Messages about the GDPR are arriving in large numbers: newsletters, webinars and consultants, all with the same message. May 25, 2018 is approaching, fines can reach 4% of global turnover, and businesses must prepare. Most of this material targets European companies, and from an island in Indonesia, it is tempting to conclude that the regulation does not apply.
The profile of actual bookings suggests otherwise. A large share of dive guests here come from Europe: Germans, French, Dutch and British travellers. They book through dive shop websites from home, months in advance. They subscribe to newsletters and email copies of their certification cards.
We therefore reviewed the regulation in detail.
Does the GDPR apply to a business outside Europe?
It can. Article 3 states that it applies to businesses outside the EU when they offer goods or services to people who are in the EU, or when they monitor the behaviour of people in the EU.
The detail matters, and many alarmist messages misstate it. The regulation concerns people located in the EU, not EU citizens wherever they may be. A German tourist who walks into a dive shop in Bali from the street is not clearly covered. The same German traveller, sitting in Munich and booking a course on the shop's website with prices in euros and a German-language page, is a much clearer case: the business is offering services to someone in the Union.
Most dive centres with an international website fall on the covered side of that line, at least for part of their business. We recommend assuming coverage and making the necessary changes, rather than debating the question after a complaint.
As for British guests, the United Kingdom remains in the EU for now, and its government has just introduced its own data protection bill that brings the same standards into British law. Brexit therefore does not remove the obligation.
Is a European regulator likely to pursue a small dive shop in Indonesia? That appears unlikely, since regulators will focus on larger organizations. Enforcement is not, however, the strongest reason to comply. The strongest reason is that guests expect it, and most of what the GDPR requires is simply sound practice.
What is the first step toward compliance?
An inventory of the personal data the business collects. A spreadsheet is sufficient: every point where personal data enters the business, what it is, where it is stored, who can access it and how long it is kept.
For a dive centre, the list grows quickly:
- booking forms on the website (name, email, phone, dates)
- newsletter sign-ups
- certification card numbers and copies of the cards
- passport details, in some cases, for boat manifests or permits
- the medical questionnaire every diver completes
- emergency contacts
- photos and videos of guests, which are then posted on Facebook
- email threads, WhatsApp conversations and the booking inbox
The medical form raises the most concern, and with good reason. Health data is a special category under the GDPR, subject to stricter rules. It is necessary for safety, but it does not need to be kept indefinitely in an unlocked drawer or as a photo on a staff member's personal phone.
Most small businesses we know have never documented any of this. Data simply accumulates in whatever tool is most convenient.
How should consent be obtained?
Clearly, with a box the person ticks personally. The newsletter is the clearest example. Many businesses automatically add every booking email address to their mailing list. Under the GDPR, this is a problem. People must actively agree to receive marketing emails, through a box they tick themselves rather than one that is pre-ticked, and they must have an easy way to unsubscribe.
The same applies to photos. Before posting a guest's face on social media, the business should ask. Most people agree willingly; some do not, and they have their reasons.
Canadian businesses are already ahead on part of this. CASL, Canada's anti-spam legislation, has required consent for commercial email since 2014. A newsletter that already complies with CASL meets most of the GDPR requirements on this point. CASL was often perceived as a burden; it now proves to be useful preparation.
How long should personal data be kept?
Only as long as it is needed for the purpose for which it was collected. This step is often the most difficult, for reasons that are more cultural than technical. Small business owners tend to keep everything: booking spreadsheets from years ago, a folder of scanned certification cards from guests who came once, all kept "just in case."
The rule should be set explicitly. Keep booking records as long as accounting and insurance require. Keep medical forms as long as the insurer or the training agency requires, then destroy them. Do not keep the rest.
Less data also means less exposure. This month, Equifax, one of the major American credit agencies, acknowledged that attackers accessed personal data on roughly 143 million people. Equifax is a very large company with a dedicated security team. A laptop stolen from a dive shop with three years of scanned passports is a smaller version of the same incident. A laptop containing no sensitive data is simply a lost laptop.
What other measures are required?
A privacy policy in plain language explaining what is collected and why. A designated person guests can contact about their data. Confirmation that the tools in use, such as the booking system and the email platform, handle data properly and will sign the agreements the GDPR requires. HTTPS on the website, which should already be in place, since Chrome began marking plain HTTP pages containing password or card fields as "Not secure" in January.
How should the work be scheduled over the next eight months?
In stages. The work does not need to be completed all at once. We recommend the following sequence.
This autumn, complete the inventory and delete unnecessary data, which alone eliminates most of the risk. Next, address the newsletter: clean the list, ask existing subscribers to confirm their subscription where their origin is uncertain, and correct the sign-up forms. Then prepare the privacy policy and the agreements with suppliers. Allow some time before May, because every software provider will send new terms in the spring, and they will need to be read carefully.
For those who wish to consult the source, the full GDPR text is laid out article by article, and it is more readable than many expect. Articles 5 and 6 are a good place to start.
If a mailing list was built by adding every customer without explicit consent, that should be corrected before any other change to the business's email newsletters. Some names will be lost. A smaller list of people who genuinely want to receive the newsletter is more valuable, and it is the only kind of list that will be appropriate to use next June.