If you are involved with the collection and management of personal data in your organization, you may already have 25 May marked on your office calendar. That’s when the EU’s new General Data Protection Regulation (GDPR) enters into force. You may also be thinking to yourself that this would be a good time to get your head around it.
While 25 May is indeed just around the corner, please Keep Calm. Be Prepared by making sure your organization is fully compliant from Day 1. It’s with that in mind that we have put together a few overall pointers for you, along with four specific advisory guidelines.
The GDPR is all about regulating the collection, storage, transfer and use of personal data on individuals in the European Union (EU). It also gives data subjects more rights and greater control over their data, by regulating how organizations handle and store the personal data they collect.
What matters is not necessarily where the data processing is taking place, but the location where the person whose data is being collected, namely inside the EU. So, if your organization is based outside the EU, but it collects or processes data – addresses, phone numbers, images, etc. – on individuals who are in any EU member state at the moment of data collection, the GDPR applies to you.
Don’t underestimate the implications of the GDPR; its enforcement provisions have been intensified compared to its predecessor. Violations can involve stiffer fines than before-up to 4% of a company’s global annual turnover.
Now, you may be thinking: “If all we’re doing is gathering insights, the GDPR probably doesn’t apply.” In fact, however, gathering customer feedback sometimes includes technical user data (for example an IP address) as well as personal information a user might provide on his own initiative (for example a home address). Keep in mind: all data that can help identify an individual is considered personal. Thus, location-based data, IP addresses and personal contact details are all considered privacy-sensitive data and are covered by the GDPR.
To provide you with the right information and be transparent about how we are implementing the changes ahead, we refer you to our support article. Compliance scores high on our agenda and we want you to know what measures we take to keep you safe in the digital world.
Below are four clear guidelines that help you get data settings right and make clear to your customers that their privacy is of paramount importance.
Be smart about what data you collect, take the time to truly understand and define what you need. In a less tightly regulated environment, it might have been fine to collect data subjects’ IP addresses – but in this new environment, you must ensure that all the data you collect is data you actually need. Is that information truly business critical to meet your research and measurement objectives? If not, simply exclude it by unticking the right boxes. In fact, because Usabilla believes in privacy by design the default settings help you to make the right choices. Indeed, the default is that IP addresses are not collected – though of course, you can change that if you do need them.
By capturing the customer experience visually, through a screenshot, you may inadvertently pick up personal data. That’s why Usabilla offers a simple way to mask the personal details that might otherwise be caught in an image. In fact, the software can detect sensitive information, and masks it as needed. You may also wish to take a look at this article to find out more about how to hide privacy-sensitive information.
Is it really a few years, or could just 90 days be enough? If there is no real need to keep data forever, it is wiser to think ahead for how long you actually need to store user’s data. And it makes sense to set that limit from the start.
It can happen that a user – without even realizing it – leaves personal data within their comments or answers. This can, and should, be avoided. But how?
First, it’s important to be clear about which channels serve which purposes. For instance, a Facebook page or feedback survey might not be the right place to complain about a delivery – and mention a home address in the process. The best thing to do in a case like this would be to direct the customer to a support page or a customer-service department.
Second, it’s a good idea to gently remind your customers that the answers in feedback surveys should not include personal data: simply include a standard message in the answer text box.
We felt that these pointers were worth highlighting-though, of course, there is much more to be said on the GDPR. Once it goes into effect, you can be sure we’ll be coming back to you with further insights and updates-so watch this space.
Professional Affiliations: I sit on the local Young Professionals at the Zoo Board, am an Ambassador for our YMCA Youth Tri program and am on Team Inspire for a local race company. I am also a mentor and speaker at the local law school for their health and women’s law groups
Previously, I served on the Susan G. Komen Board of Directors, was a member of the Chester Bedell Inns of Court, andwas President of the Jacksonville Women Lawyers and one of the Editors/Board Members for the FL Association of Women Lawyers.
Describe Your Role with USA Triathlon: Member of the Board of Directors. Member of ITU Womens Committee.
What drove you to the multisport lifestyle? I like to do a lot of things at the same time. Triathlon seemed like the perfect conduit.
Athletic Accomplishments: I love long events – running ultras, doing ironman and cycling centuries. I have been a member of Team USA from 2003-2007
and was lucky to race Kona 2012 with the inaugural legacy lottery spot. I started doing Ironmans in 2002 andam currently up to 62 completed irons. In 2012, I raced 18 iron distance races and participated in a total of 75 events.
Athletic Background: I didn’t find my real athletic self until Smith College where I attempted to race crew and played softball for 2 years.
I participate in all distances, serve as a mentor for newbies, volunteer at youth events and am currently training to be a USAT referee.
I enjoy traveling and the opportunity to meet so many wonderful athletes at all of the events I participate in.