The GDPR Deadline Looms: Is Your U.S. Website Ready?

No.

Requirement

Steps to Consider

1

Limit data usage to the purpose(s) for which data was collected.

If the use of personal data will go beyond the immediate purpose for which personal data was collected (for example, to complete a sale), the operator generally will likely need to obtain the clear and unambiguous informed consent of the consumer unless (i) it has a “legitimate interest” in the use of such data, or (ii) in the event one of the limited express exceptions under GDPR applies. See point 3 below discussing the consent and “legitimate interest” approaches.   

2

Inform EEA residents about the use of their data

The company’s privacy policy should both accurately and fully reflect its practices and address the wide array of requirements and disclosures mandated by GDPR. Some GDPR requirements that may be less-familiar to U.S. operators include:

• A required statement of the purpose for which personal data is collected and processed.
• The legal basis for processing data. See Point 3 below on consent.
• The categories of third parties with whom the data is shared.
• A disclosure of how long the data will be stored.
• A statement of the EAA data subject’s rights. For example, the right (i) to request access to, correction, or erasure of the data, (ii) the right to object or restrict the processing, and (iii) the right to data portability.
• Where consent is given, the right to withdraw the consent at any time without affecting the lawfulness of any processing made prior to the withdrawal.
• The right to lodge complaints with the relevant data protection authorities.

3

Consent or “Legitimate Interest” as basis for  additional uses of data

The use of personal information to engage in targeted marketing or certain other activities that invoke the application of GDPR typically will require either the consent of the consumer, or the ability of the operator to demonstrate its “legitimate interest” in the marketing activity is not overridden by the consumer’s fundamental rights and freedoms requiring protection of personal data. The consent and the legitimate interest requirement are discussed separately, followed by a brief summary of the additional requirements for e-mail marketing.

Consent:  Consent for marketing or sharing must be freely given, specific, informed, and unambiguous. Where required, consent has to be (a) voluntary (it cannot be a condition of using a site or service), (b) specific as to each type of use of data beyond the immediate transaction, (c) written in plain language an ordinary consumer can understand, and (d) unambiguously communicated, and not assumed based on merely continuing to use a site or otherwise not taking an affirmative step to opt out. Pre-checked boxes specifically are rejected.

Legitimate Interest. The scope of the “legitimate interest” basis is not fully clear as of this writing but may be illuminated by future guidance from the European authorities. A portion of the GDPR refers to “direct marketing” as possibly fitting within an operator’s legitimate interests. However, relying on that theory requires the operator to conduct a formal internal “legitimate interests assessment,” including a determination of why the processing of personal data is necessary for the marketing activity, what benefits the company and its customers stand to gain, what potential harms the consumers face, whether the particular uses are consistent with the consumers’ reasonable expectations, whether any less-intrusive options were available, and other factors.

The main advantage of relying on “legitimate interest” is the ability to avoid obtaining affirmative consent, and the consumers’ corresponding ability to revoke consent (though the consumer can lodge an objection to the data uses with the data protection authorities at any time thereby triggering an opportunity for the operator to seek to defend its practices).  The main disadvantage is the uncertainty at this time about the scope of what will be accepted as a “legitimate purpose” for marketing purposes.

Email Marketing. U.S. companies that wish to send marketing communication to consumers in the EEA by email also should consider the specific requirements for unsolicited electronic communications imposed by the EU E-Privacy Directive (which is currently under review and likely to be replaced by a new E-Privacy Regulation within the next year). The Directive prescribes that marketing emails may only be sent to individuals who have given their prior consent and does not recognize legitimate interest as a viable alternative. Consent is not necessary where the marketing is directed to existing customers and relates to products or services that are similar to those previously sold to the consumer as long as the consumer is sufficiently given the opportunity to object to the use of their email address.   

4

Adopt Internal Data Security Measures

Implement and maintain appropriate technical and organizational measures to ensure an appropriate level of security for personal data.   

5

Execute data processing agreements with third party service providers (sub-processors)

Data processing agreements with cloud service providers and other third party service providers which process personal data of EEA residents on the operator’s behalf must include a number of provisions.  A partial list of some types of mandatory provisions a U.S.-based company might not expect includes the following (along with many other requirements):  

• subject-matter, duration, nature, and purpose of the processing.
• type of personal data and categories of data subjects.
• operator’s obligations and rights vis-à-vis the service provider.
• the service provider’s obligation to:
  • process personal data only on the operator’s documented instructions.
  • ensure that all personnel authorized to process personal data have committed to confidentiality.
  • implement appropriate technical and organisational measures to ensure data security.
  • assist the operator in responding to requests from EEA  residents and fulfilling its data compliance obligations to such individuals.
  • delete or return all personal data upon termination of the services.
  • submit to an audit of its data processing procedures.

6

Respond to individual requests by data subjects regarding the processing of their data

Implement appropriate procedures for responding to individual requests from EEA residents regarding their personal data rights, which may include:

• request to be informed about and to access their personal data that the operator is processing (right of access).
• request to rectify inaccurate parts of their personal data (right to rectification).
• request to erase their personal data where the operator is not or no longer allowed to process such data (right to erasure).
• request to restrict the processing of their data (e.g., in cases where the accuracy of the data is disputed) (right to restriction of processing).

7

Notify DPAs of data breaches

Implement appropriate procedures for notifying the relevant data protection authorities of a data breach concerning personal data of EEA residents.

8

Maintain a record of processing activities

If a company has more than 250 employees, it must maintain a record of processing activities which must be made available to the relevant data protection authorities upon request.

9

Delete personal data

Delete all personal data of persons residing in the EEA where such data is no longer necessary for fulfilling the purpose for which the data were collected, unless retention is required by applicable law.

10

Designate a representative in the EEA

Designate in writing a representative in the EEA to be available to respond to requests by the EU data protection authorities or persons in the EEA on issues relating to the processing of personal data under GDPR.