Four Months Until GDPR

Four months from today

The European Union's General Data Protection Regulation applies from May 25, a little over four months from now.

Most of what has been written about it concerns large companies with offices in Europe. It can also apply to a small business in BC that has never set foot there.

What follows is information, not legal advice: when the regulation reaches a Canadian business, and what is worth doing now.

When it reaches a Canadian business

The regulation applies to organisations outside the EU in two situations: when they offer people in the EU goods or services, paid or free, and when they monitor the behaviour of people there.

A website Europeans can see is not enough on its own. Signs that count include prices in euros, delivery to EU countries, pages in German or Italian, and marketing aimed at Europeans.

A tour company on Vancouver Island taking bookings from visitors in Germany may well be covered. A plumber serving three towns in the Fraser Valley is very unlikely to be.

Monitoring means tracking and profiling, such as following visitors' behaviour to target advertising. Whether ordinary website statistics count is still debated.

What counts as personal data

• Names, email addresses and phone numbers from forms and bookings.
• Order and delivery details in the shop or invoicing system.
• Mailing list subscribers, and records of what they opened.
• IP addresses and cookie identifiers collected by analytics and ad tags.
• Notes about customers kept in spreadsheets or a contact manager.
• Health or dietary details asked for a booking.

The fourth surprises most owners. The regulation treats online identifiers as personal data, so the tags on a website collect it even when nobody fills anything in.

Why the list comes first

Almost everything the regulation asks of a business depends on knowing what it holds.

A privacy notice cannot say what you collect until you know. A customer's request to see their data cannot be answered within the month the regulation allows if nobody knows where to look.

Deciding what to delete, which suppliers to check and which forms to change all start from the same list.

It is also the slowest part, because the information is spread across systems, inboxes and people. Four months is enough time to make it. Four weeks would not be.

Four questions for each item

For each kind of personal data, write down four things.

What it is, specifically. Not customer information, but name, phone number, street address, and the notes the estimator types after a visit.

Why you collect it: quoting a job, delivering an order, sending a newsletter. If there is no answer, that is an answer.

Where it goes after collection. The inbox, the form plugin's database, the accounting software, a spreadsheet on somebody's laptop, the backups.

And who handles it for you, which deserves a section of its own.

The companies that process it for you

A small business rarely holds personal data alone. The host stores the website and its forms, an email service holds the mailing list, and booking, payment and analytics services each hold a share.

The regulation calls these processors, and expects written terms with each one covering how they handle the data.

Many of the larger services have said they will update their terms before May. Note which of yours have done so, and check again in the spring.

Note where each keeps the data, too. Many are in the United States, which matters to some customers and to the privacy notice you will eventually write.

A worked example

A small company in the Selkirk Mountains runs guided backcountry ski trips, and many of its guests come from Germany and Austria, booking through the website.

The owners started their list expecting a page of notes. It took three evenings.

The booking form asked about medical conditions and allergies, and the answers went from the shared inbox into a spreadsheet the guides kept on their phones. The regulation treats health information as especially sensitive.

The mailing list sat with an email service in the United States. Waivers were signed through another service, payments went through a third, and the website carried analytics and an advertising tag.

None of it was unreasonable, and none of it had been written down. With the list, they could see what to ask each supplier and which booking questions were really needed.

The medical question now asks only what the guides need for the trip, and the spreadsheet is deleted when the season ends.

Consent is one basis among six

A common misunderstanding is that the regulation requires consent for everything.

Consent is one of six lawful bases. Replying to an enquiry or running a trip somebody has booked rests on others, such as the contract itself or the business's legitimate interests.

Where consent is the basis, as with most marketing email, the standard is high: a clear action by the person, never a pre-ticked box, and a record of when and how they agreed.

Canada's anti-spam law already asks for much of this, so a mailing list built carefully under it is a good starting point.

What already applies in Canada

None of this is entirely new.

PIPEDA, the federal private-sector privacy law, already expects the businesses it covers to collect only what they need for stated purposes, protect it, and let people see what is held about them.

Some provinces have private-sector privacy laws of their own, and where and how a business collects and uses personal information decides which one applies.

So the list is worth making even if the European rules never reach you. It is the housekeeping the Canadian rules already assume.

The counter-case

For many BC businesses, the regulation will not apply at all.

A business with only local customers, no sales to Europe and no advertising aimed at Europeans has a much smaller job: the list, for Canadian purposes, and perhaps a clearer privacy notice.

A business with significant European sales has a larger one, and should have a lawyer look at it before May rather than relying on any general article, this one included.

Either way, the first step is the same: list what personal data you collect, why, where it goes, and who processes it for you.

This month

1. Check where your customers live.
2. List every kind of personal data you collect.
3. Write down why you collect each one.
4. Trace where each one goes after collection.
5. Name every company that processes it for you.
6. Delete what nobody needs any more.
7. Book a legal review if Europe matters to you.

Step four is the one that takes longest and surprises most, because personal data rarely stays where it was collected. It spreads into inboxes, spreadsheets and phones.

Consent for a mailing list under Canada's own rules is covered in building the list Facebook cannot take away.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.