GDPR Archives - Analytics Platform - Matomo

A Guide to GDPR Sensitive Personal Data

Erin — Mon, 13 May 2024 21:52:00 +0000

The General Data Protection Regulation (GDPR) is one of the world’s most stringent data protection laws. It provides a legal framework for collection and processing of the personal data of EU individuals.

The GDPR distinguishes between “special categories of personal data” (also referred to as “sensitive”) and other personal data and imposes stricter requirements on collection and processing of sensitive data. Understanding these differences will help your company comply with the requirements and avoid heavy penalties.

In this article, we’ll explain what personal data is considered “sensitive” according to the GDPR. We’ll also examine how a web analytics solution like Matomo can help you maintain compliance.

What is sensitive personal data?

The following categories of data are treated as sensitive:

1. Personal data revealing:
  - Racial or ethnic origin;
  - Political opinions;
  - Religious or philosophical beliefs;
  - Trade union membership;
2. Genetic and biometric data;
3. Data concerning a person’s:
  - Health; or
  - Sex life or sexual orientation.

Sensitive vs. non-sensitive personal data: What’s the difference?

While both categories include information about an individual, sensitive data is seen as more private, or requiring a greater protection.

Sensitive data often carries a higher degree of risk and harm to the data subject, if the data is exposed. For example, a data breach exposing health records could lead to discrimination for the individuals involved. An insurance company could use the information to increase premiums or deny coverage.

In contrast, personal data like name or gender is considered less sensitive because it doesn’t carry the same degree of harm as sensitive data.

Unauthorised access to someone’s name alone is less likely to harm them or infringe on their fundamental rights and freedoms than an unauthorised access to their health records or biometric data. Note that financial information (e.g. credit card details) does not fall into the special categories of data.

Legality of processing

Under the GDPR, both sensitive and nonsensitive personal data are protected. However, the rules and conditions for processing sensitive data are more stringent.

Article 6 deals with processing of non-sensitive data and it states that processing is lawful if one of the six lawful bases for processing applies.

In contrast, Art. 9 of the GDPR states that processing of sensitive data is prohibited as a rule, but provides ten exceptions.

It is important to note that the lawful bases in Art. 6 are not the same as exceptions in Art. 9. For example, while performance of a contract or legitimate interest of the controller are a lawful basis for processing non-sensitive personal data, they are not included as an exception in Art. 9. What follows is that controllers are not permitted to process sensitive data on the basis of contract or legitimate interest.

The exceptions where processing of sensitive personal data is permitted (subject to additional requirements) are:

Explicit consent: The individual has given explicit consent to processing their sensitive personal data for specified purpose(s), except where an EU member state prohibits such consent. See below for more information about explicit consent.
Employment, social security or social protection: Processing sensitive data is necessary to perform tasks under employment, social security or social protection law.
Vital interests: Processing sensitive data is necessary to protect the interests of a data subject or if the individual is physically or legally incapable of consenting.
Non-for-profit bodies: Foundations, associations or nonprofits with a political, philosophical, religious or trade union aim may process the sensitive data of their members or those they are in regular contact with, in connection with their purposes (and no disclosure of the data is permitted outside the organisation, without the data subject’s consent).
Made public: In some cases, it may be permissible to process the sensitive data of a data subject if the individual has already made it public and accessible.
Legal claims: Processing sensitive data is necessary to establish, exercise or defend legal claims, including legal or in court proceedings.
Public interest: Processing is necessary for reasons of substantial public interest, like preventing unlawful acts or protecting the public.
Health or social care: Processing special category data is necessary for: preventative or occupational medicine, providing health and social care, medical diagnosis or managing healthcare systems.
Public health: It is permissible to process sensitive data for public health reasons, like protecting against cross-border threats to health or ensuring the safety of medicinal products or medical devices.
Archiving, research and statistics: You may process sensitive data if it’s done for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

In addition, you must adhere to all data handling requirements set by the GDPR.

Important: Note that for any data sent that you are processing, you always need to identify a lawful basis under Art. 6. In addition, if the data sent contains sensitive data, you must comply with Art. 9.

Explicit consent

While consent is a valid lawful basis for processing non-sensitive personal data, controllers are permitted to process sensitive data only with an “explicit consent” of the data subject.

The GDPR does not define “explicit” consent, but it is accepted that it must meet all Art. 7 conditions for consent, at a higher threshold. To be “explicit” a consent requires a clear statement (oral or written) of the data subject. Consent inferred from the data subject’s actions does not meet the threshold.

The controller must retain records of the explicit consent and provide appropriate consent withdrawal method to allow the data subject to exercise their rights.

Examples of compliant and non-compliant sensitive data processing

Here are examples of when you can and can’t process sensitive data:

When you can process sensitive data: A doctor logs sensitive data about a patient, including their name, symptoms and medicine prescribed. The hospital can process this data to provide appropriate medical care to their patients. An IoT device and software manufacturer processes their customers’ health data based on explicit consent of each customer.
When you can’t process sensitive data: One example is when you don’t have explicit consent from a data subject. Another is when there’s no lawful basis for processing it or you are collecting personal data you simply do not need. For example, you don’t need your customer’s ethnic origin to fulfil an online order.

Other implications of processing sensitive data

If you process sensitive data, especially on a large scale, GDPR imposes additional requirements, such as having Data Privacy Impact Assessments, appointing Data Protection Officers and EU Representatives, if you are a controller based outside the EU.

Penalties for GDPR non-compliance

Mishandling sensitive data (or processing it when you’re not allowed to) can result in huge penalties. There are two tiers of GDPR fines:

€10 million or 2% of a company’s annual revenue for less severe infringements
€20 million or 4% of a company’s annual revenue for more severe infringements

In the first half of 2023 alone, fines imposed in the EU due to GDPR violations exceeded €1.6 billion, up from €73 million in 2019.

Examples of high-profile violations in the last few years include:

Amazon: The Luxembourg National Commission fined the retail giant with a massive $887 million fine in 2021 for not processing personal data per the GDPR.
Google: The National Data Protection Commission (CNIL) fined Google €50 million for not getting proper consent to display personalised ads.
H&M: The Hamburg Commissioner for Data Protection and Freedom of Information hit the multinational clothing company with a €35.3 million fine in 2020 for unlawfully gathering and storing employees’ data in its service centre.

One of the criteria that affects the severity of a fine is “data category” — the type of personal data being processed. Companies need to take extra precautions with sensitive data, or they risk receiving more severe penalties.

What’s more, GDPR violations can negatively affect your brand’s reputation and cause you to lose business opportunities from consumers concerned about your data practices. 76% of consumers indicated they wouldn’t buy from companies they don’t trust with their personal data.

Organisations should lay out their data practices in simple terms and make this information easily accessible so customers know how their data is being handled.

Get started with GDPR-compliant web analytics

The GDPR offers a framework for securing and protecting personal data. But it also distinguishes between sensitive and non-sensitive data. Understanding these differences and applying the lawful basis for processing this data type will help ensure compliance.

Looking for a GDPR-compliant web analytics solution?

At Matomo, we take data privacy seriously.

Our platform ensures 100% data ownership, putting you in complete control of your data. Unlike other web analytics solutions, your data remains solely yours and isn’t sold or auctioned off to advertisers.

Additionally, with Matomo, you can be confident in the accuracy of the insights you receive, as we provide reliable, unsampled data.

Matomo also fully complies with GDPR and other data privacy laws like CCPA, LGPD and more.

Start your 21-day free trial today; no credit card required.

Disclaimer

We are not lawyers and don’t claim to be. The information provided here is to help give an introduction to GDPR. We encourage every business and website to take data privacy seriously and discuss these issues with your lawyer if you have any concerns.

Your email address

Your website address

Your Analytics subdomain will be .matomo.cloud

Choose your analytics subdomain

.matomo.cloud

I accept the terms and conditions and data processing agreement (DPA)

Your information will be used to create an account on our cloud service. For more information please consult our privacy policy.

Data Privacy Issues to Be Aware of and How to Overcome Them

Erin — Thu, 09 May 2024 22:52:09 +0000

Data privacy issues are a significant concern for users globally.

Around 76% of US consumers report that they would not buy from a company they do not trust with their data. In the European Union, a 2021 study found that around 53% of EU internet users refused to let companies access their data for advertising purposes.

These findings send a clear message: if companies want to build consumer trust, they must honour users’ data privacy concerns. The best way to do this is by adopting transparent, ethical data collection practices — which also supports the simultaneous goal of maintaining compliance with regional data privacy acts.

So what exactly is data privacy?

Data privacy refers to the protections that govern how personal data is collected and used, especially with respect to an individual’s control over when, where and what information they share with others.

Data privacy also refers to the extent to which organisations and governments go to protect the personal data that they collect. Different parts of the world have different data privacy acts. These regulations outline the measures organisations must take to safeguard the data they collect from their consumers and residents. They also outline the rights of data subjects, such as the right to opt out of a data collection strategy and correct false data.

As more organisations rely on personal data to provide services, people have become increasingly concerned about data privacy, particularly the level of control they have over their data and what organisations and governments do with their data.

Why should organisations take data privacy issues seriously?

Organisations should take data privacy seriously because consumer trust depends on it and because they have a legal obligation to do so. Doing so also helps organisations prevent threat actors from illegally accessing consumer data. Strong data privacy helps you:

Comply with data protection acts

Organisations that fail to comply with regional data protection acts could face severe penalties. For example, consider the General Data Protection Regulation (GDPR), which is the primary data protection action for the European Union. The penalty system for GDPR fines consists of two tiers:

Less severe infringements — Which can lead to fines of up to €10 million (or 2% of an organisation’s worldwide annual revenue from the last financial year) per infringement.
More severe infringements — This can lead to fines of up to €20 million (or 4% of an organisation’s worldwide annual revenue from the last financial year) per infringement.

The monetary value of these penalties is significant, so it is in the best interest of all organisations to be GDPR compliant. Other data protection acts have similar penalty systems to the GDPR. In Brazil, organisations non-compliant with the Lei Geral de Proteção de Dados Pessoais (LGPD) could be fined up to 50 million reals (USD 10 million) or 2% of their worldwide annual revenue from the last financial year.

Improve brand reputation

Research shows that 81% of consumers feel that how an organisation treats their data reflects how they treat them as a consumer. This means a strong correlation exists between how people perceive an organisation’s data collection practices and their other business activities.

Data breaches can have a significant impact on an organisation, especially their reputation and level of consumer trust. In 2022, hackers stole customer data from the Australian private health insurance company, Medibank, and released the data onto the dark web. Optus was also affected by a cyberattack, which compromised the information of current and former customers. Following these events, a study by Nature revealed that 83 percent of Australians were concerned about the security of their data, particularly in the hands of their service providers.

Protect consumer data

Protecting consumer data is essential to preventing data breaches. Unfortunately, cybersecurity attacks are becoming increasingly sophisticated. In 2023 alone, organisations like T-Mobile and Sony have been compromised and their data stolen.

One way to protect consumer data is to retain 100% data ownership. This means that no external parties can see your data. You can achieve this with the web analytics platform, Matomo. With Matomo, you can store your own data on-premises (your own servers) or in the Cloud. Under both arrangements, you retain full ownership of your data.

Try Matomo for Free

Get the web insights you need, while respecting user privacy.

No credit card required

What are the most pressing data privacy issues that organisations are facing today?

Today’s most pressing data privacy challenges organisations face are complying with new data protection acts, maintaining consumer trust, and choosing the right web analytics platform. Here is a detailed breakdown of what these challenges mean for businesses.

Complying with new and emerging data protection laws

Ever since the European Union introduced the GDPR in 2018, other regions have enacted similar data protection acts. In the United States, California (CCPA), Virginia (VCDPA) and Colorado have their own state-level data protection acts. Meanwhile, Brazil and China have the General Data Protection Law (LGPD) and the Personal Information Protection Law (PIPL), respectively.

For global organisations, complying with multiple data protection acts can be tough, as each act interprets the GDPR model differently. They each have their own provisions, terminology (or different interpretations of the same terminology), and penalties.

A web analytics platform like Matomo can help your organisation comply with the GDPR and similar data protection acts. It has a range of privacy-friendly features including data anonymisation, IP anonymisation, and first-party cookies by default. You can also create and publish custom opt-out forms and let visitors view your collected data.

Complying with new and emerging data protection laws

Try Matomo for Free

Get the web insights you need, while respecting user privacy.

No credit card required

Maintaining consumer trust

Building (and maintaining) consumer trust is a major hurdle for organisations. Stories about data breaches and data scandals — notably the Cambridge Analytical scandal — instil fear into the public’s hearts. After a while, people wonder, “Which company is next?”

One way to build and maintain trust is to be transparent about your data collection practices. Be open and honest about what data you collect (and why), where you store the data (and for how long), how you protect the data and whether you share data with third parties.

You should also prepare and publish your cyber incident response plan. Outline the steps you will take to contain, assess and manage a data breach.

Choosing the right web analytics platform

Organisations use web analytics to track and monitor web traffic, manage advertising campaigns and identify potential revenue streams. The most widely used web analytics platform is Google Analytics; however, many users have raised concerns about privacy issues.

When searching for a Google Analytics alternative, consider a web analytics platform that takes data privacy seriously. Features like cookieless tracking, data anonymisation and IP anonymisation will let you track user activity without collecting personal data. Custom opt-out forms will let your web visitors enforce their data subject rights.

What data protection acts exist right now?

As time goes on and more countries introduce their own data privacy laws, it becomes harder for organisations to adapt. Understanding the basics of each act can help streamline compliance. Here is what you need to know about the latest data protection acts.

General Data Protection Regulation (GDPR)

The GDPR is a data protection act created by the European Parliament and Council of the European Union. It comprises 11 chapters covering the general provisions, principles, data subject rights, penalties and other relevant information.

The GDPR established a framework for organisations and governments to follow regarding the collection, processing, storing, transferring and deletion of personal data. Since coming into effect on 25 May 2018, other countries have used the GDPR as a model to enact similar data protection acts.

General Data Protection Law (LGPD)

The LGPD is Brazil’s main data protection act. The Federal Republic of Brazil signed the act on August 14, 2018, and it officially commenced on August 16, 2020. The act aimed to unify the 40 Brazilian laws that previously governed the country’s approach to processing personal data.

Like the GDPR, the LGPD serves as a legal framework to regulate the collection and usage of personal data. It also outlines the duties of the national data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD), which is responsible for enforcing the LGPD.

Privacy Amendment (Notifiable Data Breaches) for the Privacy Act 1988

Established by the Australian House of Representatives, the Privacy Act 1988 outlines how organisations and governments must manage personal data. The federal government has amended the Privacy Act 1988 twice — once in 2000, and again in 2014 — and is committing to a significant overhaul.

The new proposals will make it easier for individuals to opt out of data collection, organisations will have to destroy collected data after a reasonable period, and small businesses will no longer be exempt from the Privacy Act.

United States

The United States does not have a federally mandated data protection act. Instead, each state has been gradually introducing its data protection acts, with the first being California, followed by Virginia and Colorado. Over a dozen other states are following suit, too.

California — The then-Governor of California Jerry Brown signed the California Consumer Privacy Act (CCPA) into law on June 28, 2018. The act applies to organisations with gross annual revenue of more than USD 25 million, and that buy or sell products and services to 100,000 or more households or consumers.
Virginia — The Virginia Consumer Data Protection Act (VCDPA) took effect on January 1, 2023. It applies to organisations that process (or control) the personal data of 100,000 or more consumers in a financial year. It also applies to organisations that process (or control) the personal data of 25,000 or more consumers and gain more than 50% of gross revenue by selling that data.
Colorado — Colorado Governor Jared Polis signed the Colorado Privacy Act (ColoPA) into law in July 2021. The act applies to organisations that process (or control) the personal data of 100,000 or more Colorado residents annually. It also applies to organisations that earn revenue from the sale of personal data of at least 25,000 Colorado residents.

Because the US regulations are a patchwork of differing legal acts, compliance can be a complicated endeavour for organisations operating across multiple jurisdictions.

How can organisations comply with data protection acts?

One way to ensure compliance is to keep up with the latest data protection acts. But that is a very time-consuming task.

Over 16 US states are in the process of signing new acts. And countries like China, Turkey and Australia are about to overhaul — in a big way — their own data privacy protection acts.

Knowledge is power. But you also have a business to run, right?

That’s where Matomo comes in.

Streamline data privacy compliance with Matomo

Although data privacy is a major concern for individuals and companies operating in multiple parts of the world — as they must comply with new, conflicting data protection laws — it is possible to overcome the biggest data privacy issues.

Matomo enables your visitors to take back control of their data. You can choose where you store your data on-premises and in the Cloud (EU-based). You can use various features, retain 100% data ownership, protect visitor privacy and ensure compliance.

Try the 21-day free trial of Matomo today, start your free analytics trial. No credit card required.

Your email address

Your website address

Your Analytics subdomain will be .matomo.cloud

Choose your analytics subdomain

.matomo.cloud

I accept the terms and conditions and data processing agreement (DPA)

Your information will be used to create an account on our cloud service. For more information please consult our privacy policy.

Understanding Data Processing Agreements and How They Affect GDPR Compliance

Erin — Mon, 09 Oct 2023 04:11:19 +0000

The General Data Protection Regulation (GDPR) impacts international organisations that conduct business or handle personal data in the European Union (EU), and they must know how to stay compliant.

One way of ensuring GDPR compliance is through implementing a data processing agreement (DPA). Most businesses overlook DPAs when considering ways of maintaining user data security. So, what exactly is a DPA’s role in ensuring GDPR compliance?

In this article, we’ll discuss DPAs, their advantages, which data protection laws require them and the clauses that make up a DPA. We’ll also discuss the consequences of non-compliance and how you can maintain GDPR compliance using Matomo.

What is a data processing agreement?

A data processing agreement, data protection agreement or data processing addendum is a contractual agreement between a data controller (a company) and a data processor (a third-party service provider.) It defines each party’s rights and obligations regarding data protection.

A DPA also defines the responsibilities of the controller and the processor and sets out the terms they’ll use for data processing. For instance, when MHP/Team SI sought the services of Matomo (a data processor) to get reliable and compliant web analytics, a DPA helped to outline their responsibilities and liabilities.

A DPA is one of the basic requirements for GDPR compliance. The GDPR is an EU regulation concerning personal data protection and security. The GDPR is binding on any company that actively collects data from EU residents or citizens, regardless of their location.

As a business, you need to know what goes into a DPA to identify possible liabilities that may arise if you don’t comply with European data protection laws. For example, having a recurrent security incident can lead to data breaches as you process customer personal data.

The average data breach cost for 2023 is $4.45 million. This amount includes regulatory fines, containment costs and business losses. As such, a DPA can help you assess the organisational security measures of your data processing methods and define the protocol for reporting a data breach.

Why is a DPA essential for your business?

If your company processes personal data from your customers, such as contact details, you need a DPA to ensure compliance with data security laws like GDPR. You’ll also need a DPA to hire a third party to process your data, e.g., through web analytics or cloud storage.

But what are the benefits of having a DPA in place?

A key benefit of signing a DPA is it outlines business terms with a third-party data processor and guarantees compliance with the relevant data privacy laws. A DPA also helps to create an accountability framework between you and your data processor by establishing contractual obligations.

Additionally, a DPA helps to minimise the risk of unauthorised access to sensitive data. A DPA defines organisational measures that help protect the rights of individuals and safeguard personal data against unauthorised disclosure. Overall, before choosing a data processor, having a DPA ensures that they are capable, compliant and qualified.

More than 120 countries have already adopted some form of international data protection laws to protect their citizens and their data better. Hence, knowing which laws require a DPA and how you can better ensure compliance is important.

Which data protection laws require a DPA?

Regulatory bodies enact data protection laws to grant consumers greater control over their data and how businesses use it. These laws ensure transparency in data processing and compliance for businesses.

The following are some of the relevant data privacy laws that require you to have a DPA:

UK GDPR
Brazil LGPD
EU GDPR
Dubai PDPA
Colorado CPA
California CCPA/CPRA
Virginia VCDPA
Connecticut DPA
South African POPIA
Thailand PDPA

Companies that don’t adhere to these data protection obligations usually face liabilities such as fines and penalties. With a DPA, you can set clear expectations regarding data processing between you and your customers.

Review and update any DPAs with third-party processors to ensure compliance with GDPR and the laws we mentioned above. Additionally, confirm that all the relevant clauses are present for compliance with relevant data privacy laws.

So, what key data processing clauses should you have in your DPA? Let’s take a closer look in the next section.

Key clauses in a data processing agreement

GDPR provides some general recommendations for what you should state in a DPA.

Here are the elements you should include:

Data processing specifications

Your DPA should address the specific business purposes for data processing, the duration of processing and the categories of data under processing. It should also clearly state the party responsible for maintaining GDPR compliance and who the data subjects are, including their location and nationality.

Your DPA should also address the data processor and controller’s responsibilities concerning data deletion and contract termination.

Role of processor

Your DPA should clearly state what your data processor is responsible for and liable for. Some key responsibilities include record keeping, reporting breaches and maintaining data security.

Other roles of your data processor include providing you with audit opportunities and cooperating with data protection authorities during inquiries. If you decide to end your contract, the data processor is responsible for deleting or returning data, depending on your agreement.

Role of controller

Your DPA should inform the responsibilities of the data controller, which typically include issuing processing instructions to the data processor and directing them on how to handle data processing.

Your DPA should let you define the lawful data processes the data processor should follow and how you’ll uphold the data protection rights of individuals’ sensitive data.

Organisational and technical specifications

Your DPA should define specifications such as how third-party processors encrypt, access and test personal data. It should also include specifications on how the data processor and controller will maintain ongoing data security through various factors such as:

State of the technology: Do ‌third-party processors have reliable technology, and can they ensure data security within their systems?
Costs of implementation: Does the data controller’s budget allow them to seek third-party services from industry-leading providers who can guarantee a certain level of security?
Variances in users’ personal freedom: Are there privacy policies and opt-out forms for users to express how they want companies to use their sensitive data?

Moreover, your DPA should define how you and your data processor will ensure the confidentiality, availability and integrity of data processing services and systems.

What are the penalties for DPA GDPR non-compliance?

Regulators use GDPR’s stiff fines to encourage data controllers and third-party processors to follow‌ best data security practices. One way of maintaining compliance is through drafting up a DPA with your data processor.

The DPA should clearly outline the necessary legal requirements and include all the relevant clauses mentioned above. Understand what goes into this agreement since data protection authorities can hold your business accountable for a breach — even if a processor’s error caused it.

Data protection authorities can issue penalties now that the GDPR is in place. For example, according to Article 83 of the GDPR, penalties for data or privacy breaches or non-compliance can amount to up to €20 million or 4% of your annual revenue.

There are two tiers of fines: tier one and tier two. Violations related to data processors typically attract fines on the tier-one level. Tier one fines can cost your business €10 million or 2% of your company’s global revenue.

Tier-two fines result from infringement of the right to forget and the right to privacy of your consumer. Tier-two fines can cost your business up to €20 million or 4% of your company’s global revenue.

GDPR fines make non-compliance an expensive mistake for businesses of all sizes. As such, signing a DPA with any party that acts as a data processor for your business can help you remain GDPR-compliant.

How a DPA can help your business remain GDPR compliant

A DPA can help your business define and adhere to lawful data processes.

So, in what other ways can a DPA help you to remain compliant with GDPR? Let’s take a look!

1. Assess data processor’s compliance

Having a DPA helps ensure that the data processor you are working with is GDPR-compliant. You should check if they have a DPA and confirm the processor’s terms of service and legal basis.

For example, if you want an alternative to Google Analytics that’s GDPR compliant, then you can opt for Matomo. Matomo features a DPA, which you can agree to when you sign up for web analytics services or later.

2. Establish lawful data processes

A DPA can also help you review your data processes to ensure they’re GDPR compliant. For example, by defining lawful data processes, you better understand personally identifiable information (PII) and how it relates to data privacy.

Further, you can allow users to opt out of sharing their data. As such, Matomo can help you to enable Do Not Track preferences on your website.

With this feature, users are given the option to opt in or out of tracking via a toggle in their respective browsers.

Indeed, establishing lawful data processes helps you define the specific business purposes for collecting and processing personal data. By doing so, you get to notify your users why you need their data and get their consent to process it by including a GDPR-compliant privacy policy on your website.

3. Anonymise your data

Global privacy laws like GDPR and ePrivacy mandate companies to display cookie banners or seek consent before tracking visitors’ data. You can either include a cookie consent banner on your site or stop tracking cookies to follow the applicable regulations.

Further, you can enable cookie-less tracking or easily let users opt out. For example, you can use Matomo without a cookie consent banner, exempting it from many countries’ privacy rules.

Additionally, through a DPA, you can define organisational measures that define how you’ll anonymise all your users’ data. Matomo can help you anonymise IP addresses, and we recommend that you at least anonymise the last two bytes.

As one of the few web analytics tools you can use to collect data without tracking consent, Matomo also has the French Data Protection Authority (CNIL) approval.

4. Assess the processor’s bandwidth

Having a DPA can help you implement data retention policies that show clear retention periods. Such policies are useful when ending a contract with a third-party service provider and determining how they should handle your data.

A DPA also helps you ensure the processor has the necessary technology to store personal data securely. You can conduct an audit to understand possible vulnerabilities and your data processor’s technological capacity.

5. Obtain legal counsel

When drafting a DPA, it’s important to get a consultation on what is needed to ensure complete compliance. Obtaining legal counsel points you in the right direction so you don’t make any mistakes that may lead to non-compliance.

Conclusion

Businesses that process users’ data are subject to several DPA contract requirements under GDPR. One of the most important is having DPAs with every third-party provider that helps them perform data processing.

It’s important to stay updated on GDPR requirements for compliance. As such, Matomo can help you maintain lawful data processes. Matomo gives you complete control over your data and complies with GDPR requirements.

To get started with Matomo, you can sign up for a 21-day free trial. No credit card required.

Disclaimer

GDPR Compliance and Personal Data: The Ultimate Guide

Erin — Fri, 22 Sep 2023 02:03:38 +0000

According to the International Data Corporation (IDC), the world generated 109 zettabytes of data in 2022 alone, and that number is on track to nearly triple to 291 zettabytes in 2027. For scale, that’s one trillion gigs or one followed by 21 zeros in bytes.

A major portion of that data is generated online, and the conditions for securing that digital data can have major real-world consequences. For example, online identifiers that fall into the wrong hands can be used nefariously for cybercrime, identity theft or unwanted targeting. Users also want control over how their actions are tracked online and transparency into how their information is used.

Therefore, regional and international regulations are necessary to set the terms for respecting users’ privacy and control over personal information. Perhaps the most widely known of these laws is the European Union’s General Data Protection Regulation (GDPR).

What is personal data under GDPR?

Under the General Data Protection Regulation (GDPR), “personal data” refers to information linked to an identifiable natural person. An “identifiable natural person” is someone directly or indirectly recognisable via individually specific descriptors such as physical, genetic, economic, cultural, employment and social details.

It’s important to note that under GDPR, the definition of personal data is very broad, and it encompasses both information that is commonly considered personal (e.g., names and addresses) and more technical or specialised data (e.g., IP addresses or device IDs) that can be used to identify individuals indirectly.

Organisations that handle personal data must adhere to strict rules and principles regarding the processing and protection of this data to ensure individuals’ privacy rights are respected and upheld.

Personal data can include, but is not limited to, the following:

Basic Identity Information: This includes a person’s name, government-issued ID number, social address, phone number, email address or other similar identifiers.
Biographical Information: Details such as date of birth, place of birth, nationality and gender.
Contact Information: Information that allows communication with the individual, such as phone numbers, email addresses or mailing addresses.
Financial Information: Data related to a person’s finances, including credit card numbers, bank account numbers, income records or financial transactions.
Health and Medical Information: Information about a person’s health, medical history or healthcare treatments.
Location Data: Data that can pinpoint a person’s geographical location, such as GPS coordinates or information derived from mobile devices.
Online Identifiers: Information like IP addresses, cookies or other online tracking mechanisms that can be used to identify or track individuals online.
Biometric Data: Unique physical or behavioural characteristics used for identification, such as fingerprints, facial recognition data or voiceprints.

Sensitive Data

Sensitive data is a special category of personal data prohibited from processing unless specific conditions are met, including users giving explicit consent. The data must also be necessary to fulfil one or more of a limited set of allowed purposes, such as reasons related to employment, social protections or legal claims.

Sensitive information includes details about a person’s racial or ethnic origin, sexual orientation, political opinions, religion, trade union membership, biometric data or genetic data.

What are the 7 main principles of GDPR?

The 7 principles of GDPR guide companies in how to properly handle personal data gathered from their users.

The seven principles of GDPR are:

1. Lawfulness, fairness and transparency

Lawfulness means having legal grounds for data processing, such as consent, legitimate interests, contract and legal obligation. If you can achieve your objective without processing personal data, the basis is no longer lawful.

Fairness means you’re processing data reasonably and in line with users’ best interests, and they wouldn’t be shocked if they find out what you’re using it for.

Transparency means being open regarding when you’re processing user data, what you’re using it for and who you’re collecting it from.

To get started with this, use our guide on creating a GDPR-compliant privacy policy.

2. Purpose limitation

You should only process user data for the original purposes you communicated to users when requesting their explicit consent. If you aim to undertake a new purpose, it must be compatible with the original stated purpose. Otherwise, you’ll need to ask for consent again.

3. Data minimisation

You should only collect as much data as you need to accomplish compliant objectives and nothing more, especially not other personally identifiable information (PII).

Matomo provides several features for extensive data minimisation, including the ability to anonymize IP addresses.

Data minimisation is well-liked by users. Around 70% of people have taken active steps towards protecting their identity online, so they’ll likely appreciate any principles that help them in this effort.

4. Accuracy

The user data you process should be accurate and up-to-date where necessary. You should have reasonable systems to catch inaccurate data and correct or delete it. If there are mistakes that you need to store, then you need to label them clearly as mistakes to keep them from being processed as accurate.

5. Storage limitation

This principle requires you to eliminate data you’re no longer using for the original purposes. You must implement time limits, after which you’ll delete or anonymize any user data on record. Matomo allows you to configure your system such that logs are automatically deleted after some time.

6. Integrity and confidentiality

This requires that data processors have security measures in place to protect data from threats such as hackers, loss and damage. As an open-source web analytics solution, Matomo enables you to verify its security first-hand.

7. Accountability

Accountability means you’re responsible for what you do with the data you collect. It’s your duty to maintain compliance and document everything for audits. Matomo tracks a lot of the data you’d need for this, including activity, task and application logs.

Who does GDPR apply to?

The GDPR applies to any company that processes the personal data of EU citizens and residents (regardless of the location of the company).

If this is the first time you’ve heard about this, don’t worry! Matomo provides tools that allow you to determine exactly what kinds of data you’re collecting and how they must be handled for full compliance.

Best practices for processing personal data under GDPR

Companies subject to the GDPR need to be aware of several key principles and best practices to ensure they process personal data in a lawful and responsible manner.

Here are some essential practices to implement:

Lawful basis for processing: Organisations must have a lawful basis for processing personal data. Common lawful bases include the necessity of processing for compliance with a legal obligation, the performance of a contract, the protection of vital interests and tasks carried out in the public interest. Your organisation’s legitimate interests for processing must not override the individual’s legal rights.
Data minimisation: Collect and process only the personal data that is necessary for the specific purpose for which it was collected. Matomo’s anonymisation capabilities help you avoid collecting excessive or irrelevant data.
Transparency: Provide clear and concise information to individuals about how their data will be processed. Privacy statements should be clear and accessible to users to allow them to easily understand how their data is used.
Consent: If you are relying on consent as a lawful basis, make sure you design your privacy statements and consent forms to be usable. This lets you ensure that consent is freely given, specific, informed and unambiguous. Also, individuals must be able to withdraw their consent at any time.
Data subject rights: You must have mechanisms in place to uphold the data subject’s individual rights, such as the rights to access, erase, rectify errors and restrict processing. Establish internal processes for handling such requests.
Data protection impact assessments (DPIAs): Conduct DPIAs for high-risk processing activities, especially when introducing new technologies or processing sensitive data.
Security measures: You must implement appropriate technical security measures to maintain the safety of personal data. This can include ‌security tools such as encryption, firewalls and limited access controls, as well as organisational practices like regular security assessments.
Data breach response: Develop and maintain a data breach response plan. Notify relevant authorities and affected individuals of data breaches within the required timeframe.
International data transfers: If transferring personal data outside the EU, ensure that appropriate safeguards are in place and consider GDPR provisions. These provisions allow data transfers from the EU to non-EU countries in three main ways:
1. When the destination country has been deemed by the European Commission to have adequate data protection, making it similar to transferring data within the EU.
2. Through the use of safeguards like binding corporate rules, approved contractual clauses or adherence to codes of conduct.
3. In specific situations when none of the above apply, such as when an individual explicitly consents to the transfer after being informed of the associated risks.
Data protection officers (DPOs): Appoint a data protection officer if required by GDPR. DPOs are responsible for overseeing data protection compliance within the organisation.
Privacy by design and default: Integrate data protection into the design of systems and processes. Default settings should prioritise user privacy, as is the case with something like Matomo’s first-party cookies.
Documentation: Maintain records of data processing activities, including data protection policies, procedures and agreements. Matomo logs and backs up web server access, activity and more, providing a solid audit trail.
Employee training: Employees who handle personal data must be properly trained to uphold data protection principles and GDPR compliance best practices.
Third-party contracts: If sharing data with third parties, have data processing agreements in place that outline the responsibilities and obligations of each party regarding data protection.
Regular audits and assessments: Conduct periodic audits and assessments of data processing activities to ensure ongoing compliance. As mentioned previously, Matomo tracks and saves several key statistics and metrics that you’d need for a successful audit.
Accountability: Demonstrate accountability by documenting and regularly reviewing compliance efforts. Be prepared to provide evidence of compliance to data protection authorities.
Data protection impact on data analytics and marketing: Understand how GDPR impacts data analytics and marketing activities, including obtaining valid consent for marketing communications.

Organisations should be on the lookout for GDPR updates, as the regulations may evolve over time. When in doubt, consult legal and privacy professionals to ensure compliance, as non-compliance could potentially result in significant fines, damage to reputation and legal consequences.

What constitutes a GDPR breach?

Security incidents that compromise the confidentiality, integrity and/or availability of personal data are considered a breach under GDPR. This means a breach is not limited to leaks; if you accidentally lose or delete personal data, its availability is compromised, which is technically considered a breach.

What are the penalty fines for GDPR non-compliance?

The penalty fines for GDPR non-compliance are up to €20 million or up to 4% of the company’s revenue from the previous fiscal year, whichever is higher. This makes it so that small companies can also get fined, no matter how low-profile the breach is.

In 2022, for instance, a company found to have mishandled user data was fined €2,000, and the webmaster responsible was personally fined €150.

Is Matomo GDPR compliant?

Matomo is fully GDPR compliant and can ensure you achieve compliance, too. Here’s how:

Data anonymization and IP anonymization
GDPR Manager that helps you identify gaps in your compliance and address them effectively
Users can opt-out of all tracking
First-party cookies by default
Users can view the data collected
Capabilities to delete visitor data when requested
You own your data and it is not used for any other purposes (like advertising)
Visitor logs and profiles can be disabled
Data is stored in the EU (Matomo Cloud) or in any country of your choice (Matomo On-Premise)

Is there a GDPR in the US?

There is no GDPR-equivalent law that covers the US as a whole. That said, US-based companies processing data from persons in the EU still need to adhere to GDPR principles.

While there isn’t a federal data protection law, several states have enacted their own. One notable example is the California Consumer Privacy Act (CCPA), which Matomo is fully compliant with.

Ready for GDPR-compliant analytics?

The GDPR lays out a set of regulations and penalties that govern the collection and processing of personal data from EU citizens and residents. A breach under GDPR attracts a fine of either up to €20 million or 4% of the company’s revenue, and the penalty applies to companies of all sizes.

Matomo is fully GDPR compliant and provides several features and advanced privacy settings to ensure you ‌are as well, without sacrificing the resources you need for effective analytics. If you’re ready to get started, sign up for a 21-day free trial of Matomo — no credit card required.

Disclaimer
We are not lawyers and don’t claim to be. The information provided here is to help give an introduction to GDPR. We encourage every business and website to take data privacy seriously and discuss these issues with your lawyer if you have any concerns.

GDPR Compliance Checklist: A Detailed Walkthrough

Erin — Thu, 14 Sep 2023 02:42:09 +0000

As digital transformation drives global economies, data has become a valuable currency to businesses of all shapes and sizes. As a result, the complex issue of data privacy is often in the spotlight.

The General Data Protection Regulation (GDPR) is the key legal framework in the European Union to protect individual privacy and regulate business data handling.

Compliance with the GDPR is not just a legal mandate, it’s also good business. An 86% majority of users want more control over their data and 47% of users have switched providers over data privacy concerns.

To help guide your business decisions around user privacy, this article will cover the key principles of GDPR, including a comprehensive GDPR compliance checklist.

The key principles and requirements of GDPR

Before we can translate GDPR’s objectives into practical steps, let’s begin with the defining features and key principles.

GDPR: An overview

The GDPR bolsters and unifies data protection standards for everyone within the EU. Enacted in 2018, it represented a seismic shift for companies and public authorities alike in protecting personal information. Its primary objective is to offer greater control to individuals over their data and to hold organisations accountable for its protection.

GDPR establishes a legal framework that mandates corporate compliance with key principles to ensure user data security, transparency and choice. It sets the terms for your organisation’s privacy practices and the landscape of legal obligations you must navigate in data handling.

Key principles of GDPR

There are seven core principles pivotal to GDPR compliance, which provide a roadmap for ethical and legal data practices.

Lawfulness, fairness and transparency: This principle demands lawful and fair processing of personal data. Companies should be transparent about their data processing activities, providing clear information in an accessible form.
Purpose limitation: Personal data should be collected for explicit, legitimate purposes and not further processed in a way incompatible with those purposes. This demands careful planning of data processing activities.
Data minimisation: Companies should only collect personal data that are necessary for their specified purposes, as anything more than this is illegal. This principle emphasises the importance of limiting scope, rather than performing blanket data collection.
Accuracy: This principle calls for maintaining data that is accurate, up-to-date and not misleading. Regular internal audits and updates are crucial to following this principle.
Storage limitation: Personal data should only be kept for as long as necessary for the purposes for which it was collected. This underscores the need for a detailed retention policy in your GDPR compliance efforts.
Integrity and confidentiality: Companies should protect personal data from unauthorised or unlawful processing and accidental loss or damage. Your organisation’s technical security measures play a vital role in this.
Accountability: Organisations should be able to demonstrate their compliance with GDPR principles. This underscores the importance of records of processing activities and regular audits as part of your compliance checklist.

The importance of GDPR compliance for businesses

Embracing GDPR compliance isn’t merely a matter of avoiding penalties — it’s a commitment to principles that reflect integrity, transparency and respect for personal data. At Matomo, we champion these principles, empowering companies with powerful and compliant web analytics. We make the compliance journey accessible and straightforward, making sure website analytics aligns with legal obligations and ethical practices.

The implications of non-compliance

It’s easy to highlight the dramatic fines imposed on tech giants such as Google and Meta. However, it’s essential to recognise that GDPR compliance extends to all companies, including small businesses — for whom even smaller fines can have a significant impact.

The implications of non-compliance aren’t limited to financial penalties alone, either. Failing to meet obligations can tarnish reputations, erode trust and hinder business activities. Non-compliance could lead to a breach of privacy policy, causing a ripple effect that may be challenging to overcome.

The potential benefits of being GDPR compliant

Adhering to GDPR regulations is more than a checkbox on a form — it’s a comprehensive approach to handling personal data responsibly. It fosters trust, opens doors to European customers and builds enduring relationships with individuals whose rights are protected. In fulfilling these obligations and practices, businesses not only meet legal requirements but also foster a culture of ethical conduct and business success.

Comprehensive GDPR compliance checklist

Ensuring GDPR compliance may seem like a complex task, but this detailed checklist will simplify your journey. From consent management to data security, we’ve got you covered.

Establish personal data collection and consent management

When it comes to GDPR compliance, not all consent is created equal. Two distinct forms exist: explicit consent and implied consent. But what exactly sets them apart, and why does it matter to your organisational measures?

Explicit consent from users means that the individual has unequivocally agreed to the processing of personal data. It’s an unambiguous agreement, often obtained through a deliberate action like ticking a box. Details are paramount, as the person giving consent must be fully informed about the processing activities.

Inform clearly: Use plain language to explain how data will be used and be transparent about processing practices.
Obtain active agreement: Use forms or checkboxes (not pre-ticked boxes) to ensure active participation and that you are obtaining explicit user consent.
Document it: Keep records of consent, including when and how it was obtained, as a crucial part of your compliance efforts.
Facilitate withdrawal: Use consent mechanisms that allow for easy withdrawal of consent for users who decide to opt out.
Manage consent forms: Tools like Matomo’s Consent Management Platform can provide accessible forms that not only enhance transparency but also empower individuals, allowing them to feel in control of their details and rights.

Facilitate data subject rights and access requests

GDPR emphasises individual rights by empowering users with control over their personal data processing. Here’s a succinct breakdown:

Know the rights of individuals: GDPR outlines individual rights such as data access, error rectification, erasure and data portability, allowing individuals to guide how their details are used, processed or shared.
Simplify complying with access requests: Companies must respond to access requests efficiently, usually within one month, without undue delay, reflecting organisational measures of respect.
Employ ethical and compliant digital analytics: As a leader in ethical web analytics, Matomo subtly aids in compliance efforts, protecting privacy without compromising functionality.

These practices align with a modern understanding of privacy, emphasising more than legal obligations. By employing Matomo, companies simplify the processing of access requests, which fosters transparency and user control over personal data.

Implement clear data privacy practices

Data privacy and consent mechanisms are key tools for compliance. Crafting a comprehensive privacy policy helps protect individuals’ rights and provides integrity in personal data processing. Designing sites and applications with data protection in mind ensures your compliance from the ground-up.

Create an easy to understand privacy policy: Create a clear, GDPR-compliant privacy policy that details processing activities, storage limitations and organisational measures, all in plain language.

By implementing these steps, companies not only adhere to their legal obligations but also foster an inclusive community that values privacy and ethics. Whether you’re an IT professional or marketer, Matomo’s platform can guide you through the maze of GDPR complexities, inspiring positive change towards responsible data handling.

Implement data storage limitations and robust security

Data storage and security are foundational elements of compliance efforts. Companies must foster a proactive approach to preventing data breaches by understanding potential cyberthreats and enforcing appropriate security controls across applications and infrastructures.

Implement storage limitations: Define limitations on time and scope to avert undue retention and protect personal details.
Embrace technical security: Utilise secure processes like encryption, access controls, firewalls and so on, bolstering protection by design.
Establish a comprehensive security policy: Align security practices with privacy laws and regulations, including GDPR.
React swiftly to personal data breaches: A security breach requires an immediate response, without undue delay, to honour legal obligations and maintain customer trust. Develop a plan for notifying supervisory authorities and affected individuals promptly in the event of a personal data breach.

Security measures for personal data are about more than just fulfilling legal obligations — they’re about building a safe and ethical digital ecosystem that instils confidence in customers.

Keep cross-border data transfers in mind

Cross-border data transfers present a unique challenge, with increased complexity due to varying data privacy laws across regions. You must understand the respective regulations of participating countries and align your compliance practices appropriately to respect all that are relevant to your organisation.

For example, data privacy laws in the US are generally more lax than the GDPR so US companies taking on EU customers must hold themselves to a higher standard, with stricter controls placed on their data processing practices.

Evaluate third-party services: For companies utilising global networks of third-party services, be sure to select providers that maintain ongoing knowledge and vigilance towards privacy law compliance. Platforms like Matomo that innately prioritise transparency and privacy, have implemented robust security measures, and document transfers diligently are worth considering.

Conduct internal audits and compliance checks

Compliance is not a “one and done” setup, but an ongoing journey requiring regular internal audits. Systems settings can drift over time, and datasets can become increasingly complex as companies scale. Human error happens, too. Audits identify gaps in your compliance efforts to guide actionable improvements.

Conduct regular audits: Stay proactive with internal audits and systematic monitoring, adapting policies to align with privacy laws. Clarity in privacy notices and cookie banners fosters confidence, while regular assessments ensure alignment with GDPR requirements.
Ensure transparency: Platforms like Matomo simplify audits, offering valuable insights and support for ethical web analytics and transparency. The right platform can increase visibility and make generating your reports easier. Integrating these processes guarantees GDPR-aligned measures while emphasising data ownership and customer-centric values.
Educate and train staff: Engage in ongoing staff education and training on GDPR compliance, privacy policies, and their related responsibilities.

Case study: GDPR compliance in action

Achieving compliance with the General Data Protection Regulation (GDPR) stands as a paramount concern for businesses worldwide. Both small and large companies have embarked on this journey, implementing measures and revising privacy policies to conform to these regulations.

Typeform

Based in Ireland, Typeform, a company dealing with online forms, took GDPR compliance very seriously. Here’s how they achieved it:

Conducting a data protection impact assessment (DPIA): This vital step helped them assess personal data breach risks and enabled systematic monitoring of potential challenges.
Implementing technical and organisational measures: Security measures such as encryption, access control and drafting a security policy reinforced their personal data processing mechanisms.
Revamping privacy policy: They transformed their privacy policy with accessible, plain language, making it clear and user-friendly.
Appointing a data protection officer (DPO): This aligned with their core activities and strengthened their compliance efforts.

The benefits for Typeform were profound:

Enhanced customer trust and confidence
Reduced risk of fines and penalties
Bolstered data security and privacy
Improved brand reputation, positioning them favourably among European customers

Ensuring GDPR Compliance with Matomo Analytics

Matomo is more than just an analytics platform; it is a trusted guide in the realm of data privacy. Our mission is to empower users with full data ownership, fostering an inclusive digital community built on trust and transparency. Our suite of features has been meticulously designed to align with GDPR regulations, ensuring that businesses can navigate the complexities of compliance with ease and confidence.

1. Data Anonymisation

Matomo’s focus on ethical digital analytics means the platform allows for the anonymisation of user data, ensuring that individual identities remain protected.

2. Robust GDPR Management

Beyond just a GDPR Manager, Matomo provides an encompassing framework to streamline compliance activities. From managing user consent to meticulous record-keeping of processing activities, Matomo ensures you are always a step ahead.

3. User Empowerment with Opt-Out Capabilities

Matomo respects user choices. The platform offers users an easy way to opt-out of all tracking, giving them control over their data.

4. First-party Cookies as the Standard

By using first-party cookies by default, Matomo ensures data remains with the website owner, minimising potential breaches or misuse.

5. Transparent Data Collection Practices

Users have the right to know their data. With Matomo, they can view the exact data being collected, reinforcing a transparent relationship between businesses and their users.

6. Visitor Data Management

Upon request, Matomo offers capabilities to delete visitor data, aligning with the GDPR’s right to be forgotten.

7. Data Ownership and Privacy Assurance

Unlike other web analytics platforms, with Matomo, you retain full ownership of your data and can rest assured that it is not being used for other purposes such as advertising.

8. IP Anonymisation

Protecting user location details, Matomo anonymises IP addresses, adding an additional layer of privacy.

9. Customisable Data Visualisation

Recognising that not all data is essential, Matomo allows the disabling of visitor logs and profiles, giving businesses the flexibility to decide what data they track.

By taking a holistic approach to GDPR compliance, Matomo streamlines the processes for you and ensures you follow the legal and ethical best practices.

Start your GDPR compliance journey today

The global focus on data privacy requires using a GDPR compliance checklist. With 137 countries implementing data protection laws (UN), companies must align with international standards. Compliance, after all, goes beyond avoiding breaches— it’s about upholding privacy and building trust.

As your trusted guide, Matomo invites you on this GDPR journey. With us, you’ll uphold privacy obligations and manage your processing activities effectively. Compliance isn’t a one-time task but a continuous journey to enhance practices and align with individual rights. Start this vital journey with Matomo today. Try it free for 21-days. No credit card required.

Disclaimer

The 7 GDPR Principles: A Guide to Compliance

Erin — Fri, 11 Aug 2023 04:29:21 +0000

We all knew it was coming. It’s all anyone could talk about — the General Data Protection Regulation (GDPR) took effect on 25 May 2018.

You might think five years would have been plenty of time for organisations to achieve compliance, yet many have failed to do so. As of 2022, 81% of French businesses and 95% of American companies were still not compliant.

If you’re one of these organisations still working on compliance, this blog will provide valuable information about the seven GDPR principles and guide you on your way to compliance. It will also explore how web analytics tools can help organisations improve transparency, ensure data security and achieve GDPR compliance.

What is GDPR?

The European Union (EU) created the General Data Protection Regulation (GDPR) to grant individuals greater control over their data and promote transparency in data processing.

Known by many other names across Europe (e.g., RGPD, DSGVO, etc.), the GDPR created a set of rules surrounding the handling of personal data of EU citizens and residents, to make sure organisations aren’t being irresponsible with user names, locations, IP addresses, information gleaned from cookies, and so on.

Organisations must assume several responsibilities to achieve GDPR compliance, regardless of their physical location. These obligations include:

Respecting user rights
Implementing documentation and document retention policies
Ensuring data security

Why is GDPR compliance important?

Data has become a valuable asset for businesses worldwide. The collection and use of data is a feature of almost every sector. However, with increased data usage comes a greater responsibility to protect individuals’ privacy and rights.

A YouGov study conducted in 17 key markets found that two in three adults worldwide believe tech corporations across all markets have too much control over their data.

GDPR is the most extensive government framework aiming to tackle the increasing concern over data collection and handling. GDPR safeguards personal data from misuse, unauthorised access and data breaches. It ensures that businesses handle information responsibly and with respect for individual privacy. It also provided a foundation for similar laws to be created in other countries, including China, which is among the least concerned regions (56%), along with Sweden (54%) and Indonesia (56%).

GDPR has been pivotal in safeguarding personal data and empowering individuals with more control over their information. Compliance with GDPR builds trust between businesses and their customers. Currently, 71% of the countries in the world are covered by data protection and privacy legislation.

What are the risks of non-compliance?

We’ve established the siginficance of GDPR, but what about the implications — what does it mean for your business? The consequences of non-compliance can be severe and are not worth being lax about.

According to Article 83 of the GDPR, you can be penalised up to 4% of your annual global revenue or €20 million, whichever is higher, for violations. For smaller businesses, such substantial fines could be devastating. Non-compliance could even result in legal action from individuals or data protection authorities, leading to further financial losses.

Potential outcomes are not just legal and financial. GDPR violations can significantly damage your reputation as a company. Non-compliance could also cost you business opportunities if your policies and processes do not comply and, therefore, do not align with potential partners. Customers trust businesses that take data protection seriously over those that do not.

Finally, and perhaps the most timid outcome on the surface, individuals have the right to complain to data protection authorities if they believe you violate their data rights. These complaints can trigger an investigation, and if your business is found to be breaking the rules, you could face all of the consequences mentioned above.

You may think it couldn’t happen to you, but GDPR fines have collectively reached over €4 billion and are growing at a notable rate. Fines grew 92% from H1 2021 compared with H1 2022. A record-breaking €1.2 billion fine to Meta in 2023 is the biggest we’ve seen, so far. But smaller businesses can be fined, too. A bank in Hungary was fined €1,560 for not erasing and correcting data when the subject requested it. (Individuals can also be fined in flagrant cases, like a police officer fined €1,400 for using police info for private purposes.)

The 7 GDPR principles and how to comply

You should now have a good understanding of GDPR, why it’s important and the consequences of not being compliant.

Your first step to compliance is to identify the personal data your organisation processes and determine the legal basis for processing each type. You then need to review your data processing activities to ensure they align with the GDPR’s purpose and principles.

There are seven key principles in Article 5 of the GDPR that govern the lawful processing of personal data:

Lawfulness, fairness and transparency

This principle ensures you collect and use data in a legal and transparent way. It must be collected with consent, and you must tell your customers why you need their data. Data processing must be conducted fairly and transparently.

How to comply

Review your data practices and identify if and why you collect personal data from customers.
- Learn what personally identifiable information (PII) is.
Update your website and forms to include a clear and easy-to-understand explanation of why you need their data and what you’ll use it for.
Obtain explicit consent from individuals when processing their sensitive data.
Add a cookie consent banner to your website, informing users about the cookies you use and why.
- Website analytics tools like Google Analytics and Matomo offer the ability to create cookie consent banners and integrate with Consent Management Platforms (CMPs) to manage user consent and privacy settings.
- Matomo also offers a setting without tracking cookies, in which case you would not need to add the cookie consent banner.
Privacy notices must be accessible at all times.
To ensure your cookies are GDPR compliant, you must:
- Get consent before using any cookies (except strictly necessary cookies).
- Clearly explain what each cookie tracks and its purpose.
- Document and store user consent.
- Don’t refuse access to services if users do not consent to the use of certain cookies.
- Make the consent withdrawal process simple.

Use tools like Matomo that can be configured to automatically anonymise data so you don’t process any personal data.

Purpose limitation

You can only use data for the specific, legitimate purposes you told your visitors, prospects or customers about at the time of collection. You can’t use it for anything else without asking again.

How to comply

Define the specific purposes for collecting personal data (e.g., processing orders, sending newsletters).
Ensure you don’t use the data for any other purposes without getting explicit consent from the individuals.

Data minimisation

Data minimisation means you should only collect the data you need, aligned with the stated purpose. You shouldn’t gather or store more data than necessary. Implementing data minimisation practices ensures compliance and protects against data breaches.

How to comply

Identify the minimum data required for each purpose.
Conduct a data audit to identify and eliminate unnecessary data collection points.
Don’t ask for unnecessary information or store data that’s not essential for your business operations.
Implement data retention policies to delete data when it is no longer required.

Accuracy

You are responsible for keeping data accurate and up-to-date at all times. You should have processes to promptly erase or correct any data if you have incorrect information for your customers.

How to comply

Implement a process to regularly review and update customer data.
Provide an easy way for customers to request corrections to their data if they find any errors.

Storage limitation

Data should not be kept longer than necessary. You should only hold onto it for as long as you have a valid reason, which should be the purpose stated and consented to. Securely dispose of data when it is no longer needed. There is no upper time limit on data storage.

How to comply

Set clear retention periods for the different types of data you collect.
Develop data retention policies and adhere to them consistently.
Delete data when it’s no longer needed for the purposes you specified.

Integrity and confidentiality

You must take measures to protect data from unauthorised or unlawful access, like keeping it locked away and secure.

How to comply

Securely store personal data with encryption and access controls, and keep it either within the EU or somewhere with similar privacy protections.
Train your staff on data protection and restrict access to data only to those who need it for their work.
Conduct regular security assessments and address vulnerabilities promptly.

Accountability

Accountability means that you are responsible for complying with the other principles. You must demonstrate that you are following the rules and taking data protection seriously.

How to comply

Appoint a Data Protection Officer (DPO) or someone responsible for data privacy in your company.
Maintain detailed records of data processing activities and any data breaches.
Data breaches must be reported within 72 hours.

Compliance with GDPR is an ongoing process, and it’s vital to review and update your practices regularly.

What are GDPR rights?

Individuals are granted various rights under the GDPR. These rights give them more control over their personal data.

The right to be informed: People can ask why their data is required.

What to do: Explain why personal data is required and how it will be used.

The right to access: People can request and access the personal data you hold about them.
What to do: Provide a copy of the data upon request, free of charge and within one month.

The right to rectification: If data errors or inaccuracies are found, your customers can ask you to correct them.
What to do: Promptly update any incorrect information to ensure it is accurate and up-to-date.

The right to object to processing: Your customers have the right to object to processing their data for certain purposes, like direct marketing.
What to do: Respect this objection unless you have legitimate reasons for processing the data.

Rights in relation to automated decision-making and profiling: GDPR gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, if it significantly impacts them.
What to do: Offer individuals the right to human intervention and express their point of view in such cases.

The right to be forgotten: Individuals can request the deletion of their data under certain circumstances, such as when the data is no longer necessary or when they withdraw consent.
What to do: Comply with such requests unless you have a legal obligation to keep the data.

The right to data portability: People can request their personal data in a commonly used and machine-readable format.
What to do: Provide the data to the individual if they want to transfer it to another service provider.

The right to restrict processing: Customers can ask you to temporarily stop processing their data, for example, while they verify its accuracy or when they object to its usage.
What to do: Store the data during this period but do not process it further.

Are all website analytics tools GDPR compliant?

Unfortunately, not all web analytics tools are built the same. No matter where you are located in the world, if you are processing the personal data of European citizens or residents, you need to fulfil GDPR obligations.

While your web analytics tool helps you gain valuable insights from your user base and web traffic, they don’t all comply with GDPR. No matter how hard you work to adhere to the seven principles and GDPR rights, using a non-compliant tool means that you’ll never be fully GDPR compliant.

When using website analytics tools and handling data, you should consider the following:

Collection of data

Aligned with the lawfulness, fairness and transparency principle, you must collect consent from visitors for tracking if you are using website analytics tools to collect visitor behavioural data — unless you anonymise data entirely with Matomo.

To provide transparency, you should also clarify the types of data you collect, such as IP addresses, device information and browsing behaviour. Note that data collection aims to improve your website’s performance and understand your audience better.

Storage of data

Assure your visitors that you securely store their data and only keep it for as long as necessary, following GDPR’s storage limitation principle. Clearly state the retention periods for different data types and specify when you’ll delete or anonymise it.

Usage of data

Make it clear that to comply with the purpose limitation principle, the data you collect will not be used for other purposes beyond website analytics. You should also promise not to share data with third parties for marketing or unrelated activities without their explicit consent.

Anonymisation and pseudonymisation

Features like IP anonymisation to protect users’ privacy are available with GA4 (Google Analytics) and Matomo. Describe how you use these tools and mention that you may use pseudonyms or unique identifiers instead of real names to safeguard personal data further.

Cookies and consent

Inform visitors that your website uses cookies and other tracking technologies for analytics purposes. Matomo offers customisable cookie banners and opt-out options that allow users to choose their preferences regarding cookies and tracking, along with cookieless options that don’t require consent banners.

Right to access and correct data

Inform visitors of their rights and provide instructions on requesting information. Describe how to correct inaccuracies in their data and update their preferences.

Security measures

Assure visitors that you take data security seriously and have implemented measures to protect their data from unauthorised access or breaches. You can also use this opportunity to highlight any encryption or access controls you use to safeguard data.

Contact information

Provide contact details for your company’s Data Protection Officer (DPO) and encourage users to reach out if they have any questions or concerns about their data and privacy.

When selecting web analytics tools, consider how well they align with GDPR principles. Look for features like anonymisation, consent management options, data retention controls, security measures and data storage within the EU or a similarly privacy-protecting jurisdiction.

Matomo offers an advanced GDPR Manager. This is to make sure websites are fully GDPR compliant by giving users the ability to access, withdraw consent, object or erase their data, in addition to the anonymizing features.

And finally, when you use Matomo, you have 100% data ownership — stored with us in the EU if you’re using Matomo Cloud or on your own servers with Matomo On-Premise — so you can be data-driven and still be compliant with worldwide privacy laws. We are also trusted across industries as we provide accurate data (no trying to fill in the gaps with AI), a robust API that lets you connect your data to your other tools and cookieless tracking options so you don’t need a cookie consent banner. What’s more, our open-source nature allows you to explore the inner workings, offering the assurance of security firsthand.

Ready to become GDPR compliant?

Whether you’re an established business or just starting out, if you work with data from EU citizens or residents, then achieving GDPR compliance is essential. It doesn’t need to cost you a fortune or five years to get to compliant status. With the right tools and processes, you can be on top of the privacy requirements in no time at all, avoiding any of those hefty penalties or the resulting damage to your reputation.

You don’t need to sacrifice powerful data insights to be GDPR compliant. While Google Analytics uses data for its ‘own purposes’, Matomo is an ethical alternative. Using our all-in-one web analytics platform means you own 100% of your data 100% of the time.

Start a 21-day free trial of Matomo — no credit card required.

Disclaimer

Meta Receives a Record GDPR Fine from The Irish Data Protection Commission

Erin — Mon, 29 May 2023 03:21:07 +0000

The Irish Data Protection Commission (the DPC) issued a €1.2 billion fine to Meta on May, 22nd 2023 for violating the General Data Protection Regulation (GDPR).

The regulator ruled that Meta was unlawfully transferring European users’ data to its US-based servers and taking no sufficient measures for ensuring users’ privacy.

Meta must now suspend data transfer within five months and delete EU/EEA users’ personal data that was illegally transferred across the border. Or they risk facing another round of repercussions.

Meta continued to transfer personal user data to the USA following an earlier ruling of The Court of Justice of the European Union (CJEU), which already address problematic EU-U.S. data flows. Meta continued those transfers on the basis of the updated Standard Contractual Clauses (“SCCs”), adopted by the European Commission in 2021.

The Irish regulator successfully proved that these arrangements had not sufficiently addressed the “fundamental rights and freedoms” of the European data subjects, outlined in the CJEU ruling. Meta was not doing enough to protect EU users’ data against possible surveillance and unconsented usage by US authorities or other authorised entities.

Why European Regulators Are After The US Big Tech Firms?

GDPR regulations have been a sore area of compliance for US-based big tech companies.

Effectively, they had to adopt a host of new measures for collecting user consent, ensuring compliant data storage and the right to request data removal for a substantial part of their user bases.

The wrinkle, however, is that companies like Google and Meta among others, don’t have separate data processing infrastructure for different markets. Instead, all the user data gets commingled on the companies’ servers, which are located in the US.

Data storage facilities’ location is an issue. In 2020, the CJEU made a historical ruling, called the invalidation of the Privacy Shield. Originally, international companies were allowed to transfer data between the EU and the US if they adhered to seven data protection principles. This arrangement was called the Privacy Shield.

However, the continuous investigation found that the Privacy Shield scheme was not GDPR compliant and therefore companies could no longer use it to justify cross-border data transfers.

The invalidation of the Privacy Shield gave ground for further investigations of the big tech companies’ compliance statuses.

In March 2022, the Irish DPC issued the first €17 million fine to Meta for “insufficient technical and organisational measures to ensure information security of European users”. In September 2022, Meta was again hit with a €405 million fine for Instagram breaching GDPR principles.

2023 began with another series of rulings, with the DPC concluding that Meta had breaches of the GDPR relating to its Facebook service (€210 million fine) and breaches related to Instagram (€180 million fine).

Clearly, Meta already knew they weren’t doing enough for GDPR compliance and yet they refused to take privacy-focused action.

Is Google GDPR Compliant?

Google has a similar “track record” as Meta when it comes to ensuring full compliance with the GDPR. Although Google has said to provide users with more controls for managing their data privacy, the proposed solutions are just scratching the surface.

In the background, Google continues to leverage its ample reserves of user browsing, behavioural and device data in product development and advertising.

In 2022, the Irish Council for Civil Liberties (ICCL) found that Google used web users’ information in its real-time bidding ad system without their knowledge or consent. The French data regulator (CNIL), in turn, fined Google for €150 million because of poor cookie consent banners the same year.

Google Analytics GDPR compliance status is, however, the bigger concern.

Neither Google Univeral Analytics (UA) nor Google Analytics 4 are GDPR compliant, following the Privacy Shield framework invalidation in 2020.

Fines from individual regulators in Sweden, France, Austria, Italy, Denmark, Finland and Norway ruled that Google Analytics is non-GDPR compliant and is therefore illegal to use.

The regulatory rulings not just affect Google, but also GA users. Because the product is in breach of European privacy laws, people using it are complacent. Privacy groups like noyb, for example, are exercising their right to sue individual websites, using Google Analytics.

How to Stay GDPR Compliant With Website Analytics

To avoid any potential risk exposure, selectively investigate each website analytics provider’s data storage and management practices.

Inquire about the company’s data storage locations among the first things. For example, Matomo Cloud keeps all the data in the EU, while Matomo On-Premise edition gives you the option to store data in any country of your choice.

Secondly, ask about their process for consent tracking and subsequent data analysis. Our website analytics product is fully GDPR compliant as we have first-party cookies enabled by default, offer a convenient option of tracking out-outs, provide a data removal mechanism and practice safe data storage. In fact, Matomo was approved by the French Data Protection Authority (CNIL) as one of the few web analytics apps that can be used to collect data without tracking consent.

Using an in-built GDPR Manager, Matomo users can implement the right set of controls for their market and their industry. For example, you can implement extra data or IP anonymization; disable visitor logs and profiles.

Thanks to our privacy-by-design architecture and native controls, users can make their Matomo analytics compliant even with the strictest privacy laws like HIPAA, CCPA, LGPD and PECR.

Learn more about GDPR-friendly website analytics.

Final Thoughts

Since the GDPR came into effect in 2018, over 1,400 fines have been given to various companies in breach of the regulations. Meta and Google have been initially lax in response to European regulatory demands. But as new fines follow and the consumer pressure mounts, Big Tech companies are forced to take more proactive measures: add opt-outs for personalised ads and introduce an alternative mechanism to third-party cookies.

Companies, using non-GDPR-compliant tools risk finding themselves in the crossfire of consumer angst and regulatory criticism. To operate an ethical, compliant business consider privacy-focused alternatives to Google products, especially in the area of website analytics.

Google Analytics 4 and GDPR: Everything You Need to Know

Erin — Tue, 17 May 2022 21:54:10 +0000

Four years have passed since the European General Data Protection Regulation (GDPR, also known as DSGVO in German, and RGPD in French) took effect.

That’s ample time to get compliant, especially for an organisation as big and innovative as Google. Or is it?

If you are wondering how GDPR affects Google Analytics 4 and what the compliance status is at present, here’s the lowdown.

Is Google Analytics 4 GDPR Compliant?

No. As of mid-2022, Google Analytics 4 (GA4) isn’t fully GDPR compliant. Despite adding extra privacy-focused features, GA4 still has murky status with the European regulators. After the invalidation of the Privacy Shield framework in 2020, Google is yet to regulate EU-US data protection. At present, the company doesn’t sufficiently protect EU citizens’ and residents’ data against US surveillance laws. This is a direct breach of GDPR.

Google Analytics and GDPR: a Complex Relationship

European regulators have scrutinised Google since GDPR came into effect in 2018.

While the company took steps to prepare for GDPR provisions, it didn’t fully comply with important regulations around user data storage, transfer and security.

The relationship between Google and EU regulators got more heated after the Court of Justice of the European Union (CJEU) invalidated the Privacy Shield — a leeway Google used for EU-US data transfers. After 2020, GDPR litigation against Google followed.

This post summarises the main milestones in this story and explains the consequences for Google Analytics users.

2018: Google Analytics Meets GDPR

In 2018, the EU adopted the General Data Protection Regulation (GDPR) — a set of privacy and data security laws, covering all member states. Every business interacting with EU citizens and/or residents had to comply.

GDPR harmonised data protection laws across member states and put down extra provisions for what constitutes sensitive personal information (or PII). Broadly, PII includes any data about the person’s:

Racial or ethnic origin
Employment status
Religious or political beliefs
State of health
Genetic or biometric data
Financial records (such as payment method data)
Address and phone numbers

Businesses were barred from collecting this information without explicit consent (and even with it in some cases). If collected, such sensitive information is also subject to strict requirements on how it should be stored, secured, transferred and used.

7 Main GDPR Principles Explained

Article 5 of the GDPR lays out seven main GDPR principles for personal data and privacy protection:

Lawfulness, fairness and transparency — data must be obtained legally, collected with consent and in adherence to laws.
Purpose limitation — all personal information must be collected for specified, explicit and legal purposes.
Data minimisation — companies must collect only necessary and adequate data, aligned with the stated purpose.
Accuracy — data accuracy must be ensured at all times. Companies must have mechanisms to erase or correct inaccurate data without delays.
Storage limitation — data must be stored only for as long as the stated purpose suggests. Though there’s no upper time limit on data storage.
Integrity and confidentiality (security) — companies must take measures to ensure secure data storage and prevent unlawful or unauthorised access to it.
Accountability — companies must be able to demonstrate adherence to the above principles.

Google claimed to have taken steps to make all of their products GDPR compliant ahead of the deadline. But in practice, this wasn’t always the case.

In March 2018, a group of publishers admonished Google for not providing them with enough tools for GDPR compliance:

“[Y]ou refuse to provide publishers with any specific information about how you will collect, share and use the data. Placing the full burden of obtaining new consent on the publisher is untenable without providing the publisher with the specific information needed to provide sufficient transparency or to obtain the requisite specific, granular and informed consent under the GDPR.”

The proposed Google Analytics GDPR consent form was hard to implement and lacked customisation options. In fact, Google “makes unilateral decisions” on how the collected data is stored and used.

Users had no way to learn about or control all intended uses of people’s data — which made compliance with the second clause impossible.

Unsurprisingly, Google was among the first companies to face a GDPR lawsuit (together with Facebook).

By 2019, French data regulator CNIL, successfully argued that Google wasn’t sufficiently disclosing its data collection across products — and hence in breach of GDPR. After a failed appeal, Google had to pay a €50 million fine and promise to do better.

2019: Google Analytics 4 Announcement

Throughout 2019, Google rightfully attempted to resolve some of its GDPR shortcomings across all products, Google Universal Analytics (UA) included.

They added a more visible consent mechanism for online tracking and provided extra compliance tips for users to follow. In the background, Google also made tech changes to its data processing mechanism to get on the good side of regulations.

Though Google addressed some of the issues, they missed others. A 2019 independent investigation found that Google real-time-bidding (RTB) ad auctions still used EU citizens’ and residents’ data without consent, thanks to a loophole called “Push Pages”. But they managed to quickly patch this up before the allegations had made it to court.

In November 2019, Google released a beta version of the new product version — Google Analytics 4, due to replace Universal Analytics.

GA4 came with a set of new privacy-focused features for ticking GDPR boxes such as:

Data deletion mechanism. Users can now request to surgically extract certain data from the Analytics servers via a new interface.
Shorter data retention period. You can now shorten the default retention period to 2 months by default (instead of 14 months) or add a custom limit.
IP Anonymisation. GA4 doesn’t log or store IP addresses by default.

Google Analytics also updated its data processing terms and made changes to its privacy policy.

Though Google made some progress, Google Analytics 4 still has many limitations — and isn’t GDPR compliant.

2020: Privacy Shield Invalidation Ruling

As part of the 2018 GDPR preparations, Google named its Irish entity (Google Ireland Limited) as the “data controller” legally responsible for EEA and Swiss users’ information.

The company announcement says:

Initially, Google assumed that this legal change would help them ensure GDPR compliance as “legally speaking” a European entity was set in charge of European data.

Practically, however, EEA consumers’ data was still primarily transferred and processed in the US — where most Google data centres are located. Until 2020, such cross-border data transfers were considered legal thanks to the Privacy Shield framework.

But in July 2020, The EU Court of Justice ruled that this framework doesn’t provide adequate data protection to digitally transmitted data against US surveillance laws. Hence, companies like Google can no longer use it. The Swiss Federal Data Protection and Information Commissioner (FDPIC) reached the same conclusion in September 2020.

The invalidation of the Privacy Shield framework put Google in a tough position.

Article 14. f of the GDPR explicitly states:

“The controller (the company) that intends to carry out a transfer of personal data to a recipient (Analytics solution) in a third country or an international organisation must provide its users with information on the place of processing and storage of its data”.

Invalidation of the Privacy Shield framework prohibited Google from moving data to the US. At the same time, GDPR provisions mandated that they must disclose proper data location.

But Google Analytics (like many other products) had no a mechanism for:

Guaranteeing intra-EU data storage
Selecting a designated regional storage location
Informing users about data storage location or data transfers outside of the EU

And these factors made Google Analytics in direct breach of GDPR — a territory, where they remain as of 2022.

2020-2022: Google GDPR Breaches and Fines

The 2020 ruling opened Google to GDPR lawsuits from country-specific data regulators.

Google Analytics in particular was under a heavy cease-fire.

Sweden first fined Google for violating GDPR for no not fulfilling its obligations to request data delisting in 2020.
France rejected Google Analytics 4 IP address anonymisation function as a sufficient measure for protecting cross-border data transfers. Even with it, US intelligence services can still access user IPs and other PII. France declared Google Analytics illegal and pressed a €150 million fine.
Austria also found Google Analytics GDPR non-compliant and proclaimed the service as “illegal”. The authority now seeks a fine too.

The Dutch Data Protection Authority and Norwegian Data Protection Authority also found Google Analytics guilty of a GDPR breach and seek to limit Google Analytics usage.

New privacy controls in Google Analytics 4 do not resolve the underlying issue — unregulated, non-consensual EU-US data transfer.

Google Analytics GDPR non-compliance effectively opens any website tracking or analysing European visitors to legal persecution.

In fact, this is already happening. noyb, a European privacy-focused NGO, has already filed over 100 lawsuits against European websites using Google Analytics.

2022: Privacy Shield 2.0. Negotiations

Google isn’t the only US company affected by the Privacy Shield framework invalidation. The ruling puts thousands of digital companies at risk of non-compliance.

To settle the matter, US and EU authorities started “peace talks” in spring 2022.

European Commission President Ursula von der Leyen said that they are working with the Biden administration on the new agreement that will “enable predictable and trustworthy data flows between the EU and US, safeguarding the privacy and civil liberties.”

However, it’s just the beginning of a lengthy negotiation process. The matter is far from being settled and contentious issues remain as we discussed on Twitter (come say hi!).

For one, the US isn’t eager to modify its surveillance laws and is mostly willing to make them “proportional” to those in place in the EU. These modifications may still not satisfy CJEU — which has the power to block the agreement vetting or invalidate it once again.

While these matters are getting hashed out, Google Analytics users, collecting data about EU citizens and/or residents, remain on slippery grounds. As long as they use GA4, they can be subject to GDPR-related lawsuits.

To Sum It Up

Google Analytics 4 and Google Universal Analytics are not GDPR compliant because of Privacy Shield invalidation in 2020.
French and Austrian data watchdogs named Google Analytics operations “illegal”. Swedish, Dutch and Norwegian authorities also claim it’s in breach of GDPR.
Any website using GA for collecting data about European citizens and/or residents can be taken to court for GDPR violations (which is already happening).
Privacy Shield 2.0 Framework discussions to regulate EU-US data transfers have only begun and may take years. Even if accepted, the new framework(s) may once again be invalidated by local data regulators as has already happened in the past.

Time to Get a GDPR Compliant Google Analytics Alternative

Retaining 100% data ownership is the optimal path to GDPR compliance.

By selecting a transparent web analytics solution that offers 100% data ownership, you can rest assured that no “behind the scenes” data collection, processing or transfers take place.

Unlike Google Analytics 4, Matomo offers all of the features you need to be GDPR compliant:

Full data anonymisation
Single-purpose data usage
Easy consent and an opt-out mechanism
First-party cookies usage by default
Simple access to collect data
Fast data removals
EU-based data storage for Matomo Cloud (or storage in the country of your choice with Matomo On-Premise)

Learn about your audiences in a privacy-centred way and protect your business against unnecessary legal exposure.

Start your 21-day free trial (no credit card required) to see how fully GDPR-compliant website analytics works!

Your email address

Your website address

Your Analytics subdomain will be .matomo.cloud

Choose your analytics subdomain

.matomo.cloud

I accept the terms and conditions and data processing agreement (DPA)

Your information will be used to create an account on our cloud service. For more information please consult our privacy policy.

Your introduction to personally identifiable information: What is PII?

Joselyn Khor — Wed, 15 Jan 2020 00:26:01 +0000

Learning about personally identifiable information (PII) is crucial. Identifiable information can be used for nefarious purposes like identity theft and fraud.

So, how can you protect yourself as an innocent web browser?

Or, if you manage a website — how do you protect users and your company from falling prey to privacy breaches?

As one of the most trusted analytics solutions, our readers would benefit from being as informed as possible about data privacy issues and PII. Learn how you can keep your or others’ information safe.

What is PII?

Before we discuss PII in-depth, let’s first understand what it stands for.

“PII” is an acronym for personally identifiable information.

Personally identifiable information (PII) is defined as any information that can be used to identify a person’s identity. The term was primarily used in the US data security and privacy breach notification context, but it has been adopted globally as a catch-all term for all information that can be linked to an individual. It is important to note that each privacy law defines what it protects slightly differently, and you will need to consult the specific law to understand what information or data is protected.

The US National Institute of Standards and Technology (NIST), defines PII as “any information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.” (NIST SP 800-63-3, quoting OMB Circular A-130).

What can be considered personally identifiable information (PII)?

The following are considered examples of PII:

Full name/usernames
Home address/mailing address
Email address
Credit card numbers
Date of birth
Phone numbers
Login details
Precise locations
Account numbers
Passwords
Security codes (including biometric records)
Personal identification numbers
Driver license number

Read a list of more PII examples.

What’s non-PII?

Anonymous information, information that does not relate to individuals, or information that can’t be traced back to an individual, can be considered non-PII.

What is sensitive and non-sensitive PII?

The split into sensitive and non-sensitive PII is used to assist organisations in understanding their cybersecurity obligations and designing their cybersecurity response.

Sensitive PII comprises information which if lost, compromised or disclosed without authorisation, could result in substantial harm, embarrassment, inconvenience or unfairness to the individual. Some common examples of sensitive PII include Social Security numbers, financial account information, driver’s license numbers and medical records. Such data requires a higher standard of protection and any breach affecting sensitive PII is more likely to be notifiable .

Non-sensitive PII is considered “less sensitive”, from a data breach response perspective, because, on its own, it usually can’t be used to commit identity theft or fraud or cause other harm to the individual. While such information might be part of an individual’s identity and still protected by privacy laws, it poses a lower risk in case of a breach without additional data (like a name, bank account or Social Security number). This means it’s not necessarily notifiable under U.S. data breach notification requirements, however the assessment is contextual.

Use of appropriate safeguards (encryption, secure storage, appropriate access controls, etc.) can mitigate the risks.

However, when combined with other information, even non-sensitive PII data can become more potent, emphasising the importance of protecting all PII in compliance with applicable data protection laws. Note that both sensitive and non-sensitive PII are subject to privacy laws.

When combined, simple details can reveal much about someone and be misused.While knowing the differences is important, organisations processing PII need a complete plan that will allow them to keep PII safe and meet cybersecurity standards applicable to their business.

Who is affected by the exploitation of PII?

Anyone can be affected by the misuse of PII. Websites can compromise privacy by mishandling or illegally selling/sharing individual’s data. This may lead to identity theft, account fraud,account takeovers, reputational damage, psychological harm. PII can be compromised not only when it is accessed by ill-meaning third parties, but also when employees of the organisation handling the PII access PII databases without authorisation. .

How do cybercriminals exploit stolen PII?

Cybercriminals exploit stolen PII by committing online fraud. There are many risks involved once PII has been compromised, such as:

Identity theft: One of the primary uses of stolen PII is identity theft. This allows cybercriminals to assume another person’s identity and commit fraud, open credit cards, take out loans, or make unauthorised purchases.
Targeted phishing attacks: With detailed PII, cybercriminals can craft more convincing and targeted phishing emails or messages, increasing the chances that the recipient will fall for the scam.
Financial loss: Direct financial losses can occur when cybercriminals access and misuse bank accounts, credit cards, or other financial resources tied to stolen PII.
Legal repercussions: Victims of stolen PII might inadvertently be embroiled in legal battles if their identity is used for illicit activities.

Due to these risks, individuals and organisations must prioritise data security and stay informed about best practices for safeguarding PII.

Website owner’s responsibility for data privacy (PII and analytics)

If you’re using a web analytics tool like Google Analytics or Matomo, the best practice is not collecting PII if possible. This is to respect your website visitor’s privacy and minimise the risk of data breaches.

You must collect and handle this data securely if you work in an industry that needs people to share personal information (e.g., healthcare, security industries, public sector) and be aware of any applicable privacy laws and cybersecurity standards.

Although over half of the world’s population will have its private data protected by modern regulations, it’s still vital to play it safe. Organisations should only request PII if it’s absolutely necessary.

How you’re held accountable remains up to the privacy laws of the country you’re doing business in. Make sure you’re fully aware of these privacy and data protection laws that relate specifically to you.

To reduce the risk of privacy breaches, try collecting as little PII as possible, purging it as soon as possible and ensuring your IT security is updated and protected against security threats.

With data collection tools like web analytics, data may be tracked through features like User ID, custom variables and custom dimensions. Sometimes, they’re also harder to identify when present, for example, in page URLs, page titles, or referrers URLs. So be sure to configure your web analytics tools’ settings to ensure you’re respecting users’ privacy.

If you’re using a GDPR compliant tool like Matomo, learn how you can stop processing personal data.

PII privacy laws by country

Given the rise in digital data storage and transactions, countries have established various laws to protect personal information.

Here’s a look at some privacy laws by country.

European Union

The realm of personal data protection in the European Union is governed predominantly by the General Data Protection Regulation (GDPR). This robust framework amplifies the rights of EU citizens regarding their personal protected information. Controllers or processors who fail to comply with the GDPR can receive a fine of up to €20 million or, in case of groups of companies, 4% of their total worldwide annual turnover of the preceding financial year, whichever is higher. On cybersecurity front, a failure to implement appropriate technical and organisational measures to protect the personal data can result in a fine up to €10 million or EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.

United States

Unlike the EU, the United States doesn’t operate under a single overarching data protection statute. Instead, the landscape is dotted with a myriad of laws at both the federal and state levels.

Federal laws like HIPAA target specific sectors, setting guidelines for data privacy. On the state front, significant advancements like the California Consumer Privacy Act (CCPA) and Virginia Consumer Data Protection Act (VCDPA) signal the growing emphasis on individual data rights. Other states that have passed consumer data privacy acts to date include Colorado, Connecticut, Indiana, Iowa, Montana, Oregon, Tennessee, Texas and Utah. Other bills are pending or proposed across the remaining states.

Privacy laws in other countries

The following are the primary privacy laws in other countries:

Canada

PIPEDA (Personal Information Protection and Electronic Documents Act): Governs how businesses handle personal information in private transactions. Some provinces have specific regulations that align with PIPEDA.

Australia

Privacy Act 1988, including Australian Privacy Principles, Australian Privacy Principles Guidelines and Notifiable Data Breaches scheme: Governs how federal and Norfolk Island government agencies and certain private sector entities handle personal information. State privacy laws also exist.

India

DPDP (Digital Personal Data Protection Act): The Act applies to digital or digitized data only.
Information Technology Act, 2000: Regulates cyber activities, including electronic data’s authenticity and security.

Brazil

LGPD (Lei Geral de Proteção de Dados Pessoais): Brazil’s main data protection law, LGPD, emphasises transparency, accountability and individual rights regarding personal data.

China

PIPL (Personal Information Protection Law): China’s comprehensive data protection regulation ensures the lawful, justified and necessary processing of personal data.
Cybersecurity Law: Focuses on network security, data protection and ensuring Chinese citizens’ data stays within the country.
Data Security Law: Deals with data security across (broader than personal information).

Personally identifiable information (PII) vs personal data

While PII and “personal data” are sometimes used interchangeably, it is important to remember that while PII is always personal data, not all personal data as defined in the GDPR would be considered PII. For example, the GDPR definition of “personal data” includes data that has been pseudonymised, or data that may not have been traditionally seen as PII (online identifiers, IP addresses, device ID, browser information, some cookies, and URL names).

The definition of “personal data” according to the GDPR:

What’s seen as personal data depends on the context. If a piece of information can be combined with others to establish someone’s identity then that can be considered personal data.

How do you keep PII safe?

Don’t give your data away so easily. Read the terms and conditions.
Don’t just click “agree” when faced with consent screens, as consent screens are majorly flawed.
Disable third-party cookies by default.
Use strong passwords.
Be wary of public WiFi — hackers can easily access your PII or sensitive data. Use a Virtual Private Network (VPN) to encrypt your connection.

Read more on how to keep PII safe. We’ve also included a PII compliance checklist for businesses and organisations.

PII security best practices

Protecting PII is crucial for businesses and organisations in maintaining trust and complying with privacy regulations.

Here are some best practices to ensure the safety of such data:

Incorporate data encryption

Always employ robust encryption standards for your PII, ensuring it’s encrypted during storage (at rest) and while being transferred (in transit) to safeguard against unauthorised access. This encryption acts as a protective barrier, rendering data unreadable to any unauthorised person who might intercept it.

Use data anonymisation

Incorporating data anonymisation can help organisations transform personal data to make them harder to identify. By utilising this technique, businesses can significantly reduce the risk of data breaches and protect PII from potential misuse. Tools such as Matomo provide a privacy-friendly analytics solution that guarantees GDPR compliance and offers data anonymisation as a .

Employ Multi-factor Authentication (MFA)

Mandate the use of MFA for any system storing or accessing PII, reinforcing user identity through multiple verification methods. By requiring various verification forms, MFA greatly reduces the risk of unauthorised access due to stolen or guessed credentials.

Monitor and apply updates

Diligently monitor and swiftly apply all software patches and updates to seal off vulnerabilities and keep your systems up-to-date against threats. Regularly updating software ensures that known vulnerabilities, which cybercriminals often exploit, are addressed promptly.

Establish access control

Establish strict access protocols (role-based and need-to-know basis), allowing PII access solely to those with a defined role and genuine necessity, minimising potential exposure points. This selective access means fewer people have the potential to inadvertently or maliciously misuse sensitive information.

Develop your own systems

You can effectively safeguard PII data by developing your own systems, such as by building custom plugins and APIs. Constructing your own solutions gives you complete control over how data is gathered, processed and transmitted. Using open-source platforms like Matomo, where you can customise various aspects or develop plugins, can be beneficial.

Encourage secure password policies

Advocate for complex password requirements and regular changes, bolstering defences against unauthorised access attempts. Strong passwords that are changed periodically can prevent unwanted access to critical systems.

Store data on your own servers

Storing your own data on your own servers can require some technical skills and extensive resources (like the actual servers themselves), but it’s incredibly common in industries that need high levels of data privacy and security. Industries like finance and healthcare often store their data on their own servers to ensure the data is as protected as possible.

Matomo On-Premise is a free solution for self-hosting your own servers to ensure your data is secure.

How Matomo deals with PII and personal data

Although Matomo is a web analytics tool that tracks user activity on your website, we take privacy and PII very seriously – on both our Cloud and On-Premise offerings. Matomo is a privacy-friendly analytics solution that gives you 100% data ownership and GDPR compliance.

As the GDPR continues to evolve, you can rest assured that Matomo will be at the forefront of these changes.

Keep your users’ PII safe and start using Matomo – sign up for your 21-day free trial now (no credit card required) or try our live demo now.

If you’re using Matomo and would like to know how you can be fully GDPR compliant and protect user privacy, read more:

Learn how to not process any personally identifiable information – Anonymise IP addresses, user IDs, and order IDs
Matomo protects user privacy by talking the talk and walking the walk
Stay ahead of the GDPR with a privacy-respecting analytics platform
11 ways Matomo helps you protect your visitor’s privacy

Disclaimer

We are not lawyers and don’t claim to be. The information provided here is to help give an introduction to issues you may encounter when dealing with PII. We encourage every business and website to take data privacy seriously and discuss these issues with your lawyer if you have any concerns.

Additional resources: