It's here!
If you have an e-commerce store and haven't heard of GDPR yet, pay attention!
With the General Data Protection Regulation (GDPR) now in effect, all companies worldwide that handle the data of individuals or services from European Union (EU) countries must comply with a new and complex set of security guidelines.
The European law, known as GDPR (General Data Protection Regulation), aims to protect the privacy of users on the continent with rules on how companies must handle users' personal data. The law will come into effect on May 25, 2018, and in the event of "non-compliance", companies can be fined up to 4% of their annual global revenue or €20 million (approximately R$80 million) — whichever is greater.
Various marketing and analytics systems will have to update their data retention policies. The new regulation empowers consumers and will force online retailers in 28 European Union countries to explicitly state how they are collecting, using, and storing consumers' personal data, such as name, location, IP address, and other e-commerce and app usage data.
In short: if you sell to or allow European citizens access to your website, you need to comply.
Since the internet has no borders, we will have no choice but to adjust our strategies if we want to continue selling to these consumers. After so many years of evolution, behavioral targeting will become unfeasible. We will return to segment-based marketing, giving up the benefits of one-to-one personalization that technology has brought. However, consumers can choose whether retailers use their data to provide a better shopping experience.
How to make your company compliant?
Hire a law firm specializing in Digital Law. But if you want to establish a benchmark for what your company is doing with user data, answer these questions:
- Do I need to collect data to run my business (and not to sell it to third parties)?
- Has your user been informed and given their approval (checked an unchecked box) that your company will collect data and how it will be used and shared?
- Has your company given the user a way to update this data?
- Has your company given the user a way to opt out and, in doing so, stop all processing of their data?
- Has your company given the user a way to permanently delete all collected data, notifying third parties to stop processing their data?
- Has your company given the user a way to download/export their data in a standard format (.json, .csv, .xls, etc.)?
- Did your company obtain the consent of all users before the GDPR deadline?
Tough, huh!? You probably haven't complied and it will take time to get compliant. If you are a small retailer or only a small fraction of your revenue comes from European customers, decide whether the potential risk outweighs the benefits of leaving the market. As new information and experiences from other players emerge, we will bring more information on how online retailers can comply with the legislation without compromising their store performance.
