Why GDPR matters and everything you need to know about it from the experts

Whilst this article has been drafted in collaboration with Digital Law, specialists in the field of data protection, it should not be construed as legal advice. The information contained within the article is provided for informational and educational purposes only. If legal advice relating to the topics mentioned is needed, please contact a legal professional.

– – – – – – – – – – – – – – – – – – – – – – –

Are you clued up when it comes to Data Protection Regulations for your clients?

We get that it’s a topic that’s about as dry as unbuttered toast. But if you have a business that collects and handles personal data from clients, it’s essential to know how to be compliant.

Here’s some food for thought if you’re not thinking about this already.

Do you know if your business can keep customers’ personal data forever? Could low-cost one-stop shop website building tools be opening your business up to possible UK GDPR breaches? Are you using WhatsApp for business related purposes?

These are some of the most common and important questions when it comes to keeping your customers’ data safe.

Rather than you land a huge fine, we’ve compiled all you need to know in these frequently asked questions about GDPR below with guidance from our legal partner, Digital Law. We can’t promise that it’s light reading, but by the end you’ll understand all you need to about protecting customer data – from how long you should store it to the importance of knowing the location of your servers.

Need help with this?

Honestly, we get asked about this a lot. So we decided to partner up with our legal partners to provide an optional service that you can take us up on so that you don’t have to worry about this side of your business. We’ll handle it all as part of our process. This can be built into a new site or made as updates to an existing one.

Our partners, Digital Law, are are the only UK law firm to specialise only in online, data and cyber law, and offer expert advice in this area, with clients ranging from start-ups through to SMEs and multinational businesses. They’ve been advising on data protection for more than a decade, so save this guide from them if you need to.

Or let’s talk more if you need this taking care of by the Herron team and our legal partner.

FAQ’s

What is personal data?

Personal data is defined under the UK General Data Protection Regulation (GDPR as you may know it) and the Data Protection Act 2018 (DPA’18) as:

“Personal data means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Examples of personal data include:
– Name
– Postal address
– Email address
– Telephone number
– IP address
– GPS/location data
– Photographs
– Video and audio recordings (such as CCTV footage).

Put simply, personal data is any data that identifies a living person.

Am I processing personal data?

Most businesses will be collecting personal data in one way or another. The key is to assess what personal data is being collected and the volume. A starting point would be to look at the ways in which you are gathering information. Below is a list of examples, including what personal data might be collected via that specific approach:

• Contact forms and enquiries: these would likely record an individual’s full name, email address and phone number, along with any other personal data that may be contained within their query.

• Chatbots: these may also collect the above information as well as additional identifiers such as geographical location and your IP details.

• Customer/client onboarding process: once again, you will probably be collecting the basic contact information. However, a law firm for example, will also collect copies of ID for due diligence purposes.

It is important to consider that though we live in an age which is dominated by technology, personal data can also be collected on hardcopy paper. This collection, while often overlooked, is just as important to safe guard as electronic data.

While these are examples, there are many ways that this data can be collected. More often than not, most businesses will be collecting or processing personal data. Where this data is then collected and processed UK GDPR and DPA’18 applies.

What systems am I safe to use? Should I be using free document sharing platforms and tools?

When starting a new project, whether you are a startup company or a well-established company, project funding can be tight. It is very easy to consider using freely available tools to cut costs, such as free document sharing platforms.

These free platforms enable you to collaborate on documents more easily however, they are not always secure. For a number of reasons, these tools can be susceptible to malware and phishing attacks, meaning that a system can be taken down by using a variety of free online tools. Alongside the cyber security vulnerabilities, there are also UK GDPR issues with many free tools relating to compliance. Specifically with some platforms you cannot be sure exactly where your personal data is being held. Therefore, if your data is being stored outside the European Economic Area (“EEA”) you may be in breach of UK GDPR if the appropriate safeguards are not in place and have not been verified.

What happens if there is a breach?

A breach covers a broad range of possible scenarios. A breach may include any of the following:
– An accidental breach of personal data by an employee (for example, sending an email to the wrong recipient).
– A cyberattack that results in data being stolen from the business.
– An employee leaving records that include personal data on a train.

Should a breach occur, you could be fined by the UK Information Commissioner’s Office (ICO) for up to 4% of your global annual turnover or €17.5 million, whichever is greater. However, a growing trend highlighted by the current Information Commissioner, John Edwards, is the use of reprimands. Reprimands, unlike fines, cannot be appealed. They stay on public record and cannot be easily removed. Unless you want a judicial review…

The real damage however, does not always come from the long arm of the regulator. Reputational damage can have a huge effect on a business, including a loss of business and revenue.

How should I build my website? Should I be using free website building tools and platforms?

Often when starting a new project, whether you are a startup company or a well-established company, project funding can be tight. It is simple to consider using freely available tools to cut costs, such as free or budget website building and hosting platforms.

During these initial stages, is easy to see flashy adverts advertising a one-stop shop for website building.

However, using these tools can open you up to possible UK GDPR breaches. This is because often there are hidden ‘small print’ points such as the provider accessing data that you collect on your users and unclear server locations. Both of these points alone would seem to contradict the transparency points which UK GDPR makes.

A possible way forward in relation to this issue is to contact a web developer. They can outline possible fees as well as signpost you in the right direction.

Use of instant messaging apps like WhatsApp (for business related purposes)

WhatsApp is arguably one of the most recognisable and popular messaging apps. Following an investigation into its use, the Information Commissioner’s Office (ICO) has outlined that WhatsApp should not be used for business related purposes (https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/07/behind-the-screens-ico-calls-for-review-into-use-of-private-email-and-messaging-apps-within-government/). This is because, despite adverts assuring users that the platform is secure due to being end to end encrypted, the issue lies with the servers that Meta are using. Servers are where your user data is stored, it’s why if you add a new device, you can see the old messages that you sent. With this feature comes the risk of servers being hacked. Servers store the messages, therefore, if using this for business related purposes, crucial personal data could be breached. Messages which are then being stored on servers, which companies such as Meta cannot guarantee the location of, pose an issue in terms of UK GDPR and DPA’18 compliance. Meta and other tech giants should be able to confirm the location of personal data collected and stored on their users.

There is also the issue of how Meta uses the data that they are collecting (as the owner of WhatsApp). Meta have been found on numerous occasions to have misused data individuals using their services have provided with the most recent story outlined here (https://www.bbc.co.uk/news/technology-65669839). Similarly, WhatsApp have also fallen foul of vulnerabilities, affecting the security of communications through the platform (https://www.ncsc.gov.uk/pdfs/guidance/whatsapp-vulnerability.pdf).

Alongside the risk of hacking, server locations are also a problem. Servers need to be located within the European Economic Area (EEA) or the UK unless there are appropriate safeguards in place such as Standard Contractual Clauses (SCC) and Binding Corporate Rules (BCRs) in place. With a company as large as WhatsApp, while they may claim that servers are within the EEA, the consideration needs to be applied to back up servers also, which may be stored outside of the EEA. Hence, this could then breach UK GDPR. Another point to consider is whether the country has received an adequacy decision.

What is data adequacy?

Data adequacy is a term that the EU uses to describe other countries, territories, sectors or international organisations that it deems to provide an ‘essentially equivalent’ level of data protection to that which exists within the EU. With these risks, it is clear why using WhatsApp is problematic. Organisations should consider the above NCSC guidance when it comes to exploring alternative secure messaging platforms for business related purposes.

Can I keep personal data forever?

Forever is a very long time therefore, only in exceptionally limited circumstances can you keep data forever, particularly, when you add UK GDPR and DPA’18 to the mix. Under the principle of minimisation you should be minimising the volume of personal data that you collect and the amount of time that you keep this for. Keepin data ‘just in case’ is not permissible.

The approach that should be taken is to keep data for as long as is necessary for the specific purpose that you are processing the data for. Under the UK statutory limitation you could be sued for a contractual dispute for up to 6 years after the event. As a starting point, that data should be kept for 6 years so that you can defend yourself, should you need to rely on the data in a law suit. Best practice outlines that it may be useful to keep the data for an extra year (7 years total). This allows you to review and securely delete or destroy the data in line with your legal requirements.

The key is to be able to prove to the regulator, the ICO, that you are keeping data for a specific reason or purpose. Hence, if you are going to keep data for any longer than 6 years for the reason outlined above, then you need to demonstrate a clear reason for retaining the personal data for longer. This should also be clearly documented so that you are able to ‘prove’ the time you are keeping the data for is following the regulator’s guidelines and industry best practice.

Can I copy and paste other website documents? For example, a website’s privacy policy document.

So, you’ve built a website and are doing your best to comply with all legal and regulatory obligations. You know that websites should (not all do) have a privacy policy, terms of use, cookie policy amongst other documents. However, if you don’t know where to start, you look to similar websites for inspiration.

As you will likely know, copying something and taking inspiration are very different things. In some circumstances copying may be useful however, website compliance documents should not be ‘off the shelf’ documents. They need to be made in line with your business practices and policies. Therefore, copying and pasting another website’s privacy policy, for example, is not the answer.

One way to tackle this is to ask a specialist such as Digital Law to write the documents for you. However, when budgets are restrictive, sometimes this is not a feasible option.

When I am sending out marketing emails, what do I need to avoid? 

Marketing emails constantly clog up your inbox. However, there are specific rules that, by law, should be followed in relation to sending out marketing communications. When processing personal data, you must have a legal basis for processing the personal data. A legal basis may include any of the following:

– Legitimate business interest

– Consent

– Contract

– Legal obligation

– Public interest

– Vital interest

A legal basis for processing must be in place before you send out any marketing communications. Just asking a recipient to email back, asking to be unsubscribed is not compliant. Also, make sure that your unsubscribe function is actually working and that the recipient is not redirected to a page that does not allow them to stop receiving any further emails.

Once the legal basis is in place, the set of regulations that regulate marketing communications are the Privacy and Electronic Communications Regulations (“PECR”). Under PECR, users must be able to opt out easily of marketing communications. This should include having a clear unsubscribe button or link at the bottom of every marketing email. Please note however, that emails about products or services that you are providing to existing customers do not require an unsubscribe button. This is because these emails do not relate to marketing, rather a product or service that you are providing.

Do I need a Data Protection Officer?

Starting with the basics, what is a Data Protection Officer (DPO)?

A DPO does what it says on the tin. They are in charge of the data within the organisation, monitoring, advising upon and carrying out internal compliance with UK GDPR and the UK Data Protection Act 2018 (DPA’18). A DPO is a statutory role as defined in the DPA’18. They can also help you demonstrate compliance and help ensure accountability in relation to data protection. A DPO can be an existing employee or they can be externally appointed.

Moving on to whether you need a DPO, while a DPO is not mandatory in relation to compliance, there are specific times when you should consider utilising a DPO:

– You are a public authority or body (except for courts acting in their judicial capacity)
– Your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or
– Your core activities consist of large-scale processing of personal data or smaller-scale processing of what could be very sensitive data.

Do you know where your servers are based/who your website host is?

Knowing the location of your servers as well as who your host is, is critical in terms of managing risks and compliance. Specifically with some service providers you cannot be sure exactly where your data is being held. Therefore, if your data is being stored outside the EEA you may be in breach of UK GDPR. At a surface level, it may appear that a service provider’s servers are stored in the EEA however, there may be back up servers which are not (which also breaches DPA’18). It is for this reason that you must be able to understand where the location of your servers is.

Do I need a cookie banner and what should be in it?

What is a cookie banner?

A cookie banner is a notice often displayed on a user’s first visit to a website that informs them about the cookies and trackers the site uses and asks for the user’s consent to store cookies on their devices. You will likely have noticed the annoying cookie banner pop up on a variety of websites.

If you have read our previous mention of the Privacy and Electronic Communications Regulations (PECR), cookies are another aspect that is covered under PECR.

Do you need a cookie banner?

To comply with PECR a cookie banner is necessary if your site is using cookies. It must allow users the ability to accept or reject non-essential cookies. As technology develops, not all sites use cookies, there are other forms of analysis that can be used instead. This means that a cookie banner will most likely not be necessary in the situations where cookies are not in use.

What is the purpose of the site? I.e., is it highly regulated and are there statutory or regulatory requirements that I need to think about when selling specific business services online?

Should you be a regulated entity including but not limited to an organisation in the insurance industry, pharmaceutical industry, legal profession or financial services industry, there may be additional statutory or regulatory requirements that you need to follow. This includes being held to a higher standard as the data that you will be collecting may be more sensitive, at a larger volume or contain special category data.

Security and encryption – what is it and why is it necessary?

Security, specifically encryption, is your best friend when establishing a website. You need both in order to protect your users when they are using your website in any way. This is not only to protect their information that they may choose to disclose to the website but to ensure that users have confidence that their personal data is safe.

Users may be able to tell whether you are using security and encryption by the padlock displayed in the search bar. This padlock, if clicked, will outline the level of security that a website has.

Having the correct level of security is part of the UK Data Protection Act 2018 (DPA’18). Ensuring that any data disclosed to the website is protected is a core feature of the DPA’18 and therefore, failing to have the necessary level of security may result in a fine should you have a data breach.

How can I protect the IP on my website? Is my IP safe?

It is crucial to protect your website Intellectual Property (IP). Protecting your IP is essentially keeping your ideas safe from misuse by others. IP can include logos, corporate identity, products services and processes. It is when these ideas are used without your permission that you may suffer. Hence, it is important to ensure that your IP is protected.

One way that you may do this, is to include a clause in your terms of use which seeks to protect your IP. For more special advise speak to an IP lawyer.

How to safely use artificial intelligence (“AI”) and navigate UK GDPR and DPA’18.

Many companies trying to utilise AI to boost their business and it is vital that you understand how to implement it safely and securely.

Generative AI, including Large Language Models (“LLM”), while a useful tool, comes with a long list of risks such as exploitation, data breaches, misuse and many more.

To mitigate risk, you must ensure the following information is not input into any AI system:

– Personal data; and
– Commercially sensitive data.

AI should be limited to the following activities:

– Text Generation – generating informative content;

– Brainstorming – facilitating creative brainstorming sessions;

– Translation and Editing – assisting in basic translation and editing of sentences to improve communication among international teams; and

– Generic Questions – Providing answers to common industry-related queries or general knowledge questions to enhance learning and development.

Limiting the use of AI to these areas should minimise a risk to your business, while still encouraging innovation and efficiency. However, as with any AI information that has been generated, the content must be thoroughly checked before use and all systems should be evaluated thoroughly following your organisation’s processor on-boarding procedures.

Please note that if you are planning to provide goods and services to customers in the European Union (“EU”) including the European Economic Area (“EEA”) you will have to demonstrate compliance with the EU AI Act as well as the EU Digital Markets Act and EU Digital Services Act. For more detail on this please contact Digital Law directly.

Congratulations!

You made it to the end. It’s time for a brew. Your customers will be happy you made the effort though.

If you need some extra help with this side of things, please contact us.

– – – – – – – – – – – – – – – – – – – – – – –

This article was updated in June 2024 and is therefore based on relevant laws, regulations and guidance at the time. Due to this, we cannot guarantee that the information contained within this article will be up to date at the time of reading. We do, however, aim to update this article every 6 months.