GDPR is coming.
Chances are that you may have heard of it in the context of a mind-blowing €20,000,000 fine if you are found to be non-compliant.
From my research, I can see that there is a lot of fear-mongering on the topic. Lawyers and consultants are using it as a cash grab to sell expensive kits and training.
Quick summary: GDPR, which stands for the General Data Protection Regulation, is a new law that becomes enforceable on 25 May 2018. It is designed to promote greater transparency, enhanced rights for individuals and increased accountability of organizations. While it applies specifically to EU citizens, in practice it affects every website in the world because EU citizens can visit your little corner of the web wherever they are.
Thankfully, my research also found some plain-speaking and straight-shooting resources to explain what GDPR is and how to get compliant. This article aims to outline what I’ve learnt and share these resources with you.
TABLE OF CONTENTS
- Are Website Owners Really At Risk Of A €20m Fine?
- Big Honking Disclaimer
- Making A Commitment To Data Protection
- Getting Your WordPress Site GDPR-Compliant
- Conclusion and Further Resources
Are Website Owners Really At Risk Of A €20m Fine?
First, let’s talk about the elephant in the room – the €20 million fine. Elizabeth Denham, the Information Commissioner of the UK said in a recent speech:
Yes the GDPR gives me greater sanctions and tools for those that flout the law – those that play fast and loose with the personal data that’s been entrusted to them.
But there is a carrot as well as a stick. And I have always preferred the carrot.
This is a long haul and preparations will be ongoing. But if you self-report a breach, engage with us to resolve issues, can demonstrate effective accountability arrangements, you will find us to be fair.
Enforcement will be proportionate and, as it is now, a last resort.
This sounds to me that the regulators aren’t trigger-happy bureaucrats out to punish everyone. Their main goal is to foster a “culture of transparency and accountability” with regards to the handling of personal data. And thankfully, they appear to be more interested in your “commitment over compliance” (source).
Looking through the list of enforcement actions that the ICO has taken, I’m relieved to see that there are no listings for “Punishing bloggers for non-compliant email opt-in forms” 😅
After numerous privacy breaches and data leaks in recent years – I’m looking at you Facebook – that’s something I can get behind. I think you would too.
But Europe has no jurisdiction over me where I am
My country is NOT subject to the laws of the European Union. We cannot be prosecuted under European law, so I don’t need to comply with GDPR requirements.
That might be true, but you might use services with businesses like Mailchimp, ConvertKit, Google Analytics, AdSense, your web host and much more. And all of these businesses have customers in the EU, so they have to comply with GDPR. And when you signed up for their service, you agreed to their Terms of Service.
Now, if you use Mailchimp, ConvertKit, Google Analytics, AdSense in a non-GDPR compliant manner, you’ll be in violation of your ToS. These companies would have the right to terminate your account because of your ToS violation.
So even if you might not face direct action from the ICO, you could find yourself without some of the most important services to operate your website.
I know GDPR is not fun, but I think we can agree that handling personal data in a responsible and secure manner is a good thing. So let’s now focus on how to get compliant, or at the very least ensure that we demonstrate a good commitment to data protection.
Big Honking Disclaimer
At this point I want to make clear that I’m not a lawyer and the following should not be considered legal advice. What the following is my understanding of what bloggers and website owners can do to make a best effort to comply with GDPR. This is what I’ve told my wife to do with her own website. If you are a more than a hobbyist, I suggest that you consult a lawyer like I have.
If you run a WooCommerce site, the steps are much more complicated. Read this article instead:
How To Make A WooCommerce Website GDPR Compliant? (12 Steps)
This guide is to help you follow the spirit of the law, even if you are not able to fully follow the letter of the law. As the Commissioner said, “The GDPR mandates organisations to put into place comprehensive but proportionate governance measures” (source).
Even if your website makes a small side income, you’re nowhere in the same league as Facebook and Google. I would argue that the measures I’m outlining below are comprehensive and proportionate for an entity of your size.
Based on what I’ve read, GDPR compliance guides I’ve purchased and speaking with legal experts in various Facebook groups, I believe this will be enough for bloggers and most website owners. Worried that what I’m suggesting is not enough? Please consult a lawyer.
This guide is NOT for you if are a business with more than 3 staff. In that case, you should follow the letter of the law as closely as you can and get legal advice.
Full Compliance Is Impossible
After wrestling with GDPR for the past 2 months, I’m not sure that any organization can be fully compliant. To follow the strict letter of the law would require a full time compliance team, which most bloggers and small businesses don’t have.
So it becomes a question of how compliant can you practically be? If you are Facebook, you’d better aim for 99+% compliance because the ICO will be watching you like a hawk thanks to your track record and your huge audience. But if you own and operate a small website, 80% compliance may be all that you can practically achieve. And I sincerely believe that that’s ok.
Even if you are found to have unlawfully used or processed personal data and the ICO even realizes your “offence”, you will likely receive a warning and guidance on how to fix your mistake before receiving punitive measures.
Cool with all that? Let’s proceed.
Making A Commitment To Data Protection
On the Information Commissioner’s Office (ICO) website, they suggest 8 steps to get prepared:
Based on these 8 steps, I’ve boiled down what you need to do into the following:
A) Make a list of all the personal data you hold
List out all of the personal data you collect, how you collected it, why you need it and whether you have consent for collecting it.
Andy Budd from ideea has got an excellent data map template which you can download and use in your audit. Once you’ve completed the audit, it’ll look something like this:
For each data source, you want to ensure that you have consent to collect the data (more in section C below) and that it is actually mission critical or required to your operations. If you don’t have either of these, you should stop collecting this data.
Print the map out, fill it in with a pen, write your name and the date on it and put it in a folder for safekeeping. This is proof that you have completed this audit and goes to show your commitment towards data protection.
B) Audit your data handling and vendors
Next, you want to ensure that where you keep the personal data you collect is secure and that any vendors you use are GDPR-compliant themselves.
For most bloggers, the data collected is stored in WordPress on your hosting account. Ensure that you use strong passwords for both the WordPress dashboard and also your hosting account. This is where a password manager may be useful (more info).
Many bloggers also use email marketing services like Mailchimp and ConvertKit. Both of these are compliant for storing your data, but you’ll still need to ensure you obtain consent on your website forms (e.g. email newsletter and contact forms).
C) Obtain consent at point of data collection
Hoo boy. Here’s where it starts to get hairy. This will require some technical skill, or you may need a web developer to help you.
GDPR requires a high standard of consent to data collection and processing. It says that consent must be:
Informed. Notify website visitors (the data subject) at the point of data collection
Freely given. Don’t pre-select checkboxes on forms. The data subject must make the choice themselves.
Specific. Don’t subscribe visitors to 3 extra things when they only meant to signup for your newsletter.
Because this section requires some technical implementation, I’ve dedicated a whole section below (Getting Your WordPress Site GDPR-Compliant) to cover this step.
D) Create or update your legal documents
- TermsFeed agreement generators (premium)
- Suzanne Dibble’s GDPR Pack (premium)
Whatever option you choose, make sure it covers all the necessary info. The ICO has provided a helpful privacy notice checklist.
E) Have a plan for when people ask about their personal data
The other bit of GDPR that you need to be concerned about is the data subject’s rights to rectification (correction), erasure (to be forgotten) and data portability (to export their data). In practice you’ll probably only need to deal with requests to opt-out of your email marketing lists. Most email providers make this easy and include a mandatory 1-click unsubscribe link which in your emails as well as a profile update function.
WordPress 4.9.6 has now added tools to export and delete personal data from the site. They can be found under Tools → Export / Erase Personal Data.
Finally, if your website or email marketing account gets hacked, be sure to be upfront about it and notify your website members / subscribers. Again, prevention is better than cure so make sure you have strong passwords!
Getting Your WordPress Site GDPR-Compliant
In this section, we’ll get down to the nuts and bolts for your website. A lot of people get very stressed and worked up about this, so I want to remind you again that:
GDPR is not just about checkboxes and cookies. These are minor details in implementation. The way you handle data and your approach to privacy are much more important.
Your best effort is enough. You might not be able to be fully compliant in some of the areas here, just just endeavor to do your best. Commitment over compliance, ok?
Install a Cookie Notice
To be fully compliant, you should block non-essential cookies – the ones used for analytics, marketing, ads – before the visitor dismisses the cookie banner. To do this, paste your Facebook Pixel, Hotjar, etc script code into the Script blocking field. The scripts that you put here will only be activated after the website visitor accepts cookies.
In practice, blocking cookies before consent is pretty complicated. Also, the law is still fuzzy here. I wouldn’t sweat it too much if you can’t get it to work correctly as long as you have the cookie banner on the site.
Anonymize Your Analytics
You can also side-step some of the privacy potholes by anonymizing your analytics. This makes for slightly less accurate geographic reports, but you are minimizing the personal data you collect this way. This can be easily done by selecting an option in your plugin settings.
Obtain Consent for Email Marketing
Most bloggers and small businesses have email newsletters, and this is the topic that causes the most stress by far. Let’s start with the easy things first.
Stop automatically subscribing website visitors to your email list. If you have a contact form or a way to purchase something on your website, you cannot add people who use these forms to your newsletter automatically. Add a checkbox to your form for the option of automatically subscribing, but make sure that the checkbox is not pre-selected.
What about lead magnets? These are the “bribes” where entice website visitors to get on your email list with an offer e.g. Download my free guide/video. Under GDPR, you can’t do that anymore because consent must be specific. In this case, the language on the opt-in form is requesting consent to the free incentive but not the weekly emails.
The easiest thing to do here is to add a checkbox that says “I also want to receive the weekly newsletter” like this:
This is the easiest solution, but it may not be the best solution. The big caveats are:
- You can’t pre-select the checkbox
- You still have to deliver the lead magnet even if the subscriber didn’t select the checkbox
The above is what has caused the most hand-wringing, hair-pulling and teeth-gnashing in all the Facebook groups I’m a part of. Everyone is getting hung up over this although I would say this is a small detail in your overall GDPR compliance.
For more ideas on how to get your lead magnets compliant, check out Thrive Themes’ article:
Lots of folks will say that the Thrive Themes guys are being very cavalier about the GDPR, but again I say that forms and checkboxes are a small, tiny part of your GDPR compliance. Do your best, don’t forget the other steps in my guide, and move on.
Conclusion and Further Resources
The above is quite a bit of work and if you were like my wife, you won’t relish it. However try to look at this as an opportunity. By committing to data protection, you tell your website readers that they matter to you. You’ll appear more professional and authoritative, leading to deeper trust and engagement with your audience.
If you want to learn more about GDPR, here are some further resources for you.
- The ICO’s guide to get ready for GDPR (and the entire website in general).
- Small business law expert Suzanne Dibble’s free webinar on GDPR for online entrepreneurs
- Small business law expert Suzanne Dibble talks about GDPR and very small businesses.
- The Lowdown on GDPR Compliance for WordPress Users – WordPress-specific tips from Kinsta
This article will be updated with corrections and new information as I get them. Thank you to members of the GDPR For Online Entrepreneurs Facebook Group for your comments, feedback and support.