GDPR: What Companies Need to Make Available to Consumers

The GDPR-era has commenced a week ago and the dust has begun to settle. So, what’s next? Everyone has been inundated with notices from companies explaining changes to their policies and seeking consent from users over the past few weeks. These changes relate to various provisions of the GDPR, and as companies adopt compliance controls to manage user data, the effects of the GDPR will continue to surface.

The GDPR gives authority to users to decide the extent by which their personal data can be used by organizations. The GDPR seeks to regulate the use of such personal data collected by businesses by defining the boundaries of data collection, data processing and data use with the aids of policies, notices, consent and access requests.

Should all businesses obtain ‘consent’?

It depends. If your organization does not process personal data for identification of end users, there is no need to obtain any consent. However, it is recommended that an express consent mechanism is in place to reflect your organization’s respect for privacy and user data.

What should businesses address for a GDPR-compliant ‘consent’?

GDPR requires consent management to be an affirmative indication of a user’s wish for processing personal data. To elaborate, a valid consent should be:

Express, explicit and clear;
Informed, unambiguous and freely given;
By way of a statement or an affirmative action;
Independent of other terms and conditions;
Intelligible and easily accessible, using clear and plain language.

An explicit consent statement should clearly explain the extent of personal data being collected, processed, and transferred, while also outlining any associated risks. In addition, explicit consent supported by a clear audit trail is a prerequisite for processing sensitive data, enabling automated decision-making, creating user profiles, and conducting international data transfers.

Moreover, the GDPR has strengthened user rights through the “Right to be Forgotten,” which allows individuals to withdraw previously granted consent and request the deletion of their personal data. As a result, organizations must put suitable mechanisms in place to allow users to withdraw consent easily and without unnecessary barriers. Furthermore, businesses should maintain accurate records of all consent withdrawals and the actions taken in response, thereby ensuring transparency, accountability, and ongoing compliance.

What should businesses do to inform users of data processing?

The GDPR requires businesses to adequately inform users on multiple facets of data collection, recipients of data, data access procedures and timelines of data storage in the form of ‘Fair Processing Notices’. Here is a bird’s eye view of the mandatory contents of notice:

What information is being collected? – Details and categories of personal data collected;
How is the information being collected? – Methodology of collecting personal data;
Why is specific information being collected? – Legal basis and justification for collecting personal data;
Who is collecting it? – Identity and contact details of applicable businesses;
Who will the data be shared with? – Recipients of underlying personal data;
How long will the information be stored? – Period of storage;
How will it be processed? – Purpose, intent and legal basis for processing data;
How will it be transferred? – Safeguards and data retrieval mechanism in case of international data transfers;
How should a user access personal data after consenting? – Data access request and data portability;
How can consumers enforce their Right to be Forgotten? – Request deletion of personal data; withdrawal of consent;
Who should consumers contact when inquiring about personal data or other concerns? Contact details for the data protection officer.

Businesses should ensure that data is used in compliance with the consent obtained. If businesses intend to use the data for any other purpose, additional consent is warranted specific to the new use. This means that businesses can no longer utilize available user data for marketing and targeted advertising without prior user consent.

What should businesses do to comply with data access requests?

The GDPR requires organizations to design and implement appropriate user access forms that allow individuals to view, add, edit, and delete their personal data. In practice, users must be able to request access to their data and electronically download the information collected and processed, free of charge. However, a reasonable fee may be applied only when fulfilling a request involves additional administrative effort.

Furthermore, when international data transfers are involved in data storage or retrieval, businesses must clearly inform users about the associated risks as well as the safeguards in place to protect their information. In addition to basic access rights, users are also entitled to request data rectification, erasure, and restriction of processing. Moreover, the GDPR grants users the right to data portability and the right to limit or object to automated individual decision-making and profiling. Together, these rights reinforce transparency and place greater control over personal data directly in the hands of users.Businesses should ensure suitable policies are in place to address the following:

Right to rectification

Choice to update incomplete personal data or submit an additional statement in order to correct it

Right to erasure

Possibility to remove personal information due to legal obligations, inessential purposes, consent withdrawal, improper processing, and

Right to restriction of processing

Option to restrict personal data processing on account of inaccuracy, unlawfulness and legal requirements;

Right to data portability

Users have the option to receive personal data in a structured, commonly used, machine-readable format and transmit it to another business.
Additionally, users have the right to object to automated decision-making or profiling that produces legal or similarly significant consequences.
Businesses must address all data access requests within 30 days, with a possible 60-day extension for complex or high-volume requests.
Failure to comply can lead to complaints to supervisory authorities, increased legal exposure, and significant financial penalties.

As the GDPR continues to unfold in real time, businesses and compliance professionals will learn more about these provisions’ application to actual fact patterns, and development of best business practices will come soon after. This is an exciting but trying time for compliance and privacy professionals. Companies that collect user data must remain informed and ahead of the curve.

If your organization has any governance, risk mitigation, ethical or regulatory compliance concerns, we can help simplify things for you. Contact us directly at 908-447-0521 or via email at info@riddlecompliance.com.