Do I Really Need to Care About GDPR? Maybe.

Andrea Ferguson

Andrea Ferguson

President at AndiSites Inc.
Andi is founder and President of AndiSites Inc. She writes about website design and development, best practices, and random stuff her busy brain thinks would be useful.
Andrea Ferguson

August 7, 2018

Think GDPR (General Data Protection Regulation) doesn’t apply to your organization? You might want to think again.

The regulation could have implications you haven’t considered. And with related regulation being passed in California, it’s wise to take another look at your potential exposure.

“Compliance can be really burdensome, but making the first steps towards compliance doesn’t require a whole overhaul of everything you’re doing,” says Melissa Bailey, an attorney with the Brooks Pierce Law Firm in Raleigh, NC. “You can begin by evaluating your current data practices across the organization, revising your privacy policy and website terms of use as needed, updating your breach notification procedure if necessary, and adding an opt-in consent to data retention.”

Article 3 of the GDPR suggests that a non-EU-based company is subject to the new law if it processes personal data of an individual residing in the EU. To assess your current practices, ask yourself these questions:

  1. Where do we offer goods and services within and outside the U.S.?
  2. What personal data do we collect and where does it come from?
  3. How do we collect it and where is it stored?
  4. Who needs to have access to that information?
  5. Who’s responsible for that information?

If the answers to these questions leave you feeling like you might, indeed, need to comply, contact your attorney to get an expert opinion.

GDPR and State/Local Governments

It’s unlikely GDPR will apply to state and local governments, but if you do international marketing, you should take a closer look.

For instance, say the City of Raleigh launched a marketing campaign to get people from Germany to visit. “Since the campaign is targeted at people in the EU, it likely would fall under GDPR, which means the government organization or its marketing agency would need to be compliant,” Bailey says. Your take-away: Pay attention to who you’re targeting with your marketing, website, and campaigns. And where those people are located.

Higher Education: GDPR vs. FERPA

Colleges and universities are more likely to fall under GDPR. If your institution has campuses, programs and partners in the EU; if it markets to EU students to study here; or if its students go abroad, you need to pay attention to the regulation.

It’s the same if your faculty and staff do research that uses data from EU residents.

“In these cases, if the institution isn’t complying, what’s at stake isn’t just the penalties, but also the risk of losing the partnership with an EU institution,” Bailey cautions. “It’s also tempting to think that if you comply with FERPA, you’re complying with GDPR, but that’s not necessarily true.” That’s because the US and the EU/UK look at privacy differently. “Here, there’s not a fundamental right to privacy, while in the UK and EU, you do have fundamental right to privacy and to be forgotten.”

Medicine & Healthcare: GDPR vs. HIPAA

HIPAA is a US law ensuring the privacy and security of protected health information. “HIPAA applies to a defined group of ‘covered entities’ – generally health plans, health clearinghouses, and healthcare providers – and their ‘business associates’,” Bailey explains. She adds, “GDPR, on the other hand, has a much broader scope, both in terms of the type of data it applies to – generally, anything that is personally identifiable – and in terms of the entities within its reach – any entity that offers goods or services to citizens in the EU.”

 

Even if you don’t need to comply with GDPR, re-evaluating your data privacy and protection policies is a good idea. As more nations and states begin to enact their own versions of the regulation, a little advance work can make it easier to know if and how you need to comply.

Good News for WordPress Website Owners

WordPress has created a GDPR Compliance Team to develop and test data privacy tools for inclusion in the WordPress core.  The team is focusing on creating a comprehensive core policy, plugin guidelines, privacy tools, and documentation.

In the meantime, want to know more about making your WordPress website GDPR compliant? We recommend these reader-friendly resources:

 

DISCLAIMER: This information is not intended as a substitute for professional legal consultation; it’s provided “as is” without any representations or warranties, express or implied. Always consult an attorney when you have specific questions about any business matter of this kind.

Back to Blog