An overview of the legal aspects of GDPR, the new EU data protection and privacy regulation, and how it will affect digital marketing. Presented at Mezzo Labs’ “Getting to Grips with GDPR for Digital Marketers” event in June and July 2017.

1. The Letter of the
Law
Raoul Lumb

2. THE LETTER OF THE LAW
BY RAOUL LUMB

3. THE WHAT?
• The “General Data Protection Regulation”
• European Regulation – replacing the Data Protection Act
• Does not replace the PECR (Privacy & Electronic
Communications Regulations)
• Implementation 25 May 2018

4. HOW DOES IT WORK?
• Maintains the eight Data Protection Principles:
• “Fair and Lawful” (the ‘conditions’ for processing)
• “Purposes”
• “Adequacy”
• “Accuracy”
• “Retention”
• “Rights” of data subjects
• “Security”
• “International Processing”
• Adds significant new fines (4% global turnover or €20 million)
• Adds extensive new duties

5. WHAT ARE THE IMPLICATIONS FOR
MARKETEERS?
• E-mail, Text, Telephone marketing – new standard of ‘consent’
• Opt-in now obligatory
• Opt-in must be voluntary
• Consideration of Principle 2 in all circumstances
• Data Processors (i.e. marketeers) can now be held liable per
Article 82
• Much of the risk can be mitigated by effective contracts

6. STORAGE OF RECORDS
• Duty to build in data protection by “Design & Default”
• Consideration to be given to ‘pseudonymisation’
• Need to be able to respond to subject access requests:
• How was data obtained? For what purpose? When?
• Need to be able to respond to new stop/update/erasure
requests
• Reporting of breaches now essentially mandatory within 72
hours

7. REPORTING AND RECORD KEEPING
• Boring but important – new records of processing must be kept
• Consider mapping ‘data-flows’
• All contracts appointing/engaging as a Data Processors must
meet new requirements
• Impact assessments to be performed before any significant
new processing
• Encryption to be seriously considered