Personal data protection Archives - Polikarpov Law Firm

Question 1

Do I have to comply with the GDPR if my business is not located in the EU, but my website is visited by users from Europe

Accepted Answer

Yes, it is. GDPR has extraterritorial in nature, which means that it applies not only to companies located in the EU, but also to those that process personal data of EU citizens; regardless of their location.

Thus, if your website is accessible to users from Europe and you collect their personal data (even if your business is physically located in Ukraine or any other country in the world), you are obliged to comply with the GDPR.

This applies to any personal data:

Name, address, email address: if the user provides them during registration, filling out a feedback form, etc.
IP address, location data, online identifiers (cookies)

Ignoring the GDPR can lead to serious consequences:

Fines: up to EUR 20 million or 4% of annual global turnover.
Reputational risks: loss of customer confidence, negative reviews, deterioration of the brand image.
Legal actions: from users whose rights have been violated.

Recommendation: Don’t take any chances. Ensure that your website is GDPR compliant, no matter where you are. This is an investment in the security of your business and the trust of your customers.

Question 2

I use Google Analytics on my website. Does this mean that I collect personal data through cookies, and do I need to obtain user consent

Accepted Answer

Yes, using Google Analytics on your website usually means collecting personal data via cookies, and you do need to get consent from EU users for this.

Why are Google Analytics and cookies related to personal data?

Google Analytics uses cookies to track user behaviour on a website: which pages they visit, how long they spend on each page, where they come from, etc. While this data may seem anonymous at first glance, the GDPR treats some of it as personal, as it can be used to identify a user when combined with other information.

For example:

IP address: Google Analytics can collect users’ IP addresses, which is already considered personal data.
Unique identifiers: Google Analytics assigns a unique identifier to each user, which is stored in a cookie and used to track their activities on the website. This identifier can also be considered personal data.

What do I need to do to use Google Analytics in compliance with the GDPR?

Get cookie consent:
- Place a clear and understandable cookie notice on your website, explaining what data is collected, for what purpose, and how the user can manage cookies.
- Use a GDPR-compliant consent mechanism, such as a pop-up window with a choice of the type of cookies the user allows to be used.
Configure Google Analytics to anonymise IP addresses:
- Activate the IP anonymisation feature in Google Analytics. This will cause Google Analytics to use only a part of the IP address to determine the geographical location of the user, making it difficult to identify them.
Update your privacy policy:
- Include in your privacy policy information about the use of Google Analytics, the types of data collected, and how users can manage their data.

Remember that Google Analytics is just one of the tools that can collect personal data through cookies. It is important to analyse all the services and tools you use on your website and make sure that you obtain users’ consent to collect and process their data in accordance with the GDPR.

Question 3

What are the implications for my business if I ignore the GDPR's cookie requirements

Accepted Answer

Ignoring the GDPR’s cookie requirements can have serious negative consequences for your business, both in the short and long term.

Here are some of them:

Financial:

High fines: The GDPR provides for fines of up to €20 million or 4% of a company’s annual global turnover(whichever is greater) for serious breaches, which include the unlawful collection and processing of personal data through cookies..
Legal Expenses: Users whose rights have been violated have the right to sue for damages.
Loss of funding: some investors and partners may refuse to cooperate with companies that do not comply with the GDPR.

Reputational:

Damage to brand image: Information about GDPR violations can spread quickly online and in the media, negatively impacting your company’s reputation and brand trust.
Loss of customers: users concerned about their data privacy may stop using your site and services if they find out about GDPR violations.
Negative reviews and comments: users can leave negative feedback about your company on review sites, social media, etc.

Others:

Data processing ban: regulators may prohibit you from collecting and processing personal data of EU citizens, which may result in the suspension of your website or even your business as a whole.
Regulatory inspections: your company may become the subject of close attention from regulatory authorities, which will entail additional costs for legal advice and support.

It is important to understand: that even if your business is not located in the EU, you are still obliged to comply with the GDPR if you process the personal data of EU citizens. Don’t underestimate the importance of GDPR and risk the future of your business.

Question 4

What are the "lawful grounds for processing personal data" and how can I make sure that I collect user data legally?

Accepted Answer

Lawful basis for processing personal data” are the conditions clearly defined by the GDPR under which you are allowed to collect, store and use personal data from EU users.

The GDPR defines six main legal grounds:

Consent: the user has freely and explicitly agreed to the processing of their data for a specific purpose.
- Important: consent must be informed, specific, unambiguous and freely given. It is unacceptable to use pre-set checkboxes or to impose consent as a condition of using the service.
Contract: the processing is necessary for the performance of a contract to which the data subject is a party or for taking measures at the request of the data subject prior to the conclusion of the contract.
- For example: processing data for the delivery of goods ordered in an online store.
Legal obligation: The processing is necessary for the performance of a legal obligation imposed on the data controller.
- For example: accounting, tax reporting.
Protection of vital interests: processing is necessary to protect the vital interests of the data subject or another natural person.
- For example: processing medical data for emergency medical care.
Public interest: the processing is necessary for the performance of a task carried out in the public interest or in connection with the exercise of public authority vested in the data controller.
- For example: processing data for fraud prevention, for scientific research.
Legitimate interests: the processing is necessary for the legitimate interests of the data controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data.
- For example: video surveillance to ensure security at facilities, analysis of website traffic data to improve it.
- Important: when using this ground, a balance of interests test should be performed to ensure that the rights and interests of users are not violated.

How do you make sure you collect data legally?

Define the purpose of the data collection: why do you need this data? What specific business processes will you run with it?
Select the appropriate legal basis: which of the six grounds best suits your purpose and circumstances?
Be transparent: tell users what data you collect, for what purpose, on what basis, how long you will keep it, and to whom you may share it.
Get consent: If you are using consent as a legal basis, make sure it meets all the requirements of the GDPR.
Maintain documentation: write down what data you collect, on what basis, when and how you obtained consent, etc. This will help you prove the legitimacy of your actions in the event of an audit.

Remember: the lawfulness of data processing is one of the key principles of the GDPR.

Question 5

How often do I need to update my website's cookie policy to be GDPR compliant

Accepted Answer

There is no explicit GDPR deadline for updating a cookie policy. However, it’s important to understand that the GDPR requires that your cookie policy is always up-to-date and reflects the reality of your website.

Here are a few situations when you should update your cookie policy:

Changes in legislation: If there are any changes to the GDPR or other laws relating to the protection of personal data, you will need to make the appropriate adjustments to your cookie policy.
Changes in cookie use: If you start using new types of cookies, change the purpose of their use, or add new third-party services that use cookies, you will need to update your cookie policy to reflect these changes.
Changing the data processor: if you have started to cooperate with a new analytics service provider, advertising network or other service that will process personal data of your website users, you need to inform about it in the cookie policy.
Recieving complaints: If you receive complaints from users or regulators about your cookie policy, you should review it and make any necessary changes.

Recommendations for updating:

Regular review: It is recommended that you review and update your cookie policy at leastonce a year..
Monitoring changes: Follow the news and updates on GDPR and data protection legislation to stay up to date with the latest changes.
Legal advice: If you are in any doubt about the relevance of your cookie policy or the need to update it, please seek advice from a lawyer specialising in GDPR.

Remember: an up-to-date and transparent cookie policy is not just a legal requirement, but also a show of respect for your users and concern for their privacy.

Blog

Privacy settings

Manage settings

Necessary

Marketing

Personalization

Analytics