Most enterprises are either prioritizing data privacy compliance or already implementing privacy compliance strategies and technologies. However, many organizations still find the monumental task overwhelming and difficult to understand.
The EU’s GDPR laws are top-of-mind due to their stringent requirements and high fines for serious offenses, followed closely by California’s CCPA. But Brazil’s LGPD has been enacted, Virginia just became the second state to pass privacy legislation, and other states from Nevada to Utah, Washington, New York, Vermont, and Maine will be coming online soon.
Gartner forecasts that by the end of 2023, 75% of the world’s population will have its personal data covered under modern privacy regulations. That means that compliance is only going to get more complicated.
While the space is extremely dynamic right now, we thought it would be wisest to look at three pain points companies are experiencing with GDPR since it has the strictest regulations, and other countries are trending toward enacting similar data privacy laws. Then we’ll give quick suggestions on how to address those pain points and some tips.
1) Collecting personal data in a transparent and secure manner
Requirement: Article 5 of the GDPR states that personal data shall be processed lawfully, fairly, and in a transparent matter. Personal data should be collected for specified and legitimate purposes and processed in a manner that ensures appropriate security of personal data, including protection against accidental loss, destruction, or damage.
How To Meet It:
- Many companies have trouble defining what personal data is, so clear definitions should be a first step in training.
- Be as specific and transparent as possible in your privacy policies.
- Discuss privacy compliance with any third-party data processing partners you use since their vulnerability is also your responsibility or use vendor risk assessments.
- Breaches are not under your control, but you can encrypt or anonymize personal data; companies have been fined for not taking basic security measures such as this.
Tips: Make sure your privacy policy is clearly written, understandable, and available at all points of entry into your digital property.
Using ObservePoint’s Privacy Compliance solution, you can set up a custom Rule to audit your site and ensure your privacy policy is always live and accessible.
2) Processing personal data lawfully
Requirement: Article 6 of the GDPR outlines six lawful reasons for processing personal data such as to meet the requirements of a contract or for a task in the public interest, but the one that most companies can meet in relation to their marketing efforts is the first one: the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
How To Meet It: Install a Consent Management Platform (CMP) like OneTrust, Tealium, or TrustArc on your site or implement an application that provides a way for you to collect consent with a cookie banner. CMPs integrate with your tag management systems to track customer preferences and are powered by a database of laws to offer privacy and security solutions.
Tips:
- When marketing to customers, we think of getting them on a path to conversion. It’s helpful to think of acquiring consent as the first conversion, which will allow you to continue giving your customer a good experience.
- We’re used to zeroing in on a specific pathway and making sure tags are firing when monitoring a marketing campaign. Privacy compliance now requires us to think of it more broadly and monitor the entirety of our site or app to make sure consent is offered and honored at all points.
- Make sure your Consent Management Platform is implemented and performing correctly. Just like any third-party technology, your CMP needs to be audited and monitored by a team tasked to QA its performance.
By using ObservePoint’s Tag Initiators feature, you can easily visualize your tagging architecture and identify any hard-coded, piggybacking, or unauthorized tags that aren’t being delivered by your tag management system and are therefore invisible to your CMP.
3) Transferring data to third parties
Requirement: While the EU does not want to hinder the free movement of personal data and has made many provisions as to how it can be done legally in Articles 44-50, the Court of Justice of the European Union ruled on July 16, 2020 that any cloud services hosted in the U.S. are incapable of complying with the GDPR and EU privacy laws due to our surveillance laws.
How To Meet It: The safest way to comply with this requirement is to have servers in Europe store and process the data you collect on EU residents. If you do not have co-location services in Europe, consider third party vendors who do.
Tips: Monitor the geolocation of your EU customers’ personally identifiable information to make sure they’re staying in Europe or other approved countries.
Privacy Compliance from ObservePoint enables you to set up consent profiles with allowed tags, cookies, domain requests, and geolocations. Then you can mimic a customer’s journey through your site or app to monitor if you’re dropping cookies and collecting data according to their preferences and where you are sending that data.
In Conclusion
If you haven’t already, it’s time to start thinking more specifically about privacy compliance with GDPR and other laws, so that you can take the necessary steps toward getting your organization compliant and offering a better customer experience. ObservePoint’s Privacy Compliance solution was built to automatically monitor your Consent Management Platform, your Tag Management System, and the geolocation of your network requests to help you maintain trust with your customers and protect your brand’s reputation.
This blog is for informational purposes only. The information contained herein should not be considered legal advice, a contractual commitment, or advice on how to meet the requirements of any applicable law. It is provided “AS IS” without guarantee or warranty as to the accuracy or applicability of the information to any specific situation or circumstance. If you require legal advice on the requirements of privacy laws or advice on the extent to which ObservePoint’s technologies can assist you, you are advised to consult a suitably qualified legal professional. If you require advice on the technical and organizational measures that are required to deliver operational privacy and security in your organization, you should consult a suitably qualified privacy professional. No liability is accepted by any party for any harms or losses suffered in reliance on the contents of this publication.
