Privacy

Before discussing how and why you should be collecting personal data, it’s important to define what personal data is, according to the GDPR.

“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;”¹

While the definition of ‘personal data’ under the GDPR is largely unchanged from its predecessor, the EU Directive, the inclusion of reference to “online identifiers” is potentially a major shift for marketers’ perception of the data they hold and how it should be handled. So, if you’re storing data about a person in a usable way, it probably relates to some identifier of a natural person (including online identifiers like device IDs, cookie IDs, etc) and is, as a result, personal data.

The tips below focus on GDPR requirements that should be considered at the point of collection.

Personal Data must be “Processed lawfully, fairly and in a transparent manner”²

Consent and Transparency

For all data covered by the above definition of personal data, you’ll need to be able to justify that you’re processing³ it lawfully. Consent is just one way of establishing that your processing activities are lawful under the GDPR, but it is likely going to be the one most applicable to the email marketer. Just as it has been with email marketing in the past, explicit, purpose-based collection, that is freely given is the highest standard for data collection and use policies. This means that there is no ambiguity as to the activities consented to or the organisation carrying out those activities.

Consent should be clear and unique to a specific organisation and each reason for processing. Methods like separate forms or separate, default unchecked boxes are obvious options. While there may be other, more creative options that are equally viable, it is important to ensure that clarity is not lost in the process. The transparency of your reasons for processing data is a requirement for building explicit consent. As always, data subjects should be able to withdraw their consent for each, or all, processing activity, and withdrawing consent should be as easy as giving it was.

As with all GDPR-related things, records keeping is vital to demonstrating compliance. Make sure that, however you decide to do this, these records support your consent-based legal grounds.

TIP: If you are relying on consent as the lawful basis for processing your subscriber’s data, we recommend evaluating your subscribe forms to ensure they comply with the consent principles encapsulated in the GDPR (specifically those in Articles 6 & 7 and Recitals 32, 33, 42, 43, and 171).

Personal Data must be “Collected for specified, explicit and legitimate purposes”⁴ and be “Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”⁵

Purpose Limitation

Obtaining explicit consent goes hand-in-hand with purpose limitation; at the point of data collection (for example, your online form), you should be completely transparent about the purpose for which personal data is being collected such that there should be no confusion regarding the purpose of collection. In addition, once you have collected data for a specified purpose, that data should not be used for another, incompatible purpose. Further, the purpose must be legitimate– in other words, it must not be in violation of applicable laws.

Data Minimization

Related to purpose limitation, personal data collected for an explicit purpose should be limited so that only data which is necessary to fulfill the consented-to purpose is processed. This means that you should carefully review the data being collected against the purpose it is meant to fulfill.

¹ Chapter I; Article 4(1)
² Chapter II; Article 5(1a)
³ Processing is defined as “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means” and includes collection, recording, storage, and other common activities.
⁴ Chapter II; Article 5(1b)
⁵ Chapter II; Article 5(1c)

As a marketing professional, especially in the context of using an email marketing application like Campaign Monitor, you will likely rely on consent (see: Consent and Purpose article) as the lawful basis for processing your subscriber’s personal data. While consent is not the only way to lawfully process personal data, at least one of the following grounds for lawfully processing personal data must apply (Art. 6 GDPR):

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject;
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

While it’s true that for most marketing activities, the industry tends to rely heavily on consent as the lawful ground for processing, it is up to you to analyze your data processing activities and choose the right justification(s). If you are unsure which of the lawful grounds listed in the GDPR apply to you, please consult with legal counsel to ensure processing activities are properly justified. As always, diligent record keeping is vital to support these justifications.

Risk and Appropriate Technical and Organisational Measures

While personal data is defined very broadly under the GDPR, the sensitivity of the data and the severity of harm that may result in the event of unauthorized access to the data, is not equal. This means that the measures by which you secure personal data (type of encryption, backup procedures, password requirements, etc.) may vary by data type and the processing activities undertaken using that data. The GDPR requires protection of personal data using “appropriate technical and organisational measures to ensure a level of security appropriate to the risk” throughout the life cycle of the data.

“In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default.” (GDPR- Recital 78)

The regulation does not prescribe any specific security mechanisms, but rather requires that data controllers and processors take into “account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons”⁶ should data be subject to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.

Some measures that the GDPR highlights are pseudonymisation and encryption, but the extent to which they represent a standard for data security is unclear. Until more clear guidance is released from the EU, we recommend keeping an eye out for guidance from industry thought leaders, trade organisations, and data security experts and organisations (like the National Institute of Standards and Technology, or NIST), but there may also be clarity in Member State laws and future documents issued from the EU governing body.

Regardless of your current security measures, the GDPR highlights the need for ongoing evaluation of risk to personal data and security measures based on product evolution.

Privacy By Design

The GDPR’s “Data Protection by Design and by Default” model, or more commonly, ‘privacy-by-design’ model, requires that principles of data protection should be taken into account at the product development phase rather than after data is being processed. By implementing appropriate technical and organisational measures, taking into account the nature and sensitivity of data types that will be processed, and ensuring that appropriate data minimization measures are implemented at the product (and feature) development phase, personal data is protected at all stages of its life cycle.

Data Breaches

If you’re getting a hint of that new-regulation smell, that’s because data breach handling and notification is a previously-untouched scope of data privacy law in the EU. In the GDPR, rules for how and when you should notify data subjects and/or relevant authorities are made more clear.

Notice from Controllers to Supervisory Authority:
For controllers, notice to the appropriate supervisory authority must be made “without undue delay and, where feasible, not later than 72 hours” after becoming aware of the breach with the following information⁷:

1. Describe the nature of the personal data breach including where possible,
   1. The categories and approximate number of data subjects concerned; and
   2. The categories and approximate number of personal data records concerned
2. Include the name and contact details of the data protection officer or other contact from whom more information may be obtained
3. Describe the likely consequences of the breach
4. Describe what the controller is doing to address the breach and/or mitigate possible adverse effects.

Throughout the process of identifying, measuring the scope of, and remediating the effects of the breach, records should be maintained to “enable the supervisory authority to verify compliance with this Article.”⁸

Notice from Processors to Controllers:
Processors must inform “the controller without undue delay after becoming aware of a personal data breach”.

Notice from Controller directly to Data Subject:
If the personal data in question represents “high risk to the rights and freedoms of natural persons,” the controller will need to notify the data subject without undue delay. This notification should include a description of the breach in clear, plain language that includes contact details for the appropriate person (DPO or otherwise), the likely consequences of the breach, and the current and future measures the controller will take to address the breach.

There are a few exceptions to the data subject notice requirement: where the controller employed safeguards or has taken subsequent action to render the risk of the breach inert, and where individual data subject outreach would require disproportionate effort. But as with any exception under the regulation, legal counsel should be sought before proceeding.

⁶ Article 32(1)
⁷ Article 33(3a-d)
⁸ Article 33(4)

1. Head over to https://help.campaignmonitor.com/s/article/dir-how-to-get-help
2. Ensure that you select “GDPR Request” as your main issue, and the appropriate subcategory of Deletion, Retrieval, or Rectification to indicate the specific GDPR rights you’d like to exercise.
3. Please provide the following information in the notes with your request (this part is important for us to be able to help as quickly and accurately as possible!):
   1. Full name of data subject, email address of data subject, username for account, admin email address of the account, Name of client account
4. Our Support team will be in touch with confirmation that we’ve received your request, and we’ll start processing for you as quickly as possible. You’ll receive confirmation when we’re all done and we’ll make sure to deliver any collateral in a secure format (if applicable).

If your subscriber’s personal data was provided to us in connection with any prior request for support or services, please indicate this when submitting the request to our Support team.

Last Updated April 6, 2022: Added Twilio and Bitly as sub-processors for SMS services.