Secure Privacy Hospitality

The EU GDPR (General Data Protection Regulation) is the most significant change in data protection for decades since the ePrivacy Directive. This privacy law requires businesses to protect the use, storage, and processing of personal data for EU citizens. It introduces tougher fines for non-compliance, and data breaches and gives people more say over what companies can do with personal data. Any company that does business in Europe needs to be GDPR compliant.

The overall objective of the General Data Protection Regulation (GDPR) is to give citizens back control of their personal data and to simplify the regulatory environments for international business by unifying data and privacy regulations. GDPR replaced the EU ePrivacy Directive  (the Data Protection Directive  ) with the main aim of adopting this cookie law being the need to unify data protection and privacy regulation in the EU to reduce administration and inconsistencies among local laws. Essentially, with a directive, unlike a data protection regulation, each member state has discretion as to the implementation of data protection regulations, and can thus differ from country to country.

Although the General Data Protection Regulation (GDPR) originates in the EU, it applies to companies outside the EU offering goods and services (paid or free), or those who monitor the behavior of individuals within the region.

Under the former Data Protection Directive, a business was subject to the data protection regulation only if it was located in an EU country or used equipment in an EU country to process personal data.

However, the new cookie law also applies to any business that offers goods or services to individuals in the EU or monitors such individuals’ behavior. This is a broad expansion of the general data protection requirements that will affect many more organizations across the globe.

The GDPR penalties can reach a maximum of EUR 20 million or 4 percent of the annual revenue (whichever is highest) of the organization, depending on the details and circumstances regarding non-compliance with GDPR requirements.

Furthermore, class action litigation is also allowed, resulting in exposure to both regulatory enforcement and private litigation for a company’s failure to be compliant with GDPR.

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, collected by various types of cookies that together can lead to the identification of a particular person, also constitute personal data.

Personal data that has been de-identified, encrypted, or pseudonymized but can be used to re-identify a person is still classified as personal data and falls within the scope of the EU GDPR.

Personal data that has been rendered anonymous in such a way that the individual is not identifiable is no longer considered personal data under GDPR requirements. For data to be truly anonymized, the anonymization must be irreversible.

Examples of personal data include name, surname, email addresses such as name.surname@company.com, a home address, ID card number, cookie ID, Internet Protocol (IP).

Examples of data not considered personal data include a company registration number, email addresses such as info@company.com, and anonymized data.

Personal data can flow from European Economic Area (EEA), which includes all EU countries and non-EU countries (Iceland, Liechtenstein, and Norway), to third party countries without any further safeguard when the European Commission has acknowledged the country to have adequate data protection. Countries recognized to have adequate protection are Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, and the US (limited to the Privacy Shield framework) as providing adequate protection. Talks are ongoing with Japan and South Korea.

If your organization/business interacts or does business with EU citizens, such as selling products/services or monitor individual behavior online, then you may fall under GDPR jurisdiction.

If you use third-party tools such as Google Analytics, which collect personal data, then you need to obtain valid GDPR cookie consent before placing cookies or any other form of tracking technology on the visitors’ computer. One of the ways you can accomplish this is through a cookie consent tools/cookie consent plugin.

If you have contact forms or newsletters collecting data from EU citizens then you need to be compliant with GDPR and need to ensure you do lawful processing of their personal data.

Many websites use tracking technologies, including cookies, pixels, and tags, to advertise, collect statistics and perform marketing campaigns. To ensure your website is GDPR compliant, you are required to provide a cookie notice/GDPR cookie consent banner and obtain user consent for each one of these technologies. Make sure to do a web audit of your website and see what trackers you have enabled and are running.

If you are unsure what trackers you have on your website, then use our GDPR cookie consent plugin tool. It is free and will provide you a result within 5 minutes or less. Our tool identifies the cookies and trackers that operate on your website, and our cookie script blocks them into groups determined by their function.

There are specific requirements for how to obtain valid consent when it comes to GDPR and cookies. Primarily, GDPR cookie consent must be informed, unambiguous, explicit, freely given, specific, and have the right to withdraw written in plain language that is visible in your cookie banner. For consent to be informed, both the GDPR and ePrivacy Directive, state that an individual must receive at least the following information from your cookie consent notice:

• the identity of the organization processing data;
• the purposes for which the data is being processed;
• the type of data that will be processed;
• the possibility to withdraw the given consent (for example, an unsubscribe link at the end of an email)
• if the consent is related to an international transfer, the possible risks of data transfer to third countries.

Below is one of the GDPR cookie consent banner examples you can use to communicate different cookie preferences and receive valid consent.

1. Consent should be affirmative, specific and unambiguous
2. Details of recipients and data controller
3. Purpose of processing and notification of profiling
4. Duration
5. Withdraw consent
6. Link to complain, correct and transfer data
7. Can decline

The standard text phrase that is included in most cookie consent banners, “by using this site, you accept cookies,” will not be sufficient under GDPR cookie compliance requirements, as it only suggests implied consent, which is ambiguous and generic. You will now need granular levels of control with separate consents for tracking, analytics, and other cookie categories, as well as mechanisms to signal customer consent. They need to make an affirmative action to guarantee GDPR compliant cookie consent.

It should be as easy to withdraw as to give consent. Furthermore, to be compliant with GDPR your cookie banner must inform your users how they can exercise this choice. If user consent is withdrawn your company/organization can no longer process the data. Once consent has been withdrawn, your company/organization needs to ensure that the data is deleted unless it can be processed based on legal grounds (for example storage requirements or as far as it is a necessity to fulfill the contract).

If the data was being processed for several purposes your company/organization can’t use the personal data for the part of the processing for which consent has been withdrawn or for any of the purposes, depending on the nature of the withdrawal of consent.

Example: You’re providing an online newsletter. Your client gives their consent to subscribe to the online newsletter that allows you to process all the data on their interests to build a profile of what articles they consult. One year on, they inform you that they no longer wish to receive the online newsletter. You must delete all personal data relating to that person collected in the context of the newsletter subscription from your database, including the profile(s) related to that person.

Your cookie consent notice must clearly identify each party for which user consent is being granted. It isn’t enough to state the category name, such as analytics, but should include the identity of the organization, e.g. Google, which processes the data for your business to be considered as having a GDPR compliant cookie policy.

To learn how our cookie blocking works, please see this guide.

Yes, we offer GDPR readiness tests, website audits, training and more. Please schedule a call here.

Yes, we offer full support for a wide range of privacy laws including CCPA and LGPD.

Yes, we offer volume discounts. Please schedule a call here.

Yes, you can. We offer a FREE trial. You can cancel anytime.

You sure can. Go to your administration panel at any time, and you will find cancel in the account section.