A European Privacy Law With Reach Beyond Europe

Eleven months from now

On May 25 next year, the European Union's General Data Protection Regulation starts to apply. It replaces a 1995 privacy directive and was adopted last year.

Most of it concerns European organisations. One part reaches further: it can cover a business anywhere that sells or provides services to people in the EU, or keeps track of how they behave online.

For most small Canadian businesses the answer will be that it does not apply. For some it will, and they are not always the ones who expect it.

Treat what follows as general information rather than legal advice. Its purpose is to help you work out which group you are in, and what to write down now either way.

Who it can reach outside Europe

The regulation does not apply just because someone in Europe can open your website. It looks for signs that you are aiming at people in the EU.

• A European language on pages meant for European customers.
• Prices in euros or other European currencies.
• Checkout options for shipping to EU countries.
• Marketing aimed at Europe, such as ads targeted at European cities.
• Tracking visitors' behaviour, for example to build advertising audiences.

The last is the one owners rarely connect with the law. Remarketing tags and similar tracking that follow European visitors may count as monitoring them, even for a business that never meant to sell in Europe.

Who it probably does not reach

A business serving customers in BC or across Canada, with a site aimed at Canadians, prices in Canadian dollars, no shipping to Europe and no advertising aimed there, is probably outside it.

So is the shop whose European customers walk in on holiday: the regulation concerns people while they are in the EU.

An occasional enquiry from Europe through a contact form is unlikely, on its own, to show that you offer services there. A steady pattern of selling to Europe is different.

Probably is the honest word: guidance from European regulators is still being written.

What it asks of a business it covers

A business within its reach needs a recognised legal ground for every way it uses personal data. Consent is one such ground, and it has to be a clear action: a box someone ticks, not a box ticked for them.

People gain rights to see the data held about them, to correct it, to have it deleted in many cases, and to take it elsewhere.

Suppliers that handle the data on your behalf, such as an email service or a booking system, need written terms. Certain breaches must be reported to the authorities within 72 hours.

Some businesses outside the EU will also need a representative there, and fines for serious failures can be large.

A worked example

A luggage store with one downtown shop sells suitcases and travel goods, repairs them, and runs an online store for replacement wheels, handles and zips for the brands it services.

The owner assumed a European law was a European problem. Then the store listed what its website actually did.

The checkout accepted addresses in any country, and a few parts orders a month went to Germany, France and Ireland. A currency menu, added years ago, showed prices in euros.

Every order since the online store opened was still on file, with addresses and phone numbers and no rule for deleting any of it. A remarketing tag followed every visitor.

Each of those is a sign the regulation looks at. The parts business is worth keeping, so the store chose to prepare rather than stop shipping to Europe.

The list of what is collected, where it lives and who handles it is under way, with a deletion rule for old orders and a session with a privacy lawyer booked for the autumn.

Start with a list

Whether or not the regulation turns out to apply, the useful first step is the same: write down what personal data the business collects through its website and around it.

Count broadly. Names, emails and phone numbers, but also delivery addresses, order histories, IP addresses and cookie identifiers can all be personal data.

For each item, note where it comes from, where it is stored, which suppliers handle it, why you keep it and for how long.

Include the places people forget: form submissions sitting in an inbox, a spreadsheet of past customers, and the analytics and advertising tags.

Then mark which of it relates to people in the EU. Order and enquiry records usually show countries, and Analytics shows where visitors come from.

An afternoon with whoever built the site covers most of it, because they know what each form sends and where.

Where Canadian law already overlaps

None of this is entirely foreign. PIPEDA, Canada's federal privacy law for businesses, already expects consent, sensible purposes, safeguards and access to one's own information.

Some provinces have their own law, and which applies turns on where and how the business handles personal information.

The EU also recognises PIPEDA as giving adequate protection, which makes it easier for European companies to send data to Canada. That concerns transfers. It does not take a Canadian business that targets Europeans outside the regulation.

What not to do yet

Do not paste a European-style privacy policy from another site. A policy describing practices you do not have is worse than a plain, accurate one.

Do not add consent pop-ups or new checkboxes before the list is done; without it, there is no way to know what to ask.

And do not assume a supplier has it handled. Ask your email service, booking system and shop platform what they are doing before May, and keep their answers.

The counter-case

For most local Canadian businesses, this regulation will turn out to be someone else's concern.

A plumber, a dental clinic or a restaurant serving its own city, with no European marketing and no shipping abroad, can reasonably make the list and leave it there.

Even a business with some European customers may find the answer narrow: changes to one part of the site, not the whole business.

The list earns its keep under Canadian law regardless, so make it now, whichever group you turn out to be in.

Before the end of summer

1. List the personal data your website collects.
2. Note where each item is stored.
3. Name the suppliers that handle any of it.
4. Check orders and Analytics for EU countries.
5. Look for European prices, languages and shipping options.
6. Ask your suppliers about their plans for May.
7. Get legal advice if the signs point to Europe.

Step four is where the question gets a real answer. Whether the regulation reaches you depends less on what you intended than on who your site actually serves.

Collecting only what a form needs is covered for one common kind of form in sign-up forms for children's classes and camps.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.