What’s with all these OPT-IN Messages?

Like me you are probably receiving OPT-IN messages everyday, claiming that because of the General Data Protection Regulations (GDPR) coming into effect on 25 May 2018 that they now need your “Consent” to continue sending you marketing emails, well here’s my problem with it… …this is just wrong, the thing is GDPR is not about stopping businesses doing business, its not about marketing, it is about making businesses maintain Personal Data properly, as we say treating Data with respect, Consent (OPT-IN) is just one of the six legal basis for processing personal data and despite what many people think it is not the “Golden Nugget”, in fact there is no hierarchy to the 6 Lawful reasons and in many cases is not your best option.

Can I continue sending messages to my existing list?

Business to Business
Yes of course you can, and you do not need to get people to re-consent, additionally if you are already email marketing and they have not objected or asked to be removed then you may be able to say there is a mutual “Legitimate Interest” (Article 6.1.f) which is a lawful basis to process the information, however if you are going to rely on Legitimate Interest you need to carry out a Legitimate Interest Assessment (LIA) and ensure that the recipients rights and freedoms are not affected and are prioritised above the interests of the company, if there is any doubt about the legitimate interest then the best advice is to not send the email, and remember you always need to give the recipient an easy and clear way to unsubscribe.

Business to Consumer
Things do get a little more difficult here but not really because of GDPR, more PECR, ePrivacy and Direct Marketing Act (DMA), it is unlikely you will be able to rely on “Legitimate Interest” (but not impossible) and another lawful reason may be more appropriate, just to make this more interesting… …sole traders come under Business to Consumer, but ultimately the worst that will happen is someone will ask to no longer receive your email, as long as you remove them without delay or distress it is unlikely it will go further, unless you continually spam people or abuse the data you maintain!

What about new contacts?

From your website
You need to make it clear and optional to opt-in to any marketing emails and you are not allowed to force signups, so those annoying ‘signup to receive our White Papers’ are generally not compliant, if someone consents to you marketing to them then the consent must be given freely and unconditionally and then the details must only be used for the purpose they were consented to.

Networking Groups
It is highly likely that you will exchange business cards when networking and agree to contacting eachother, but neither of you have agreed to being added to a mailing list and receiving regular marketing emails, you would need to send an email, asking them if they would like to opt-in and clearly explaining the purpose, if they say no then you cannot Direct market to them.

Purchasing data lists
This is interesting, the seller needs to confirm that the subjects are happy to be contacted by you, that consent needs to be explicitly for your company, any third party company does not allow you to use the list, the only person allowed to contact the subject and ask is the seller, you will need to evidence that consent has been granted so take extreame care here.

Existing Customers
You can contact you existing customers and let them know about changes to the products you have already sold them, you may also market about other related services and products you provide.

We’re to small

No business is too small, by compromising smaller businesses, cyber actors can gain information and send malicious files to others, allowing then launch larger, more targeted attacks, while working up the supply chain.

How can I protect my systems?

A Cyber Essentials Certification ensures you have a good security base on your systems, the key features of Cyber Essentials are:

• Secure Firewall Configuration
• User Access Controls
• Secure Client Configuration
• Virus and Malware Protection
• Patch Management

What about Training

Well we believe that the most important part of Cyber Essentials is user awareness training, often overlooked, but as 72% of breaches are related to staff receiving fraudulent emails, there is clearly a need for training, as part of our Cyber Essentials we provide regular updates on the current threats and have a staff awareness session

How to I get a Cyber Essentials Certification?

Obtaining a Cyber Essentials Certification is a fairly straight forward process, we will guide you through the process and offer sensible advice during the process whilst considering your commercial and operational needs, get in contact and we would be happy to help

We can hide from it but truth is the new General Data Protection Regulations (GDPR) are coming into effect on 25th May 2018, these new regulations affect the personal data that every business processes, further more the definition of Personal Data has changed.

What is the definition of Personal Data?

The GDPR changes the definition of personal data, it is fair to say that information you would previously not have classified as Personal Data will be under the GDPR.

What do you need to do?

This is different for every business but there is some common ground, the very first thing that you need to do is a DPIA (Data Protection Impact Assessment), in its simplist form this is a list of all the different types of personal data you process, why you process it, on what legal basis you process and how you protect and manage it, you may remember from a previous post we described the GDPR as a “risk based regulatory framework”, with that in mind you need to put policies and procedures into place to reduce your liability by reducing any potential damages to the rights and freedoms of any person.

Once you have your DPIA then you can question if you actually need the data and then minimise the personal data that you hold and protect it.

Security by design

GDPR states that security should be by design and with the current technologies available but without involving unrealistic costs, some of the security measures you can implement can be done very cost effectively, for example ‘Access Permissions’ only giving access to those that actually need access, another measure may be disk encryption, if enabling disk encryption then there are some specific guidelines from the NCSC (National Cyber Security Centre) which should be implemented, if you need assistance implementing protection then please get in contact.

We all have passwords for everything we do these days, we’re told to make them complex and then we forget them, so we write them on a post-it note and attach it to our screens! or write it in the back of our diary backwards because nobody else does that and they will never work it out!

Well here’s a novel way of remembering, how about using a ‘pass phrase’ rather than a password… For example ‘Buy 6 eggs on the way home!’ easy to remember, complex to guess and you won’t forget the eggs either!!

You can come up with your own ideas for the phrase and make it memorable for yourself, furthermore you could associate different phrases with different accounts making it much easier to remember and harder for the nasty passwords guessing attempts:

Some more examples:
Bank : Is this safer for my £1000s than under the bed!
Tesco : Don’t forget to buy 6 packets of sweets.
Work : Working 9-5 what a way to make a living!
Other : I love my 2 Children, Jack and Jill : )

The usage is limitless and produces a nice way of remembering your passwords.

GDPR is the General Data Protection Regulations (GDPR) that come into effect on 25th May 2018, it is the biggest change to Data Protection in 20 years and is long overdue, the amount of personal data we process and the way we process it has changed vastly and all businesses need to demonstrate that they care and respect the data they are privileged to maintain, the GDPR is best described as a “risk based regulatory framework”, you need to asses your risks to the data and then put monitoring, detection and response controls in place, these come in many forms.

For most businesses the change is actually not that big, it would be fair to say that most respectful businesses already treat the Personal data they maintain with respect and care but have not documented how they maintain the data and how to put things right, the GDPR puts a requirement on businesses to have a clear and concise Data Protection Policy in place and then demonstrate how the policy is applied.

What is Personal Data

The GDPR changes the definition of personal data, it is fair to say that information you would previously not have classified as Personal Data will be under the GDPR.

Can I still process Personal Data?

Of course you can, but you must have a Lawful Reason to process the data, there are 6 lawful reasons for processing data, there is no hierarchy to the reasons.

Everyone is talking about big fines!

There is no hiding from the fact that the GDPR does include provision for some hefty fines, as we have said the GDPR is a “risk based regularity framework” the implementation of the GDPR in your business is all about mitigating those fines with you monitoring, detection and response controls, however it is worth noting that Elizabeth Denham of the Information Commissioners Office (ICO) has consistently said she “would rather use the Carrot than the Stick” and fines will be a last result saved for persistent offenders and serious cases. the ICO have

What do I need to do?

The very fist thing you need to do is asses what Personal data you hold, how has access to it and where it is going, then you need to risk asses the data and implement monitoring, detection and response controls, these will vary depending on the data and how much control you have over those controls, this is know as a Data Protection Impact Assessment.