‘Urgent action required ”, “Do you still want to hear from us?”, “We’ve updated our privacy policy”, “Should we stop sending you updates? If not, act now!”
Many of us will have received emails like this during the past few weeks, some of them from companies we haven’t used for years or have maybe never even heard of.
Triggering this deluge of emails is something called GDPR that comes into effect in just under two weeks’ time. Often the emails warn that if you don’t respond, you will be removed from the company’s database, which raises a lot of questions. What action, if any, do you need to take? Could it affect you financially? If you ignore the emails, will you wake up one morning to find tumbleweed blowing through your inbox?
GDPR, which stands for General Data Protection Regulation, has been described as the biggest overhaul of online privacy since the birth of the internet. It is designed to give all EU citizens the right to know what data is stored on them and to have it deleted, plus protect them from privacy and data breaches. It comes into effect on 25 May.
This comes just weeks after it was revealed that the personal data of millions of people was harvested from Facebook and improperly shared with the political consultancy Cambridge Analytica.
The new rules bolster the requirement for explicit and informed consent before data is processed. As a result, companies and organisations around the world are contacting users to check they are happy to carry on receiving their emails.
Typically, individuals are being asked to give explicit permission for the company to continue emailing them and holding their data. Many companies are also giving people the chance to opt out from all future communication.
However, many of us seem to be going down with “GDPR fatigue”: one article last week claimed that the “reconfirmation rate” – the proportion of people saying they want to continue receiving a company’s emails – at UK micro-businesses was averaging just 10%, which meant “they could lose 90% of their subscribers – the life-blood for their business”. So it’s no wonder some firms have resorted to tactics such as offering to enter people into a prize draw in return for them going in and updating their communication preferences.
The average adult is said to have about 100 “data relationships” – companies and organisations that hold our personal data. These can include things such as clubs we belong to, retailers we have shopped at, professional bodies we are signed up to in connection with our job, and the companies that provide our insurance policies. So they will receive as many as 100 GDPR-related emails – though some are receiving a lot more than that.
Companies are handling this in different ways. Some are taking the trouble to explain what’s happening, while others are more vague. Equally, some companies make it easy for people to consent – you hit the “Yes, I agree” button on the email, then you get a thank-you, and that’s that. Others are insisting you go through the rigmarole of logging in, which might entail trying to remember your password or setting up a new account.
“It will be their interpretation of what they need to do to be compliant,” says Robert Parker at the UK’s Information Commissioner’s Office (ICO).
So will you hear from every company you have dealings with? Probably not, suggests the ICO. In a blog this week aimed at firms and organisations, the ICO deputy information commissioner, Steve Wood, says: “Where you have an existing relationship with customers who have purchased goods or services from you, it may not be necessary to obtain fresh consent.” He adds that firms “do not need to automatically refresh all existing consents in preparation for the new law”.
For example, your relationship with your bank is different to your relationship with a company that, say, occasionally emails you newsletters. When you opened your account, you entered into a contract with the bank, and it is in regular contact with you, sending you changes to terms and conditions and so on. So your bank may well be confident that you are happy with the way it contacts you and how it stores your personal information.
The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.
The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.
Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.
GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.
Meanwhile, the reason why the company that occasionally emails you newsletters is now asking for your consent is perhaps because you never explicitly gave it permission to send you stuff. Maybe you only get its emails because you went to an event it organised ages ago or you once downloaded something from its website. Under the new regime, that almost certainly wouldn’t count as explicit and informed consent, hence its getting in touch now.
The bottom line is that if it is a company or organisation that you want to continue hearing from, you should probably click the button or log in to ensure you keep getting its emails. If it doesn’t hear from you, it may decide to err on the side of caution and take you off its database. This is, however, a good opportunity to check that the companies you deal with have your correct details, and to spring-clean your overstuffed inbox by ditching annoying marketing emails that you no longer want to receive.
How GDPR works
The General Data Protection Regulation (GDPR) restricts the way businesses collect, store and move people’s personal data. It applies to all companies that process the personal data of people located within the EU.
Personal data includes your name, photo, email address, IP address, bank details, posts on a social networking site, medical information, biometric data and sexual orientation.
Under GDPR, people get expanded rights to obtain the data a company has collected about them. People will have the “right to be forgotten”.
Also, if a company has a data breach, it must be reported to the relevant authority within 72 hours.
To ensure companies comply, GDPR gives regulators the power to fine firms up to €20m (£17.6m) or 4% of annual global turnover, whichever is greater.
