimate interests in regards to GDPR is and how to work out if your company is compliant, check out the Data Protection Network’s Guidance on the use of Legitimate Interests under the EU General Data Protection Regulation.

Asking For Consent

Consent is a lawful basis for processing and can legitimise use of special category data, restricted processing, automated decision-making and overseas transfers of data.

As a result, genuine consent should put individuals in control, build customer trust and engagement, and enhance your reputation. However, many website users have grown accustomed to, albeit slightly irritated, to the banners and advertisements on many websites. Sometimes these banners state the use of cookies and asks the user to ‘check the OK button’ but it doesn’t actually give the user a true choice.

With the new regulations, this is not sufficient and does not comply with the consent rules.

Relying on inappropriate or invalid consent could destroy trust and harm your reputation. Plus, it may leave you open to large fines.

If existing DPA consents don’t meet the GDPR’s high standards or are poorly documented, you will need to seek fresh GDPR compliant consent, identify a different lawful basis for your processing (and ensure continued processing is fair), or stop the processing” – The Information Commissioners Office.

Asking For Consent Checkboxes

• Check that consent is the most appropriate lawful basis for processing.
• Check that consent was asked for prominently and separately from your terms and conditions.
• Ensure individuals are asked to positively opt-in.
• Make sure that pre-ticked boxes are not used, nor are any other type of consent by default.
• Only use clear, plain and easy to understand language.
• Explain why data is wanted and what you’re going to do with it.
• Provide specific options to consent and to the different types of data processing that are carried out.
• Highlight named organisations and third parties that data may be shared with. This may be a requirement in the ICO’s consent guidance so think about how you would manage it.

• Explain how individuals can withdraw their consent.
• Explain how an individual can refuse to consent without detriment.
• Ensure that it’s made clear that consent is not a precondition of your service.
• Ensure that if online services are offered to children, that you only ask for consent if you have age verification and parental consent measures in place.

Recording Consent

• Keep a record of when and how you got consent from the individual
• Likewise, keep a record of exactly what they were told at the time. For example, if you have more than 250 employees, detailed records of the processing undertaken need to be kept. Smaller businesses are exempt unless the processing carried out carries a high privacy risk or involves sensitive data.

The Records Must Cover

• Name and contact details of the controller and their data protection officer
• Purposes of processing
• Classes of data
• Details of recipients’ data
• Overseas transfers
• Data retention periods (where possible)
• Security measures in place.

Managing Consent

• Make sure that consent is regularly reviewed ensure that the relationship, the processing and the purposes have not changed since consent was given.
• Ensure that you have the means to refresh consent at appropriate intervals, including any parental consent.
• Using privacy dashboards or other preference-management tools is good practice.
• Make it easy for individuals to withdraw their consent at any time, and show them how to do so. And when consent is withdrawn, act quickly.
• Don’t penalise individuals who want to withdraw their consent.

Check out Credit to the Information Commissioner’s Office (ICO) GDPR consent guidance: www.ico.org.ukfor more information.

1. Be clear with individuals why you are collecting their data.
2. 2Use clear and concise language appropriate for your audience.
3. You must give information at the point you collect data. It cannot be hidden in small print.
4. Give individuals control over their personal data – they should be able to decide whether to share their personal data with you or not.
5. You should be able to demonstrate your GDPR compliance, so make sure you record the legal grounds used for processing an individual’s personal data. For example, taking a screenshot of the tick box a customer agreed to online and the correct version of the corresponding privacy policy or notice. If an individual challenges you, you will need credible evidence to prove your compliance.

Collection Of Personal Data

Third-Party Data

Third-party cookies are set up by another website, not the one that the user is on and is often used to collect certain information to carry out research into the user’s behaviour, demographics and targeted marketing.

When buying third party data, make sure you do your due diligence, as GDPR makes you accountable and responsible for making sure the personal data you use for marketing is compliant. To be sure, give third party data suppliers rigorous checks.

You should:

• Know how the list was compiled.
• Not work with or use any organisation that withholds this information.
• Know whether the consent was recently obtained/updated.
• Make sure that the third party can prove consent (see point 1).
• Ask whether data has been screened against the Telephone Preference Service and/or Mailing Preference Service. If not, you will need to screen the data.
• Make sure your organisation was specifically named when the data was collected. This may be a requirement in the ICO’s consent guidance so think about how you would manage it.
• See a sample of the data. Record this process so you have proof that you’ve carried out extensive due diligence of your third party data suppliers.

Other Types Of Cookies To Consider

Session cookies are temporary and expire once the user has left your website. They’re mainly used on eCommerce sites to hold items in baskets whilst the user is shopping online.

Permanent cookies stay on your user’s disk for a long time after the session has ended. By law, it should be deleted every 12 months at the very least, but a cookie has the potential to stay on there forever. These cookies hold data such as login details, contact information and account numbers.

First-party cookies are the cookies issued from the website the user has accessed. They remind the website about the user’s data and preferences.

Depending on their duration and on their origin, GDPR can affect them in different ways.

Profiling

Profiling means evaluating personal data so you can make predictions about an individual or a group. This means that marketing communications can then be targeted and personalised for individuals or groups.

• Ensure that you tell people how and why you profile personal data but give people the chance to opt-out.
• Explain how you profile an individual’s personal data in your privacy notice/policy.

If You Process Personal Data Via Automated Decision Making

• Consent may need to be explicit – an informed opt-in, like a tick box, with clear copy explaining any consequences for individuals.
• Consider whether the profiling has legal or other ‘significant effects’ on individuals.
• You must ensure that the individual gives explicit consent.
• You need to undertake a privacy impact assessment to determine whether legitimate interest or consent is the most appropriate legal basis for your profiling activities.

Legacy Data

To continue marketing to individuals on your website and on your database, you must make sure that data is GDPR compliant.

• Ensure that you have implemented the requirements mentioned in the consent, legitimate interests and information provision sections of this checklist.
• As long as the data used is GDPR compliant then the ICO will have confirmed that the data can be used after May 2018.

To Get Your Legacy Data GDPR Compliant

• Ensure that your company demonstrates to individuals the reasoning behind collecting their data.
• Likewise, ensure this is made clear using concise language appropriate for the target audience.
• In addition, be certain to give individuals the chance to object to the processing of their data.
• Companies should be able to demonstrate compliance with GDPR. With this in mind, there should be a record of legal grounds for processing an individual’s personal data.
• Demonstrate that individuals have been informed of what is being done with their data clearly and specifically, and why. Consequently, if this cannot be demonstrated, then it cannot be proved that the legacy list is compliant.
• Also, make sure to use direct mail to reconnect with individuals on the database.
• Finally, ensure that consent is renewed at least every two years once reconnection with the individual has been established.