Category Archives: GDPR

Email Marketers and California’s New Data Privacy Law

1 Reply

Data Privacy
In June of 2018, Governor Jerry Brown signed into law the California Consumer Privacy Act (CCPA). Taking its inspiration from the European Union’s General Data Protection Regulation (GDPR), the CCPA was intended to protect online data privacy. Like the GDPR, it gives California residents the right to opt out of any sharing of their data and the right to have their data deleted. It was created by Alastair Mactaggart, a rich San Francisco real estate investor, and drafted by him with friends, including cybersecurity and data privacy expert Mary Stone Ross.

But Mactaggart wasn’t happy with the legislation and, two years later, introduced ballot measure Proposition 24, intended to correct what he saw as problems with the CCPA. In November 2020 the California voters passed a revision to the CCPA entitled the California Privacy Rights Act of 2020 (CPRA).1 Not everyone was happy with the new resolution, including MacTaggart’s former associate Mary Stone Ross who opposed it as did the ACLU among others. Nonetheless, the proposition passed and is now law in California.

Why It Matters

While California is just one of the fifty US states, it has one of the largest populations and an over-sized influence on the rest of the country. Legislation passed by California is often copied by other states. So what has been the impact of the CCPA on the email marketing community, and what should we expect from the CPRA?

So far, the CCPA doesn’t appear to have had a significant impact on many in the email marketing community. Will the CPRA change that? Will it have a more significant impact on businesses? Only time will tell for the true effects, but there are a number of changes in the law that seem likely to cause an impact. We have read the law and attempted to interpret how the changes will affect the email marketing community. Please note that this is not legal advice. For specific questions about the law, please consult an attorney.

One of the changes was intended to close loopholes around businesses sharing information. The new law changes the wording to include the sharing of information between companies in almost every way. Whereas before, with the 2018 version of the law, many people interpreted it to allow businesses to share information between companies with affiliate relations, that is now explicitly disallowed.

The California Privacy Protection Agency

The most dramatic change from CCPA is the creation of the California Privacy Protection Agency. Previously, the prosecution of privacy violations was left to the California attorney general’s office, which acknowledged they don’t have the resources to bring many cases to court. With a projected budget of $5 to $10 million dollars a year and a law that says the proceeds from these cases will go to the new agency, the California Privacy Protection Agency actually benefits from prosecuting cases. With these kinds of resources, we expect that there will be significantly more prosecutions. Additionally, with CCPA, there were rules that allowed a company to “cure” violations to avoid punishment. With the new law, the ability to cure violations is reduced to a one-time opportunity.

It’s not all bad news, however. As with the CCPA, the CPRA has little effect on smaller businesses. It only applies to businesses that earn over $25 million a year. If anything, it’s more lenient than the CCPA since it increases the number of subscribers a business can have from 50,000 to 100,000.

The exceptions are businesses that earn 50% or more of their annual revenue from selling or sharing consumers’ personal information. The changes in this law make it clear that sharing data with another business, regardless of the creative words used to describe the arrangement or the annual earnings, are now illegal without strict contractual requirements to ensure that business maintains the same level of privacy protection. If you make money by selling your email leads, you will need to be very careful about this law. And the penalties for violations remain debilitatingly high. Fines could be millions of dollars for a single email blast!

The law continues or even strengthens the requirements of disclosure for the personal information you collect. This law goes so far as to give the exact words you need to provide as a link on the homepage of your website to explain to users the information you collect and requires you to make an option available to users to request that this data be deleted.

In GDPR and Email: Part 1, an Overview, we pointed out that much of this legislation requires businesses to forget all the information about a recipient, without addressing the inevitable problems this can cause. Our reading of this is that the law does allow for the storage of some key identifier to support a user’s request to be deleted (specifically, email address in our case). While we doubt that this was the intended purpose of this subsection, it certainly appears to let businesses off the hook in regards to keeping email addresses to prevent further data gathering and further email sending.

Don’t Add Data to Unsubscribes

The new law makes it explicitly clear that personal information cannot be added to records for recipients that have unsubscribed. Maintaining the email address to know the person has unsubscribed appears legal, but you cannot then augment the file of information about that user to include any personal information, even if you won’t be sending to them. Some software or business practice changes may be necessary for companies to comply with this.

One thing that is unequivocally banned by the CPRA is the practice of assuming that consent is provided by hovering over, muting, pausing, or closing a given piece of content. It also prohibits the practice of using “dark patterns” to add data about users, which it defines as “a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, as further defined by regulation.” Hopefully few businesses were doing this, but should you be considering it, now it is explicitly illegal.

Another frustration we have experienced with GDPR that doesn’t appear resolved by these California laws is the question of what constitutes personal information. Some things are obvious, such as Social Security Numbers, addresses, dates of birth, etc. But how about information like clickthroughs or opens? Is it personal information to keep track of what content the person opened, or to store the links that they clicked on? Certainly, an argument could be made that this information is unworthy to be considered confidential or private information, but the laws are not clear. It would be nice if this could be resolved for the email marketing community but for now, each company and their lawyers will need to make their own decision.

The CCPA went into effect at the beginning of 2020 and will stay in effect until the 1st of January, 2023. At that point, the CPRA will go into action, but the law also applies to personal information collected by a business on or after January 1st, 2022. If you are an email marketer who doesn’t collect any personal information about your recipients and simply blasts untargeted advertisements at them you may not need to change business practices. You need to offer an explicit “delete” option, rather than just an unsubscribe, but no other changes may be required. However, if you target recipients based on the information you have collected about them no matter what the source, you may have to make changes to “dumb down” your program. Untargeted advertisements appear to be acceptable but targeted advertisements may get you in trouble. It’s a bit ironic that the “benefit” of privacy protection may neuter all marketing to be generic and unengaging to recipients.

Go to Goolara website

1. The California Privacy Rights Act of 2020 in PDF form.

© Goolara, LLC, 2020. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Goolara, LLC and the Goolara Blog with appropriate and specific directions (i.e., links) to the original content.

Privacy Report 2020

1 Reply

data privacy
The second decade of the 21st century is shaping up to become known as The Privacy Decade. Recent legislation, both internationally and in the United States, is primed to change the parameters regarding what information about a person you can or can’t collect, and the limitations on what you can do with that information. One thing these regulations have in common is that they don’t restrict their data privacy requirements to emails sent from within their borders. If your emails are sent to subscriber inboxes within any of these states, you are deemed culpable for those violations and can be subject to hefty fines. Unlike previous legislation, such as CAN-SPAM and CASL, these new laws are not aimed specifically at email but are intended to address privacy issues across all devices, platforms, and services. They all do affect email because email involves the gathering of private data in the form of email addresses and, in some cases, names and locations. Each of these laws comes with its own set of restrictions, some more draconian than others.

More Restrictions

While some people might not care if everyone knows where they are every hour of the day, most of us value our privacy and like to have some say over what a company may or may not know about us. Accepting this and working with it is the best tactic for any email marketer. Try to game a subscriber’s private data was never a good idea, but all signs point to more restrictions and greater penalties for doing so as every country gets into the act. While there are no plans for upcoming legislation in this Congress, states such as California and Vermont have created their own stringent privacy laws and 2018 saw the passage of data breach notification laws in several states.

GDPR Arrives

The legislation that started the privacy protection ball rolling was the European Union’s General Data Protection Regulation (GDPR). This regulation set a high bar for an individual’s rights to access any data about them that a company gathers, as well as the right to have that data deleted (for more on GDPR, see our three-part series on the subject). It covers a staggeringly wide range of data—everything from a person’s email address to the geolocation featured in many digital cameras. It extends to any person living within the European Union, regardless of their nationality. If you send email to a person in the EU, you need to be GDPR compliant. Full stop.

California Picks Up the Torch

Taking its cues from the GDPR, the state of California came up with its own privacy regulation. Passed in 2018, the requirements of the California Consumer Privacy Act (CCPA) goes into effect January 1, 2020, and features many of the same restrictions as the GDPR, including the right to obtain one’s data from a company and the right to be forgotten. No other state has, as yet, passed such a strict law, but it looks like Washington State is set to follow suit with their Washington Privacy Act, which is also modeled after the GDPR.

As strict as the CCPA seems, it’s got nothing on the GDPR. The California law applies only to for-profit businesses, so nonprofits can breathe easy. Additionally, for-profit businesses need to have a gross annual revenue exceeding $25 million for the law to take effect, and your active email list must exceed 50,000 subscribers. It also only applies to tax-paying residents of California.

Brazil Follows Suit

In August of 2018, the Brazilian government signed into law the Brazilian General Data Protection Act (Lei Geral de Proteção de Dados Pessoais or “LGPD”). Like the GDPR, after which it was modeled, its scope is global, with companies in any country facing fines for violating its rules. As with the CCPA, the Brazilian law goes into effect in 2020. One notable difference between the GDPR and the LGPD is the latter’s inclusion of terminology pertaining to “non-discrimination”). It also addresses credit and health records with more specificity. Originally, the law had provisions for the establishment of an independent data protection authority, but the President rescinded that in a line item veto. The LGPD is more punitive than California’s law but less so than the GDPR. The maximum fine under the LGPD is 2% of a company’s Brazilian revenue up to 50 million in Brazilian Reals per infraction (about 13.4 million in U.S. dollars). Compare that to the GDPR’s 4% of an organization’s annual revenue or 20 million Euros (about 22.6 in U.S. dollars), whichever is greater.

And Then There’s India

Also getting in on the post-GDPR drive for stronger privacy controls, the Ministry of Electronics and IT (MEITY) in India has been hammering out its own privacy regulations—a process they started back in 2010. Following the 2017 Indian Supreme Court ruling declaring that privacy is a “fundamental right,” the MEITY finally got on the ball and drafted the Personal Data Protection Bill 2018 (PDP Bill), which contains many of the same features as GDPR, but with a few curveballs that already have companies crying foul. The main one is the requirement that all “personal data” on people residing in India must be maintained at a facility within India (although the bill doesn’t define what constitutes personal data—they’re leaving that up to the government). India isn’t the only country mandating such a restriction. China and Vietnam have similar restrictions, but neither of those countries could be considered free. Their governments exert a great deal of control over every aspect of data transfer and Internet use.

India, on the other hand, has a free market economy—some might say too free. It also has an online market second only to China in size, with close to 500 million Internet users. Restrictions making it harder for companies to conduct business aren’t welcome, and this requirement is already meeting with criticism and opposition. When the MEITY requested feedback on the bill, they received nearly 600 recommended changes, from both businesses and governments, including the United States.

Perhaps this is why, since its introduction, the government has had a few opportunities to pass the PDP Bill, but decided to wait until June 2019, after the new government is in place.

Congress Changes Its Tune

In 2009, U.S. Senator Patrick Leahy of Vermont tried to get his Personal Data Privacy and Security Act passed, but the bill never reached the floor. It was too much, too soon, and nobody had any idea yet the extent to which sites such as Facebook and Google would use personal data. Still, data privacy restrictions would be a hard sell in Congress, even today, if not for the increasing number of states tackling the problems on their own. All fifty states have laws concerning the reporting of data breaches, and 35 states have laws regarding the disposal of data. To complicate matters, the laws in each state are different. Some state laws apply only to business, while others only restrict the government, leaving private businesses to do what they want with your data. Some are quite stringent, while others are written in such general terms as to be virtually unenforceable.

Mostly in response to California’s legislation, the U.S. Chamber of Commerce and several other business-based groups are lobbying Congress to pass a federal omnibus privacy and data protection law that would pre-empt the CCPA and other existing and future state data protection laws.

Email’s Role in All of This

Unlike CAN-SPAM and CASL, this recent legislation doesn’t focus exclusively on email. In the case of GDPR, it regulates everything from website visits to in-camera geolocation. They all affect email marketing, although how much depends on your subscriber list. If your list is exclusive to the United States, and your gross revenues don’t exceed $25 million, then you can go about business as usual. None of the recent legislation will have that much impact on your email efforts. There is a lot more legislation on the books now concerning data breach notification, but that’s of more concern for the IT department than the marketing department.

If you have international subscribers or own a business that brings in over 25 million a year, we recommend you follow the rules of the GDPR. It is still the strictest of the current laws, so if you are in line with it, you should be fine for the others. For everyone else, there are a few things you can do to avoid problems. They include the following:

Make Your Terms Clear

Spell out in the clearest possible language exactly what you plan to do with the data you collect and make sure you include a statement to the effect that you will not use this data for other purposes or sell it to other companies.

Leave Boxes Unchecked

If you do any business in the European Union, this isn’t simply a suggestion, it’s the law. It’s less important in the States, but, like the single- vs. double-opt-in controversy, each approach has its supporters and detractors.

Respect the Privacy of Your Subscribers.

Email marketing is a double-edged sword. On one hand, we all like our privacy, but on the other, we also prefer receiving emails about things we are actually interested in. As an email marketer, the only datum you actually need is the email address, but, by itself, that makes for generic, “batch-and-blast” emails. Personal data helps improve the engagement and the receptiveness of your subscribers to your mailings. But don’t abuse it. Just because you can send an email saying “Hey Jill! I noticed you just visited our website fifteen minutes ago” doesn’t mean you should. It makes you look like a stalker, so avoid it.

The Ground’s Still Shaking

One thing is certain: This story is far from over. Right now, most of the fretting over the new laws has been a waste of time. How much they affect you is extremely variable. New legislation is cropping up in countries around the world every day and, as time goes on, it appears more and more likely that some national legislation in the United States will be enacted to bring the various states back into line. When that happens, we’ll take a look at this subject again.

Go to Goolara website

GDPR and Email: Part 3, Data Portability

1 Reply

data portability
NOTE: This is the third in a series of articles addressing the GDPR and its effects on email marketing. For an overview of the subject, see our previous article: GDPR and Email: Part 1, an Overview.

Last time on this blog, we looked at the issues of forgetting and unsubscribing, and how the General Protection Data Regulation (GDPR) affects email marketers. That particular portion of the GDPR has received a lot of press, but there’s a far thornier issue lying in wait a few paragraphs further down in the regulation. I’m referring to the “right to data portability,” which gives the subscriber the right to receive all the data a company has collected on them.1 Compared to the other features of the GDPR, the right to data portability seems haphazardly drawn up, or, at least, drawn up without ever considering the difficulties and problems that its simple request could generate.

Acceptable Formats

Briefly put, the right to data portability says a subscriber has the right to receive any data about them in a “structured, commonly used and machine-readable format.” They don’t specify what this format is. “Commonly used” would suggest a comma separated values (CSV) file, XML, or something similar. Even then, there’s no guarantee that the data can be formatted in a useful manner. Every customer relationship management system (CRM) and email-marketing service provider (ESP) has its own structure, order of operations, and, to a certain extent, terminology, so porting the data from one site to another isn’t as easy as transferring the file. Try opening a Microsoft Word file in a text editor and you’ll see what we mean. Even when the two system can read each other’s data, it doesn’t mean than one system will have a place for all the data from the other. There is no standard for formatting things like click-throughs or deletes without opening. In Recital 68 (separate clarifications to the GDPR), the regulation states that “data controllers should be encouraged to develop interoperable formats that enable data portability,”2 but they make no suggestions as to how this would be accomplished. It is the bureaucratic equivalent to a mom’s admonition for kids to “learn to get along.”

Privacy issues

CSV and XML certainly qualify as commonly used formats, but they are also as easy for humans to read as they are for machines, which raises other privacy issues. If the “Right to Erasure,” presents the danger of someone other than the subscriber making the request, the Right to Data Portability is even more of a threat. With erasure, you’re simply asking to have your data removed from a system. Most people wouldn’t cry if to learn that their data has been accidentally erased by their ESP, but would hit the ceiling if they learned that their data was sent to someone else. Anything sent out in an email has a risk of being seen by others. Even if the format is not easily read by humans, the “commonly used” qualifier means anyone looking to steal someone’s data probably has a program that will have no trouble deciphering the information. But there are other dangers waiting in the wings.

Identity Issues

There are plenty of examples of people pulled aside by the TSA at the airport because their names matched people on suspicious person lists. This isn’t a big concern in the email marketing field, because every subscriber already has a unique identifier: their email address. Even if someone enters the wrong email address, the email will go to the person who has the account and they can choose to ignore the message. There is some danger that if an email account is hacked, the identity thief can now request all that person’s data from the ESP, and the ESP will, by law, be required to provide all the personal data for that hacked account. Depending on the data that is kept, this could provide the thief with a wealth of information about that person. Security on an email account is even more critical than ever.

Here Come the Lawyers

It’s ironic that a regulation designed to help protect an individual’s private data might be the very thing responsible for the theft of that same data. This speaks to the rather haphazard nature of this particular clause. This is why the Internet Corporation for Assigned Names (ICANN) has filed a suit against EPAG, its German affiliate, in an attempt to get better clarification of the GDPR’s restrictions. EPAG recently informed ICANN that when it sells new domain name registrations it would no longer collect administrative and technical contact information, as it believes collection of that data would violate the GDPR rules. For ICANN, this presented an untenable problem since maintaining this data is central to ICANN’s purpose. It’s a thorny issue, for sure. Right now, no one is sure where the balance between private data and public records lies. The courts have their work cut out for them.

While ICANN’s lawsuit is aimed at clarifying the regulations, other lawsuits are aimed at companies that are seen as already violating the GDPR. As of this writing, the only major lawsuits filed against companies under the GDPR are ones against Google, Facebook, Apple, Amazon, and LinkedIn. These were filed shortly after the law went into effect and are intended as test cases. The outcome of these cases will determine what happens next.

Stay Frosty

We will keep watching the events involving GDPR as they unfold and keep you posted if anything changes. In the meantime, as long as you’ve followed the rules of the GDPR that we laid out in part one of our GDPR and Email Overview, you should be alright.

(This concludes our three-part series on the GDPR.)

Go to Goolara website

1. Chapter 3, Article 20: Right to data portability

2. Recital 68: Right to data portability

GDPR and Email: Part 2, Unsubscribing and Forgetting

1 Reply

GDPR forgetting vs. unsubscribing

NOTE: This is the second in a series of articles addressing the GDPR and its effects on email marketing. For an overview of the subject, see our previous article: GDPR and Email: Part 1, an Overview.

No aspect of the General Protection Data Regulation (GDPR) has generated more confusion and misinformation than Article 17—the notorious “Right to Erasure” clause.1 Partly, this confusion is a result of the GDPR’s failure to address email regulations head-on, choosing instead to try and tackle the privacy issue on a grander scale (you won’t even find the word “unsubscribe” used anywhere in the GDPR or its “recitals”).

As we mentioned in the previous article, whether or not you’ll need to concern yourself with the ramifications of the GDPR will depend entirely on your subscriber base, and whether or not you actively seek subscribers in countries that belong to the European Union. If all your subscribers are in the United States, then you have things pretty easy. If a good percentage of your subscribers are in Europe, then you’ll probably want to make sure you follow the rules laid down by the GDPR. The fines for ignoring it are steep.

Forgetting Isn’t Unsubscribing

The most important point to remember is that “forgetting” and “unsubscribing” are two different things. When a person asks to be unsubscribed, they are saying: “I don’t want to receive any more email from this source.” Sometimes that means unsubscribing from a specific topic. For instance, you might unsubscribe from PC World’s Tech Deals newsletter but still receive their Daily News updates. Sometimes it means unsubscribing from all the mailings a company sends.

Forgetting—or the “right to erasure”—is another animal entirely. In this case, the subscriber is asking not only to be removed from your active mailing list but to have all identifying information removed from your system, with the possible exception of the email address used to verify the erasure request. When a subscriber asks to be forgotten, all personal data must be removed from the database.

Why does it matter?

Right now, nobody knows what effect the GDPR will have on email subscriptions, but some sources predict dire things. Pegasystems, a provider of customer engagement software, reports that 82% of European consumers plan to exercise their new rights to view, limit, or erase the information businesses collect about them, although the article goes on to say that only 21% of those surveyed had any idea what GDPR is or what it enables them to do. According to a survey commissioned by Veritas and conducted by 3GEM, 40% of British consumers plan to exercise their GDPR data rights.

One country that might live up to the dramatic figures for erasure requests is Germany. One need only compare Google street views for Germany versus any other country in the world to see that Germans love their privacy. People had to request that their buildings be blurred out, and Germans did it in droves. Will they do likewise with the GDPR’s right to erasure?google street viewFor most, we suspect that the unsubscribe will suffice.

How to Forget

How each email marketing software provider (ESP) contends with the right to erasure varies. Some ESPs instruct recipients to send them an email if they want to be forgotten, while others remain silent on the means to be forgotten. For our own part, we decided to automate the feature in Symphonie, so if it’s enabled by the administrator, recipients can choose to be forgotten with no manual labor. If the number of requests to be forgotten for European users climbs as high as some suggest this could be a big labor saver for Symphonie users.

As mentioned previously, the true test of these clauses in the GDPR will be put to the test over the next few months. Given the ability of people to find loopholes where the creators thought none existed, we’re sure to see some amendments to the regulation.

Go to Goolara website

1. Chapter 3, Article 17: Right to erasure (‘right to be forgotten’)

GDPR and Email: Part 1, an Overview

Leave a reply

GDPR vs. Email
They started working on it in 2012, and for the next four years, the countries of the European Union argued over, cajoled each other, and hammered out the details of a ruling known as the General Data Protection Regulation (GDPR). It was a long hard slog, but when the dust had cleared, the feeling was that the Council of the European Union and the European Parliament had a regulation that would satisfy the privacy issues inherent with any new or future technology, without hampering individual needs.

Or did they?

Ratified on May 24, 2016, the GDPR took effect on May 25th, 2018, and offers the strictest set of regulations to date as to what you can and cannot do with someone’s data. Everything from Facebook to your digital camera has to comply with the regulation, and that includes email subscriptions.

It Affects the Whole World

Although intended to protect the citizens on the European Union, it also applies to overseas companies with EU subscribers—and here’s where the GDPR starts getting fuzzy. In a recent webinar, listeners were told that they don’t have to worry about the GDPR as long as they can prove that did not actively seek European subscribers. On another site, readers were told that if you have any European subscribers, you’re obliged to follow the GDPR restrictions. So who’s right? The webinar is correct, in fact. If you can prove that you intended for your site to be used exclusively outside of the EU and had no mechanism in place to entice European subscribers, you are not liable, but that also means you might have to prove it at some point, and if, for reasons beyond your control, a large number of your subscribers are from the European Union, you’ll probably lose that fight.

That Depends on What The Meaning of “Is” is

At first glance, the GDPR looks pretty thorough. It even has a section that defines the terms it uses, such as “personal data” and “natural person.”1 But look more closely and you’ll see that every definition, in turn, raises new questions. “Personal data,” for instance, is defined as “any information relating to an identified or identifiable natural person (‘data subject’),” and goes on to explain that “an identifiable natural person is one who can be identified, directly or indirectly” (italics mine). Although the ruling is broad enough to include it, you won’t find a discussion of email anywhere in the regulation. In fact, the word “email” is used only once—as an example of one of the things that can be used to identify a person.

After reading and re-reading the current crop of articles about the regulation, what strikes us is how few of these address the questionable areas of GDPR, especially as it relates to email marketing. Whether you run email marketing using your own equipment or take advantage of a hosted solution, here are some questions and discussion about GDPR challenges for email senders.

Tell Me You Like Me

If you’re a European citizen and you’ve signed up to receive email from a company, that company must “demonstrate” that you actually did sign up. So how do you demonstrate that someone provided their information on a web form? The GDPR goes on to talk about written declarations, but that is unlikely to apply for email marketing.

You can be audited to ensure that you are complying with the GDPR, so you should be able to prove this.2 If you say that the recipient confirmed with a double-opt-in, what physical evidence can you present to backup this statement? Is the word of your software that says the recipient clicked the link enough? Do we need to record additional information to show this action really happened, like recording the IP address and browser information used when the confirmation link was clicked? But wait! Isn’t that Personal Identifying Information (PII) that you shouldn’t be keeping on recipients? Which takes precedence? Proving the recipient “demonstrated” their consent, or minimizing the PII for that recipient?

A double-opt-in confirmation step would seem to “demonstrate” the person’s interest in receiving your email. But as many email marketers know, getting people to confirm is challenging. A double-opt-in can reduce the list size; forcing them to do it again is guaranteed to reduce list sizes even further.

Unsubscribing is not Forgetting

You won’t find the word “unsubscribe” anywhere in the regulation or its recitals.3 When you unsubscribe, your information is still in the database, being applied to past metrics and ensuring that you aren’t accidentally left on any mailing list segments. Unsubscribing should be easy. Just click the unsubscribe link on any email and as long as it is an honest and legitimate company you should stop receiving mailings from that company in short order. But the GDPR even complicates this.

“Personal data shall be: adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed…” the regulation states, but then goes on to say: “In a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.” To further muddy the waters it continues by adding that “personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes…in order to safeguard the rights and freedoms of the data subject.”4

The first statement seems to indicate that data about a recipient can be retained only while it is needed for processing. For a regular newsletter subscriber, it seems likely that retaining their information would be acceptable to be able to provide the newsletter service. But what if the person unsubscribes? Or the email address is no longer valid (goes on-hold). Should any personal data for the recipient be removed at this point?

The structure of the GDPR seems to suggest that the answer to this is no unless the person has requested to be “forgotten,” which opens up a whole new can of worms.

I Forgot to Remember to Forget

One of the most controversial and discussed topics about the GDPR is its “Right to erasure (‘right to be forgotten’)” clause, which states that the “data subject” has the right to request the erasure of personal data.5 Of course, nothing is ever that simple. The regulation goes on to list the cases where a person may request erasure. Since these include for direct “data marketing purposes,”6 we can assume that it applies to most email situations, but is it possible to request that a company erase all your personal information, even though you wish to remain a customer? And what about past metrics? If 25 subscribers clicked on links last year, then asked to be forgotten this year, what happens to that data? Data from previous could be construed as “historical research,” which the GDPR says is okay to keep.7

If “forgotten” means you’re no longer anywhere in the system, and not simply, “we’re not going to send you any more email,” how would you know this? Surely you need to keep a record verifying that a person requested to be forgotten, but if you do, then they’re not completely forgotten. It reminds us of comedian Mitch Hedberg’s joke: “A man in an infomercial told me to forget everything I knew about comforters, so I did. Then he tried to sell me a comforter, but I didn’t know what it was.” If you don’t keep track of who asked to be forgotten, then how can you prevent them being re-entered into your system? It’s ludicrous. The GDPR seems to suggest that a marketer has the right to retain the email address since it’s required for compliance with the legal obligations of the states and is required by the email marketer for the defense of claims that the recipient might make.

Data Extraction

In Article 20, the GDPR is very clear that a person has the right to “receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format.”8 This is the “data extraction” clause, and the way it is worded suggests that every email marketer intending to be compliant with the GDPR should have a mechanism that allows recipients to see the data that’s been collected on them. It just doesn’t say what this data might be. Data in demographic fields or associated one-to-many tables would seem like reasonable choices, but how about open and clickthrough data?

For both the data extraction request and the request to be forgotten, there are privacy and security issues left unaddressed by GDPR. You could, for instance, create a web form that lets an email address be “forgotten” when it’s entered, but then a malicious person could erase data just for kicks. Similarly, providing all the collected personal data on request should require some validation to ensure the recipient is actually requesting this data.

Many ESPs have added a request to be forgotten feature to their privacy policies requiring you to send an email to request this. While this wouldn’t appear to be automated, at least it’s a step towards ensuring the recipient is the one making the request. As for the request for data requirement, so far, only Goolara offers to extract the recipient’s personal data in electronic form. Since it is a requirement of the GDPR, we expect others will eventually comply.

Final Thoughts

While the goals of the GDPR are fairly clear and even laudable, it can be difficult to implement when the rubber hits the road. How do we both remove personal data and keep some for the purpose of honoring the unsubscribe? Do we really need to remove all demographics when someone unsubscribes? How do we implement features like data extraction and make it available for portability? We’d like to hear your thoughts on this in the comments below.

In Part Two, we’ll get a little deeper into the nitty-gritty of the GDPR, and look at the right to be forgotten in more detail.

Go to Goolara website

1. Chapter 1, Article 4: Definitions

2. Chapter 2, Article 7: Conditions for consent

3. Recitals are brief descriptions added to the GDPR to help clarify certain terms and aspects of the regulation. At this time, there are 173 recitals!

4. Chapter 2, Article 5: Principles relating to the processing of personal data

5. Chapter 3, Article 17: Right to erasure (‘right to be forgotten’)

6. Chapter 3, Article 21: Right to object

7. Chapter 9, Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

8. Chapter 3, Article 20: Right to data portability