Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to What Marketers Need To Know About GDPR
Similar to What Marketers Need To Know About GDPR (20)
Recently uploaded
Recently uploaded (20)
What Marketers Need To Know About GDPR
- 1. WHAT MARKETERS NEED TO KNOW ABOUT GDPR Marketing Learning Series June 2018
- 2. TODAY’S SPEAKER Heather Meza Director of Marketing & Services
- 3. AGENDA • What exactly is GDPR? • Why it was created, what it does, what it covers • When it went into effect, who has to comply, consequences of non-compliance • EU citizen rights • What marketers need to know • Centralized data management and oversight • Explicit and proactive consent • Right to be forgotten • Event marketing, advertising and social, inbound and lead capture • Actions to take toward GDPR compliance • Do’s and don’ts • Frequently asked questions • Additional resources • Actions 3©2018 Crawford Group. All Rights Reserved.
- 4. DISCLAIMER: We are not lawyers. This is informational only and NOT legal advice. We recommend you contact your legal representative before taking action to ensure GDPR compliance.
- 6. 6©2018 Crawford Group. All Rights Reserved. General Data Protection Regulation (GDPR) Why it was created: GDPR was created to protect the privacy of people living in the European Union (EU) and European Economic Area (EEA) by giving them control of their personal data while imposing rules on how it’s housed and used. What it does: It guarantees a set of specific rights that businesses must honor when capturing and storing personal data for people living in the EU & EEA. What it covers: Any information that could identify a specific individual, such as their name, email address, location info, and / or online identifiers like cookies.
- 7. 7©2018 Crawford Group. All Rights Reserved. General Data Protection Regulation (GDPR) When it went into effect: GDPR went into effect May 25, 2018 Who has to comply: ALL companies doing business with people living in the EU, regardless of company size or location. Consequences of non-compliance: Intent and level of offense matters. Upper level offenders can face huge financial penalties — €20mil or 4% of global revenue, whichever is bigger.
- 8. 8©2018 Crawford Group. All Rights Reserved. General Data Protection Regulation (GDPR) EU & EEA citizens / residents have the right to: • Get detailed info on what data your company has on them, where it’s stored, and how it’s used. • Be notified within 72-hrs of a data breach that might compromise their privacy. • Ask that your company transmit their data to another company (like when they want to switch to a competitor). • Change incorrect information stored about them or revoke previous consent. • Demand you delete all information you have on them.
- 9. What marketers need to know
- 10. Data given, rather than gathered unwillingly, is simply more valuable as a marketing asset.” Robert Rose @Robert_Rose “ GDPR: The Biggest Gift to Content Marketers in a Decade SOURCE: https://contentmarketinginstitute.com/2018/06/gdpr-content-marketers/
- 11. Data must be securely managed, maintained, accessible, and in-sync across all systems • Updates and changes to personal data need to be consistent and integrated across all data collection systems. • Individual’s personal data must be easily accessible and allow them to update it. • Must appoint a Data Protection Officer (DPO) to serve as overseer and point of contact for GDPR. • Report and address breaches within 3-business days. CENTRALIZED DATA MANAGEMENT & OVERSIGHT 11©2018 Crawford Group. All Rights Reserved.
- 12. Explicit and proactive consent is required in order to legally store and use data • Manual opt in is mandatory (text disclaimers alone are not adequate). • Checkboxes can’t be pre-checked and need to be accompanied by a statement that specifically outlines how the person’s information will be used. • Double opt in is recommended, but not specifically called out in the regulation. • 3rd party or shared lists require explicit opt in for your specific company use. EXPLICIT & PROACTIVE CONSENT 12©2018 Crawford Group. All Rights Reserved.
- 13. Companies must enable and support people’s requests to delete any and all information being stored about them • Includes removal from all systems (e.g. downstream systems like marketing automation) • Financial transaction data is excluded (e.g. invoices, account collection, etc.) • You can anonymize data collected (e.g. keep cookies that are not linked to a specific individual). “Pseudonymization” is what the regulation promotes. RIGHT TO BE FORGOTTEN 13©2018 Crawford Group. All Rights Reserved.
- 14. Before • Ensure you have consent prior to any communications and that your data is integrated across all systems. • Update all registration forms to gain consent (ensure partners, vendors, and sponsors do the same). • Document processes and train staff how to obtain consent. During • Make sure mobile apps and badge scanners include opt in. • Make consent is clear at in-person events. Take pictures of signage for physical collection of information. After • Ensure any data sharing is in compliance. • Recommend double opt in for info captured manually. EVENT MARKETING 14©2018 Crawford Group. All Rights Reserved.
- 15. Contact-based retargeting • Use a double opt in on your forms to be extra safe. • Include ad retargeting in your opt out process. Cookie-based retargeting • Get opt in for all cookies on your website. • Include link to opt out on retargeting ads. • If they opt out, make sure you can remove them from future retargeting activities. IP targeting • Individual (device ID) requires opt in (cookies). Corporate (domain-level) is OK, use caution when adding filters. Social Media • Add lookalike lists as one of your uses in your terms and conditions. Enable them to opt in / out. ADVERTISING & SOCIAL 15©2018 Crawford Group. All Rights Reserved.
- 16. Websites • Get opt in for all cookies on your website via an opt in pop-up box, regardless of whether or not you track personally identifiable information. Forms • Ensure fields are consistent and contain opt in messaging. • While not required, using a double opt in process is considered a best practice. • Provide a robust preference center that allows for easy selection of things to opt in to. Affiliates and purchased lists • Make sure that any lists you buy, and all partner / affiliate sites from which you collect data, are compliant. INBOUND & LEAD CAPTURE 16©2018 Crawford Group. All Rights Reserved.
- 17. Actions to take toward GDPR compliance
- 18. 18©2018 Crawford Group. All Rights Reserved. GDPR do’s and don’ts for marketers 👍🏻 DO • Audit data, run opt in campaign if needed • Update forms and websites to enable opt in • Enable opt in / out, and “forget me” via preference center or landing page • Update privacy policies, maintain and document processes • Appoint a Data Protection Officer (DPO) • Don’t communicate with anyone in the EU if you don’t have documented consent • Don’t use pre-checked boxes for opt in • Don’t use 3rd party or shared lists without explicit permission for your company • Don’t assume, talk to your DPO and / or legal representation to ensure compliance 🚫 DON’T
- 19. 19©2018 Crawford Group. All Rights Reserved. Frequently asked questions Ⓠ Does this apply to American and / or small companies? Yes. It applies to personal data of EU citizens. Company location or size doesn’t matter. Ⓠ What about BREXIT? Doesn’t matter. The UK has stated that it will comply with the GDPR, and that its compliance will not be affected by Brexit. Ⓠ Does this apply to data I collected before May 25, 2018? Yes. If you do not have a record of them opting in, you will need to proactively get it before sending them any communications. Ⓠ Does this apply to individuals outside of the EU & EEA? No, but it’s recommended as a best practice.
- 20. 20©2018 Crawford Group. All Rights Reserved. Frequently asked questions Ⓠ Is social media impacted by GDPR? Yes, but the terms and conditions of sites like Facebook, LinkedIn, Instagram, and Twitter cover you for the most part. Use caution when retargeting or using lookalike lists. Ⓠ Are badge scanners and business card drop boxes included? Yes. Ensure you have clear opt in messaging posted next to physical collection sites, like fishbowls and follow-up with an opt in via email. Have staff request opt in permission verbally when scanning badges, in addition to collecting the opt in digitally. Ⓠ What about cold calling/emailing or direct mail? In theory you can reach out if you can show it’s related to the contact’s “legitimate interest” and you give them the ability to opt out. It’s recommended that you log activities in your CRM and track opt in / out status for these types of activities. Talk to legal before acting.
- 21. • Official GDPR regulation https://ec.europa.eu/info/law/law-topic/data- protection_en • The GDPR portal https://www.eugdpr.org/ • The Uncomplicated Guide to GDPR and Event Marketing https://splashthat.com/resources/gdpr-guide-event- marketing • The Marketer’s Guide to GDPR https://www.treasuredata.com/resources/marketers- guide-to-gdpr/ • Event Marketing and GDPR: What You Need To Know https://blog.crawfordgroup.com/blog/event-marketing- and-gdpr-what-you-need-to-know ADDITIONAL RESOURCES 21©2018 Crawford Group. All Rights Reserved.
- 22. • LinkedIn https://www.linkedin.com/ company/crawford-group/ • Facebook https://www.facebook.com/ Crawford.Group.Community/ • Twitter https://twitter.com/_CrawfordGroup WWW.CRAWFORDGROUP.COM DON’T FORGET TO FOLLOW & ENGAGE! 22©2018 Crawford Group. All Rights Reserved.
- 23. THANK YOU
Editor's Notes
- Presentation Title
- HEATHER’S BIO: Heather Meza LOVES marketing. She’s been balancing the art and science of marketing for over 25 years, working with companies like Cisco, IBM, Content Marketing Institute, and now she leads the marketing team for Crawford Group. Known for her energy and enthusiasm, Heather is an experienced trainer and public speaker who is passionate about helping and motivating her fellow marketers.
- Agenda
- Quote Change photo: Selct photo and delete. Drag new photo into picture box and Send To Back
- Section Divider Reposition the Title as appropriate to the image layout Change photo: Selct photo and delete. Drag new photo into picture box and Send To Back
- For event marketers, GDPR means new procedures must be put in place in order to do business in Europe. While this presents challenges, ultimately it can actually improve how you promote events and communicate with prospects and customers. On the downside, requiring more proactive consent to market to individuals means you’re certain to see a decrease in the number of people you’re allowed to contact. On the upside, the people who give you their active consent are going to be much more qualified leads. Ultimately, the goal of GDPR is to protect the rights of individuals. By respecting these rights, your organization has an opportunity to create more meaningful and trusting relationships with your audience in the future. While these new regulations were written specifically for countries in the European Union (EU) and European Economic Area (EEA), they have serious implications for American event marketers who do any sort of business with people in Europe When referring to data, the regulation is quite broad and covers any information that could identify a specific individual. This includes not only their names and email addresses, but also location information and online identifiers such as coo
- The consequences for not being in compliance for GDPR vary from mild to grave, including potentially massive financial penalties. The European authorities review potential violations of GDPR based on 10 different criteria. These are designed to determine whether a business has willfully defied the regulation, or has just made a mistake either by accident or oversite. They’re also designed to measure how heavy a penalty to place on your business. If you’re a first-time violator, or if your violation is determined to be unintentional, it’s possible you’ll be given an official warning or reprimand. But if you’re a repeat violator or found to be uncooperative, the next level of penalties can be severe. For starters, you could face a complete suspension of your ability to process any data within the EU. The effect of which means you’re essentially banned from doing business in the 29 European countries covered under GDPR. After that, the penalties get even more harsh. For what the authorities consider lower level infringements, you could face fines of up to €10 million, or 2% of your company’s entire annual revenue for the previous year—whichever of those two numbers is higher. Get busted as an upper level offender and the fine increases to €20 million, or 4% of your entire global revenue (again, they pick the higher number for the sanction). Simply put, if you’re not serious about following the rules laid out in GDPR, you can be assured that the European authority definitely is. Unless you feel comfortable suspending all of your business in Europe or paying out €20 million, you need to get serious about compliance.
- “data erasure”
- Big Statement Change photo: Selct photo and delete. Drag new photo into picture box and Send To Back
- SOURCE: https://contentmarketinginstitute.com/2018/06/gdpr-content-marketers/
- DATA INTEGRITY & SECURITY --- demonstrate that you have controls in place for keeping information secure. IF there is a breach, have to report & fix in 3-biz days. Appoint someone (anyone) who can be called about GDPR as the Data Protection Officer.
- Marketing software provider, HubSpot say "The GDPR is silent on whether this form of consent is required, and unless guidance to the contrary is issued by the EU or our supervisory authority, our view is that this is not mandatory under the GDPR".
- Anonymization is the encryption or removal of identifiable information so that it can never be tied back to a user. Pseudonymization is somewhere between identified and anonymous. With pseudonymization, the data components are anonymized and separated but can be put back together. For example, a system might assign a user one identifier for location and another for browser that can only be tied back to the user if it is put together with their date of birth, which is kept separately. The regulation promotes pseudonymization over anonymization.
- • Ensure all your different prospect and customer databases have consistent communications preferences fields that are synced daily
- LEGIT INTEREST --- https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/
- Don’t forget that we have a referral bonus program open to anyone.