On May 25th, 2018, the General Data Protection Regulation (GDPR) will come into effect across the EU, with global implications. Canadian organizations – from start-up to enterprise – that do business with the EU or have an online presence that markets to EU customers must ensure policies for managing EU-based personal data will be GDPR compliant.
While the GDPR is only applicable to EU residents, Canadians are knowledgeable about their privacy rights too, and cautious about the perceived threat of new technologies. According to the 2016 Survey of Canadians on Privacy prepared for the Office of the Privacy Commissioner of Canada, the vast majority of Canadians (92 percent) expressed some degree of concern about the protection of their privacy. In an age of virtually instantaneous information-sharing, protecting personal data is a priority for many people, regardless of the country in which they live.
Businesses large and small need to be prepared for the impact the GDPR will have on how they do business and exchange information with customers. However, a recent global survey by Commvault reveals that only a small percentage of organizations (12 per cent) believe they will be compliant with GDPR by the deadline.
With less than 30 days to go, here are ten everyday workplace activities that should be considered more carefully from May 25th onward.
Celebrating Office Birthdays
An individual’s date of birth is their own personal data. Under the GDPR, it cannot be shared without express consent by the individual. So it is worth checking that you have everyone’s permission to host a shared calendar of birthdays in the office.
Sending Greeting Cards
If you were planning to send holiday greeting cards to your customers, you might want to think twice. If the cards will include individuals’ home addresses, make sure to acquire consent of the individuals in advance. If you do not have express consent to contact each customer, a different legitimate basis must be established for each business communication you send. So, it may be for the courts to decide the business legitimacy of sending season’s greetings.
Sharing Baby Photos
Think carefully before sharing baby photos with international colleagues. Personal data can only be transferred internationally if the country has been designated by the EU as providing an adequate level of data protection or by complying with an approved certification mechanism such as the EU-US Privacy Shield. Of course, if the sharing of a baby photo is deemed a purely personal activity, then it can be argued to fall outside of the scope of the GDPR.
Catering for Allergies
Do you have colleagues with nut allergies? Or perhaps they have kosher or halal dietary requirements? Sorry to say but these are all classed as personal data. So, before you call a restaurant or caterer, make sure you have your colleague’s permission to share their personal information with others.
Sharing Resumes for a Second Opinion
Not sure about a potential candidate for a role in your organization? Keep in mind that a resume contains personal data before sharing it for a second opinion. Of course, you could argue that it would be reasonable to share a resume of an applicant with others in the company on a need-to-know basis. However, an easy way to get a second view of a resume is to make it anonymous, by removing the name, address, phone number and any other identifiable information. This is also becoming a growing trend among businesses as part of an approach to remove gender and race bias in recruitment.
Joining a Mailing List
Does your website registration form have a pre-ticked box for customers to receive marketing information from third parties? You might want to rethink that come May 25th. Under the GDPR, silence, pre-ticked boxes and inactivity will no longer suffice as consent. You may also want to read through your privacy terms online, as any request by a business for consent to use personal information must be intelligible and in clear, plain language.
Talking Politics at Work
Political opinions are part of a special category of personal information, and organizations cannot record or process data about this type of information. So, if you were planning a company webcast about a forthcoming election, it may be best practice for a speaker to preface any comments with the phrase “I expressly consent to share this information about my political opinions”.
Calling in Sick
Health information is also part of that special category of personal information. Therefore, if you need to call in sick one morning to address a medical condition, you can’t then return to your sickbed and hope that the message will be passed on unless you have expressly consented for that information to be shared with every person who needs to be told. Alternatively, an individual can personally share that information themselves.
Data Auditing
Under the GDPR, an organization needs to have a designated person responsible for data protection matters, and in some cases, a company may need to formally appoint a Data Protection Officer before carrying out any large-scale processing of personal data. The appointed individual would be responsible for raising awareness of data protection regulations in an organization, training staff and managing audits of data processes.
Managing Data Breaches
If your business suffers a data hack, you’ve got to think quickly about alerting people. Under the GDPR, if personal data is accidentally or unlawfully lost, destroyed, altered or damaged, it needs to be reported to the supervisory authority within 3 days. And it’s not just the relevant authority that needs to be notified, all individuals impacted need to be informed too if it is likely to result in financial loss, identity theft or fraud.
