Does GDPR Apply to a Canadian Business

The question, three months out

The European Union's General Data Protection Regulation, GDPR, applies from May 25, a little under three months from now.

Many Canadian business owners have heard it applies to everyone, because a website can be visited from anywhere.

That is not how the regulation is written. It has a defined reach outside Europe, and most businesses can work out where they stand with a few plain questions.

What follows describes the regulation's text in general terms. It is information, not legal advice.

What the regulation says about its reach

GDPR applies to organisations established in the EU. For a business with no office, branch or staff there, it can still apply in two situations.

The first is offering goods or services, paid or free, to people who are in the EU. The second is monitoring the behaviour of people in the EU while they are there.

Both tests speak of people who are in the Union, not of EU citizens. Where the customer is matters more than their passport.

Signs of offering to people in Europe

• Prices in euros or another European currency.
• Shipping to EU countries offered at checkout.
• Pages in a European language aimed at customers there.
• Mentions of European customers, such as testimonials from them.
• Advertising aimed at EU countries.
• A European domain, such as one ending in .de or .fr.

The third needs care in Canada. A language generally used in the business's own country is not, on its own, a sign, so a French version written for Quebec does not make an offer to France.

What does not count on its own

The recitals, the explanatory notes at the start of the regulation, say plainly that a website being reachable from Europe is not enough. Neither is an email address or other contact details that Europeans could use.

Visitors from Germany in your analytics, an occasional enquiry from Spain, or a Dutch tourist who books a table while visiting Vancouver do not, by themselves, show an offer to people in the EU.

The distinction is between being found from Europe and reaching out to it. A business that serves people in Canada, wherever they happen to come from, is generally on the first side of that line.

Monitoring behaviour

The second test concerns tracking. The recitals describe it as following people on the internet, including profiling them to analyse or predict their preferences, behaviour or attitudes.

Advertising aimed at people in Europe and based on what they did on your site, such as retargeting, sits close to that description.

Whether ordinary visitor statistics count is less settled. Basic analytics on a site aimed at Canadians is a long way from profiling Europeans, but there is no definitive answer yet.

A plain test

Three questions cover most small businesses.

The first is whether the business has an office, branch or staff in the EU. The second is whether it offers goods or services to people there, judged by the signs above.

The third is whether it tracks or profiles people there, for example with advertising aimed at them.

Three noes usually mean GDPR does not apply to that business. Any yes means it probably applies, at least to the people and activities concerned.

Write the answers down with your reasons. A dated note of how you reached your view is worth more than a vague memory of having thought about it.

A worked example

A two-person workshop in a small BC town builds acoustic guitars by hand and sells most of them to players across Canada and the United States.

Its website lists a dealer in the Netherlands, quotes shipping to Germany and France on request, and carries testimonials from players in both countries.

Against the test, the answer looked like yes. The workshop was offering goods to people in the EU, so GDPR would likely apply to its handling of their information from May.

The owners listed what they collected and where it went: the enquiry form, the email inbox, an order spreadsheet, the payment processor and a small newsletter.

They rewrote the privacy notice in plain words, removed a pre-ticked newsletter box, and set a period after which old enquiries are deleted.

They agreed who answers a request to see or delete someone's data, then booked an hour with a lawyer to check the result.

If the answer is no

Canadian privacy law still applies. PIPEDA covers much commercial activity, and certain provinces regulate private-sector privacy themselves; which rules apply depends on how and where a business uses personal information.

Many principles overlap with GDPR: collect what you need, say why, keep it safe, and let people see what you hold about them.

Expect software suppliers to update their terms because of GDPR over the coming months, whatever your answer. Read what they send rather than deleting it.

If the answer is yes or maybe

A business covered by GDPR needs a lawful basis for each use of personal information, a clear privacy notice, and a process for requests to see, correct or delete data.

Consent, where it is the basis, must be a clear action by the person, so pre-ticked boxes do not count. Breaches that put people at risk generally must be reported to the authorities within seventy-two hours.

Covered businesses outside the EU may also need a representative there, with an exception for occasional, low-risk processing without large-scale use of sensitive data.

Maybe is a common answer for a business with a handful of European customers. It is also a decision point: stop the activities that point at Europe, or treat those customers as covered and comply.

The counter-case

For many Canadian businesses, this will be a short exercise.

A local trade, clinic or shop serving its own community will usually answer no to all three questions in a few minutes, and May 25 changes nothing about its obligations.

The test is also less tidy than three questions suggest. The regulation is new, its reach outside Europe is untested, and some answers will only become clear with time.

That is a reason to write down your reasoning and take advice on the hard cases, not to skip the question. Answer the three questions now, and act on what they say.

Before May 25

1. Check for any EU establishment.
2. List the signs of offering to Europe.
3. Check your advertising for European targeting.
4. Write down the answers and your reasons.
5. Map what the website collects and where.
6. Take legal advice on any yes or maybe.
7. Read supplier notices about new terms.

Step five is worth doing whatever the answer, because knowing what your forms collect and where it ends up is the starting point for every privacy law that applies to you.

The wider preparation is covered in four months until GDPR.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.