 responsible for that data a third-party is collecting or processing data on your behalf.
What Happens If You Don’t Comply?
This part of GDPR is clear. If a company is in breach of GDPR, it can be fined, and the fine in question is quite serious. According to art. 83 of GDPR your company could receive a fine of up to 4% of the annual global turnover of the company or €20 million, whichever is higher.
- What data is being collected?
- How and why are you collecting it?
- How will you use it?
- Will you share it with anyone, and, if yes, who with?
Due to the explicit consent requirement, all your forms that concern data processing should be set to “No” by default.
GDPR also grants natural persons another right, the right to be forgotten (art. 17). At any time a person can request that their data be deleted from your database, to which you must comply. To make this task easier, you should make it simple for users to withdraw their permission.
Email Marketing List
Under GDPR, an email address is also considered personal data (art. 4). If you hold email records or email information through email marketing campaigns (for example, without asking for permission) you should go back and review those lists. Either delete all EU-based users from that list or ask all of them for permission.
Blocking IP Addresses
One of the solutions to avoid falling under GDPR is to block users from the EU from accessing your website.
However, if you decide on this approach you may still have to be careful in the implementation of the solution. In order to block users from the EU, your website will still have to process their IP address. According to GDPR’s definition of personal data, IP addresses are considered personal data and you can be fined for their processing and collection without the explicit consent of the user. However, there is a way to collect IP addresses for the purpose of blocking a user while still being compliant with GDPR.
One part of the GDPR gives the right to users not to be subject to decisions based solely on automated data processing. However, there is also a paragraph (par. 1b art. 6.) which states that this does not apply if the decision “is necessary for entering into, or performance of, a contract between the data subject and a data controller.”
So, you may state in your terms and conditions that your website is not for visitor use from the EU. Your terms and conditions serve as a contract between you and a visitor to your website; this means that blocking access to EU visitors is just an enforcement of that contract.
GDPR also protects European Economic Area countries, according to the “Third Countries” Issue. Some of these territories are not in Europe so you will have to block those countries as well. These are the Azores, Canary Islands, Guadeloupe, French Guiana, Madeira, Martinique, Mayotte, Reunion, and Saint Martin.
One more important thing when blocking IPs from the EU is to collect no other data besides the IP of the country from which the user is trying to access your website. Even if all that you know about the user is the country, they’ll still remain unidentifiable. To do this you should set your website to block users before your Google analytics, and any other data processing tools you might be using, start to collect data.
The EU-US Privacy Shield (Issue: Third Countries) is a framework created to allow the transfer of personal data from the EU to the US. The EU doesn’t allow the transfer of data to other countries unless they have adequate data protection laws. The US doesn’t meet this requirement so the Privacy Shield was created to correct this problem. It is the framework that certifies US companies as secure enough to transfer data outside of the EU.
Joining the Privacy Shield program is a good way to jump start your company on the road to becoming GDPR compliant. However, joining does not make you GDPR bulletproof. Even as part of the program, you should still double check if your business is completely GDPR compliant or you could pay enormous fines, as mentioned above.
GDPR is a law that will mos