“Data privacy by design, data privacy by default.” You may have heard this phrase recently, on Twitter or in blog posts, but where does it come from? What does it really mean? Most importantly, how does it affect your customers and their domain names?
What is the GDPR?
The European Union’s General Data Protection Regulation (“GDPR”), coming into effect in May 2018, lays out a new set of rules for how the personal data of EU citizens should be handled. It sets out the protection of personal data as nothing less than a fundamental human right, alongside other rights such as freedom of expression, freedom of thought, and the right to a fair trial. The GDPR is complex and far-reaching, and we’ll look at a few of the most impactful areas in this blog post. You can also keep an eye out for updates in our blog and newsletter.
Data privacy by design, data privacy by default
How many times have you bought a concert ticket online or RSVP’d to an event, only to find your inbox unexpectedly filling up with the concert venue’s newsletters and invitations to other events that are only tangentially related? Wouldn’t it be great if service providers had to get permission to use your contact information for anything other than what you’d provided it for in the first place?
That type of clear, informed consent is one of the basic requirements in the GDPR. Any business taking in your personal data not only has to explain what they need it for, they’re also simply not allowed to require you to provide more information than the absolute minimum they need to get the job done. What’s more, they can’t use your information for any purpose other than that which you agreed to in the first place. This puts you in charge of how your information is used from the very start — by design and by default — instead of making you unsubscribe after the fact.
Not only should companies’ use of your data remain within the limits of what you consented to, but the data needs to be stored securely, accessed only for the reasons already agreed upon, and cannot be shared with third parties outside the bounds of this regulation and what you consented to.
Quick, transparent reporting on data security breaches
We all know mistakes happen, and security best practices are constantly evolving. Living in the world means accepting some measure of risk, and it seems that every few days there’s a news story about a major data breach affecting hundreds of thousands of people — but usually by the time we hear about it, the breach happened months ago, leaving sensitive information exposed to the world and the affected people unaware. The GDPR addresses this with a timeframe around breach notifications, requiring that people whose information has been compromised are notified as soon as possible. This notice must include an explanation of what happened, what’s being done to fix it, and what the affected people should do to protect themselves. This type of information empowers each person to respond the way they think is best in each circumstance in order to protect their own privacy.
The right to be forgotten
Imagine you signed up for a subscription service, the kind that would send you a new product every month. Then, after signing up, you find out that the service does not ship to your location. So then you cancel your account, but continue to get emails, asking you to reactivate the service and recommend it to friends. Why can’t they just forget all about me? Or, for a perhaps more serious example, how often do we hear stories about people who lose out on job opportunities for which they would be very well-suited, just because of youthful indiscretions that still come up high in online search results?
That’s another important aspect of the GDPR: the right to be forgotten. Under these new rules, people can go back to service providers and revoke the consent to use their data, requiring the provider to remove all records and essentially erase them, giving them a fresh start. Now, this may not be without consequences (some services can’t be provided without personal information) and may not always be applicable (sometimes personal information has to be kept for reasons of public interest or relating to legal claims), but it’s certainly a lot more effective than sending an “unsubscribe” email, blocking the sender’s email address, and hoping for the best.
How does this apply to the domains world?
Are you a reseller with clients in the EU? You now need to ensure that you’re obtaining permission from these customers to use their personal data, and meeting the updated requirements surrounding its handling. This should involve a talk with your lawyer(s). Though we’re making an effort to provide resources and context, the information we’re providing should not be considered legal advice. Seeking professional, legal counsel from someone who is familiar with your specific situation is critical.
At EPAG, we’re working on amending our Agreements with our resellers, including Privacy Agreements, to allow resellers full access to the info in the Control Panel without any concerns around GDPR violations. That said, domain owners with no connection to the EU likely won’t see a lot of changes on a day-to-day basis.
Going back to the “data privacy by design and by default” idea, what it means is that all these regulations around protecting personal information can’t just be afterthoughts, they need to be “baked in”, part of the system that’s on unless you turn it off. We’ll be empowering our clients to understand what information we hold and how it’s used, to give consent to us for that use, and to request erasure of data in cases where consent cannot be provided.
Changes we’re making at EPAG
These data privacy protections touch almost every aspect of the domain onboarding process and lifecycle. We’re working through our detailed plans now, and will soon be able to share more information about our implementation; today we will share some highlights. As we work through this project, we’re keeping two things in mind: our need to operate within the bounds of legal requirements, and our commitment to keeping domain purchase and management as straightforward, simple, and instantaneous as possible for the end-user.
Where possible, we’ll implement a post-purchase consent process, similar to the Registrant Verification request we send when a new domain is registered. We may combine the two into a single request if both verification and consent are needed at the same time. Watch for details on this process in upcoming blog posts and our newsletter.
We already store your data securely, but we’re doing some internal review to see how we can strengthen our protections to keep information safe. Thinking back to the example of the marketing company who shared info with third-party companies, we want to make it clear that EPAG does not share personal data beyond what’s needed to provide the service that the client ordered. We never sell our client’s personal information, and we certainly aren’t going to start now.
Although in a perfect world every domain would stay with EPAG forever, we know that, realistically, some people want to use other Registrars, or don’t want to renew every domain they have registered until the end of time. And when they’re no longer our client, they may not be comfortable with EPAG storing their personal data. That’s where the right to be forgotten comes in; we’ll be reviewing our data retention procedures, and putting in place a method for people to request erasure of personal data from our platform. This is not without consequences, but in some cases it’s necessary.
Conclusion and Next Steps
We hope that this overview of the GDPR and the changes we’re looking at making has been helpful, and explains why this new regulation is important not only for our European clients, but for our resellers worldwide. We know it’s a lot of information, and that you have many questions. We’ll be reaching out to resellers on implementation details soon, and keeping you informed as we move through this process. Until then, check out our blog and GDPR page for more details as May 25 2018 approaches!
