mation” should be interpreted, your answer should be as broad as possible.
It should go without saying that personal information such as ID numbers and location data are considered personal data. Any information that details genetic, mental, commercial, cultural, or any other form of person identity may also be considered personal data and, therefore, the law applies.
Even subjective information, such as opinions, may be considered personal data if it can be used to identify a person, according to art. 4 of GDPR.
Here’s a handy personal data list to reference:
- Name, ID, phone number, credit card information, email address and physical address
- IP address, cookie history, and location
- Gender and sexual orientation
- Biometric data
- Racial, cultural, and ethnic data
- Political opinions
- Brand preferences
- Any other form of personal information or opinion you can think of
What Does It Mean to Be GDPR Compliant?
The last two sections make GDPR look like a big, scary document waiting to fine you. Yes, GDPR is a serious document, but it actually isn’t that scary. With GDPR in power you can still collect and process any personal data but you have to do it with the explicit consent and transparency from those whose data you are processing, according to articles 7 and 5 of GDPR.
“Transparency” means that you can’t process the data of EU citizens without telling them what data you are processing and for what purposes.
“Explicit consent” means that you can’t process EU citizens’ personal information if they refuse or you have pre-checked boxes on your consent form that they have checked.
As long as you have clearly explained what data you are collecting and processing, and visitors to your website explicitly consented to that data being collected, you should be fine. Don’t forget, though, that all of this has to happen before you have collected any personal information from them.
You should also be careful when using any third-party tools that process personal data. According to GDPR art. 4, you could still be held responsible for that data a third-party is collecting or processing data on your behalf.
What Happens If You Don’t Comply?
This part of GDPR is clear. If a company is in breach of GDPR, it can be fined, and the fine in question is quite serious. According to art. 83 of GDPR your company could receive a fine of up to 4% of the annual global turnover of the company or €20 million, whichever is higher.
- What data is being collected?
- How and why are you collecting it?
- How will you use it?
- Will you share it with anyone, and, if yes, who with?
Due to the explicit consent requirement, all your forms that concern data processing should be set to “No” by default.
GDPR also grants natural persons another right, the right to be forgotten (art. 17). At any time a person can request that their data be deleted from your database, to which you must comply. To make this task easier, you should make it simple for users to withdraw their permission.
Email Marketing List
Under GDPR, an email address is also considered personal data (art. 4). If you hold email records or email information through email marketing campaigns (for example, without asking for permission) you should go back and review those lists. Either delete all EU-based users from that list or ask all of them for permission.
Blocking IP Addresses
One of the solutions to avoid falling under GDPR is to block users from the EU from accessing your website.
However, if you decide on this approach you may still have to be careful in the implementation of the solution. In order to block users from the EU, your website will still have to process their IP address. According to GDPR’s definition of personal data, IP addresses are considered personal data and you can be fined for their processing and collection without the explicit consent of the user. However, there is a way to collect IP addresses for the purpose of blocking a user while still being compliant with GDPR.
One part of the GDPR gives the right to users not to be subject to decisions based solely on automat