{"id":618,"date":"2018-02-26T10:41:44","date_gmt":"2018-02-26T08:41:44","guid":{"rendered":"https:\/\/subsign.co\/stories\/?p=618"},"modified":"2018-04-10T17:26:25","modified_gmt":"2018-04-10T14:26:25","slug":"google-analytics-gdpr-compliance","status":"publish","type":"post","link":"https:\/\/subsign.co\/stories\/google-analytics-gdpr-compliance\/","title":{"rendered":"Google Analytics and GDPR Compliance."},"content":{"rendered":"<p class=\"article__para\"><span style=\"font-weight: 400;\"><b><i>Disclaimer<\/i><\/b><i><span style=\"font-weight: 400;\">: I am not a lawyer and this article is based on my own research and interpretation of the General Data Protection Regulation (GDPR) and e-Privacy Regulation.<\/span><\/i><\/span><\/p>\n<h2 class=\"article__heading\">GDPR Overview<\/h2>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">General Data Protection Regulation (GDPR) will come into effect on May 25th, 2018.<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">The GDPR imposes new rules on organizations in the European Union (EU) and those that offer goods and services to people in the EU, or that collect and analyze data tied to EU residents, no matter where they are located. <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Enhanced personal privacy rights;<\/li>\n<li class=\"article__list-item\">Increased duty for protecting data;<\/li>\n<li class=\"article__list-item\">andatory breach reporting;<\/li>\n<li class=\"article__list-item\">Significant penalties for non-compliance;<\/li>\n<\/ul>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">GDPR clarifies where responsibility for privacy protection lies with any companies who collect, store, manage, process and analyze any form of Personal Data. Applies to any organization (including those outside the EU) that holds or processes data from EU residents. <\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">It repeals the current Data Protection Directive (DPD) 95\/46\/EC, but complements the recently introduced NIS directive 1148\/2016.<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">It consists of 99 articles and 173 recitals and breaches could lead to fines: <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Major breaches &#8211; up to \u20ac20 million or 4% of global annual turnover;<\/li>\n<li class=\"article__list-item\">Less important breaches &#8211; up to \u20ac10 million or 2% of global annual turnover;<\/li>\n<\/ul>\n<h2 class=\"article__heading\">Internal GDPR stakeholders<\/h2>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Legal (covering both EU &amp; local law);<\/li>\n<li class=\"article__list-item\">Organizational (governance &amp; management);<\/li>\n<li class=\"article__list-item\">Procedural (operations, policies &amp; procedures);<\/li>\n<li class=\"article__list-item\">Technical (IT &amp; technology investments);<\/li>\n<li class=\"article__list-item\">Involvement is also needed from all other departments: HR, Marketing, Financial, Customer Service, etc.<\/li>\n<\/ul>\n<h2 class=\"article__heading\">New items contained within GDPR<\/h2>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Mandatory data breach notification (72 hours) ;<\/li>\n<li class=\"article__list-item\">Semi-mandatory DPO (Data Protection Officer);<\/li>\n<li class=\"article__list-item\">Explicit and implicit consent;<\/li>\n<li class=\"article__list-item\">Data minimization &amp; pseudonymization;<\/li>\n<li class=\"article__list-item\">Mandatory DPIAs (Data Protection Impact Assessments);<\/li>\n<li class=\"article__list-item\">Privacy notices &#8211; more robust, concise, transparent and accessible;<\/li>\n<li class=\"article__list-item\">They must explain personal data processed, purpose of processing, intended retention, subject rights, source of data, conditions of processing;<\/li>\n<li class=\"article__list-item\">New additions to personal data definitions: Online identifiers, device identifiers, cookie IDs, IP addresses, pseudonymized data, sensitive data now includes genetic and biometric data as well;<\/li>\n<\/ul>\n<h2 class=\"article__heading\">Digital media\/marketing gets impacted<\/h2>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Collecting personal data from users\/customers;<\/li>\n<li class=\"article__list-item\">Email marketing \u2013 validating consent and data sources;<\/li>\n<li class=\"article__list-item\">User data \u2013 applying the \u201cright to be forgotten\u201d;<\/li>\n<li class=\"article__list-item\">Respecting browser cookie policies;<\/li>\n<li class=\"article__list-item\">The need for explicit consent being granted beforehand;<\/li>\n<li class=\"article__list-item\">Monitoring users through behavior tracking tools needs to be clearly and obviously stated;<\/li>\n<\/ul>\n<h2 class=\"article__heading\">Explicit consent<\/h2>\n<blockquote class=\"article-quote\"><p>\u201cAny freely given, specific, informed and unambiguous indication of the data subject&#8217;s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her\u201d<\/p><\/blockquote>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">You can process data without consent if it\u2019s necessary for: <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">A contract with the individual;<\/li>\n<li class=\"article__list-item\">Compliance with a legal obligation;<\/li>\n<li class=\"article__list-item\">Vital interests;<\/li>\n<li class=\"article__list-item\">A public task;<\/li>\n<li class=\"article__list-item\">Legitimate business interests;<\/li>\n<li class=\"article__list-item\">Anything else needs explicit, unambiguous consent to be granted;<\/li>\n<li class=\"article__list-item\">Demonstrable by a statement or clear affirmative action;<\/li>\n<li class=\"article__list-item\">Silence or pre-ticked \u201cI agree\u201d boxes are not explicit consent!<\/li>\n<\/ul>\n<h2 class=\"article__heading\">Key changes needed for GDPR<\/h2>\n<p class=\"article__para\"><span class=\"text-bold\">A. Personal Privacy<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Individuals have the right to: <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Access their personal data;<\/li>\n<li class=\"article__list-item\">Correct errors in their personal data;<\/li>\n<li class=\"article__list-item\">Erase their personal data;<\/li>\n<li class=\"article__list-item\">Object to processing of their personal data;<\/li>\n<li class=\"article__list-item\">Export personal data.<\/li>\n<\/ul>\n<p class=\"article__para\"><span class=\"text-bold\">B.\u00a0 Controls and Notifications<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Organizations will need to: <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Protect personal data using appropriate security;<\/li>\n<li class=\"article__list-item\">Notify authorities of data breaches within 72 hours;<\/li>\n<li class=\"article__list-item\">Obtain appropriate consents before processing data;<\/li>\n<li class=\"article__list-item\">Keep records detailing data processing;<\/li>\n<\/ul>\n<p class=\"article__para\"><span class=\"text-bold\">C. Transparent Policies<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Organizations are required to: <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Provide clear notice of data collection;<\/li>\n<li class=\"article__list-item\">Outline processing purposes and use cases;<\/li>\n<li class=\"article__list-item\">Define data retention and deletion policies;<\/li>\n<\/ul>\n<p class=\"article__para\"><span class=\"text-bold\">D. IT and Training<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Organizations will need to: <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Train privacy personnel &amp; employee;<\/li>\n<li class=\"article__list-item\">Audit and update data policies;<\/li>\n<li class=\"article__list-item\">Employ a Data Protection Officer (recommended);<\/li>\n<li class=\"article__list-item\">Create &amp; manage compliant vendor contracts;<\/li>\n<\/ul>\n<h2 class=\"article__heading\">Keep your process simple.<\/h2>\n<p class=\"article__para\"><span class=\"text-bold\">1. Discover<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Any data that helps you identify a person. <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Name, email address, social media posts, location.<\/li>\n<li class=\"article__list-item\">Medical information, physical, physiological, or genetic information.<\/li>\n<li class=\"article__list-item\">Bank details, IP address, cookies, cultural identity.<\/li>\n<li class=\"article__list-item\">Identify where personal data is collected and stored.<\/li>\n<li class=\"article__list-item\">Emails, documents, databases, removable media.<\/li>\n<li class=\"article__list-item\">Letters, contracts, employee HR data.<\/li>\n<li class=\"article__list-item\">CRMs, ERPs, file shares.<\/li>\n<li class=\"article__list-item\">Metadata, log files, backups.<\/li>\n<\/ul>\n<p class=\"article__para\"><span class=\"text-bold\">2. Manage<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Defining policies, roles and responsibilities for the management and use of personal data. <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">At rest, in process, in transit.<\/li>\n<li class=\"article__list-item\">Storing, recovery.<\/li>\n<li class=\"article__list-item\">Archiving, retaining, disposal.<\/li>\n<li class=\"article__list-item\">Organizing, classifying and labeling data to ensure proper handling.<\/li>\n<li class=\"article__list-item\">Types, sensitivity, context \/ use.<\/li>\n<li class=\"article__list-item\">Ownership, custodians, administrators, users.<\/li>\n<\/ul>\n<p class=\"article__para\"><span class=\"text-bold\">3. Protect<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Protecting your data through appropriate security.<\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Physical datacenter protection, network security, storage security<\/li>\n<li class=\"article__list-item\">Identity management, access control, encryption<\/li>\n<li class=\"article__list-item\">Compute security, risk mitigation<\/li>\n<li class=\"article__list-item\">Monitoring for and detecting system intrusions<\/li>\n<li class=\"article__list-item\">System monitoring, disaster recovery<\/li>\n<li class=\"article__list-item\">Breach identification, notifying DPA &amp; customers<\/li>\n<li class=\"article__list-item\">Calculating impact, planned response<\/li>\n<\/ul>\n<p class=\"article__para\"><span class=\"text-bold\">4. Report<\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Enterprises will need to record the following info: <\/span><\/p>\n<ul class=\"article__para\">\n<li class=\"article__list-item\">Purposes of processing, classifications of personal data.<\/li>\n<li class=\"article__list-item\">Third-parties with access to the data, data retention times.<\/li>\n<li class=\"article__list-item\">Organizational and technical security measures.<\/li>\n<li class=\"article__list-item\">Implement reporting capabilities.<\/li>\n<li class=\"article__list-item\">Cloud services (processor) documentation, audit logs.<\/li>\n<li class=\"article__list-item\">Breach notifications, handling data subject requests.<\/li>\n<li class=\"article__list-item\">Governance reporting, compliance reviews.<\/li>\n<\/ul>\n<h2 class=\"article__heading\">Resources<\/h2>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">GDPR website: <a class=\"article__link\" href=\"http:\/\/www.eugdpr.org\/\" target=\"_blank\" rel=\"noopener\">http:\/\/www.eugdpr.org\/ <\/a><\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">GDPR key changes: <a class=\"article__link\" href=\"http:\/\/www.eugdpr.org\/key-changes.html\" target=\"_blank\" rel=\"noopener\">http:\/\/www.eugdpr.org\/key-changes.html <\/a><\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Full GDPR text: <a class=\"article__link\" href=\"http:\/\/ec.europa.eu\/justice\/data-protection\/reform\/files\/regulation_oj_en.pdf\" target=\"_blank\" rel=\"noopener\">http:\/\/ec.europa.eu\/justice\/data-protection\/reform\/files\/regulation_oj_en.pdf <\/a><\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">Browsable GDPR tex: <a class=\"article__link\" href=\"http:\/\/www.privacy-regulation.eu\/en\/index.html\" target=\"_blank\" rel=\"noopener\">http:\/\/www.privacy-regulation.eu\/en\/index.html<\/a><\/span><\/p>\n<p class=\"article__para\"><span style=\"font-weight: 400;\">ANSPDCP: <a class=\"article__link\" href=\"http:\/\/www.dataprotection.ro\" target=\"_blank\" rel=\"noopener\">http:\/\/www.dataprotection.ro<\/a><\/span><\/p>\n<p class=\"article__para\">\n","protected":false},"excerpt":{"rendered":"<p>Disclaimer: I am not a lawyer and this article is based on my own research and interpretation of the General Data Protection Regulation (GDPR) and e-Privacy Regulation. GDPR Overview General Data Protection Regulation (GDPR) will come into effect on May 25th, 2018. The GDPR imposes new rules on organizations in the European Union (EU) and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":630,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-618","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-development","category-marketing"],"acf":[],"_links":{"self":[{"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/posts\/618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/comments?post=618"}],"version-history":[{"count":13,"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/posts\/618\/revisions"}],"predecessor-version":[{"id":926,"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/posts\/618\/revisions\/926"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/media\/630"}],"wp:attachment":[{"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/media?parent=618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/categories?post=618"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/subsign.co\/stories\/wp-json\/wp\/v2\/tags?post=618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}