hi welcome to another episode from our GDPR our IQ thought leadership series
here we'll be discussing how ecommerce businesses should manage personal data
the general data protection regulation or gdpr became enforceable beginning May
25th 2018 the legislation places scrutiny
on e-commerce websites for the way they collect the data of European citizens
management consulting firm Oliver Wyman predicts that six billion dollars in
penalties will be levied against non-compliant companies in the first
year of GDPR our enforcement the GDPR our enables stronger data protection
designed for the digital age where it's possible to shop online from our
Mobile's and smartphones to order a pizza or book a taxi ecommerce companies
can collect this information to provide more accurate and targeted advertising
however an individual can be identified by metadata related to their mobile
device or desktop the gdpr consists of a unified and clear set of rules to help
individuals gain control of their personal information under the GDPR our
e-commerce business is processing EU citizens personally identifiable
information or PII personal or sensitive personal data need to have legitimate
grounds for processing this classification is tied to consent
explicit consent is required to process sensitive personal data the gdpr
requires that consent be specific this is a significant change for e-commerce
organizations requiring clear affirmative action from individuals in
order to be able to hold personal data in your electronic systems the current
practice of relying on a customer silence inactivity or pre tick boxes is
no longer sufficient privacy concerns surrounding cookies has been an issue
for several years now recital 30 of the gdpr
mentions cookies an important update and requires robust opt-in consent personal
data like IP addresses and other information collected by cookies is now
no longer a corporate asset instead it's owned by the data subject to stay
compliant with the gdpr you will either have to abandon this
practice or obtain consent from your customers
there are many systems that could be used to collect personal data each needs
to be clearly identified and classified accordingly personal data should be kept
only for as long as necessary simply put if it's no longer needed
destroy it the gdpr doesn't state a timeframe for holding personal data the
ecommerce sites will have to decide how long they hold on to data subjects
personal data based on the purpose that data was processed for personal data
that is no longer needed must be erased to reduce the risk of inaccuracy
excessiveness the relevance out-of-date or using such data in error storage
limitation can also help you comply with other gdpr principles specifically the
data minimization and accuracy principles it's clearly inefficient to
store personal data that is not required which can lead to avoidable costs on
storage and security under the GDP our site owners may have to respond to
subject access requests larger and inaccurate data sets can make this much
more challenging than it need be ecommerce organizations should introduce
a data retention policy and document standard retention periods for different
categories of personal information retention policies must also be flexible
enough to allow for early deletion of personal data if appropriate most
ecommerce organizations store customer data in different places within their
technology landscape and their legacy systems do not support rapid deletion or
anonymization in the gbbr era the future is about managing data not just the
storage and infrastructure on which it sits individuals from the EU freely
provide their personal information to ecommerce sites the recent Facebook
Cambridge analytical Saga highlighted a case of invasion of privacy facilitating
data exploitation by some companies any breach must be reported to a local
supervisory authority within 72 hours of the business being aware of the issue
failure to notify can result in a penalty fine of up to 10 million euros
or 2% of global turnover negligent or intentional violation of GDPR can
result in a fine of up to 20 million euros or 4% of turnover
northern American ecommerce businesses are not exempt from the GDPR if they
market their products to EU markets they ought to incorporate stringent data
protection policies to avoid reputational damage and significant
fines thanks for watching the GDPR for e-commerce video subscribe to our
channel for more on how to tackle the EU GDPR and feel free to watch more videos
from our GDPR IQ series here don't forget to check out our website or
follow our social channels thanks again and looking forward to seeing you