Benchmark Your Company’s Handling of Personal Data. Click here for your free Privacy Grade. Read more about PrivacyGrader in our recent TechCrunch coverage.

X

Do You Have a “Legitimate Interest” in the Data You Collect?

Under the GDPR, consent isn’t the only lawful basis for data processing

The European Union’s General Data Protection Regulation (GDPR) says that in order to collect and process personal data, an organization must have a “lawful basis” to do so. There are six specific ways that organizations can achieve that, and most are relatively straightforward: you’re in the clear if a data subject explicitly consents to a given use of their data, for instance, or if there’s an legal requirement for you to collect and process data in a certain way. 

But there’s one lawful basis that’s simultaneously widely used and poorly understood: the “legitimate interest” basis for data usage. According to the GDPR, data processing is lawful if it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party” — unless those legitimate interests are “overridden by the interests or fundamental rights and freedoms of the data subject.” 

On the one hand, the GDPR clearly suggests that organizations can lawfully use personal data if they really need to. But it also clearly says that the “legitimate interest” basis for data processing can be canceled out by the countervailing interests of the data subject. That’s a tricky needle to thread: how can organizations decide whether their interests are “legitimate,” and how are they supposed to figure out whether their interests are “overridden” by those of the data subject?

The three-part test

The GDPR doesn’t clearly explain what constitutes a “legitimate interest,” so this is something organizations have to figure out for themselves on a case-by-case basis. The GDPR offers some examples of legitimate interests, such as use of client or employee data, fraud prevention, marketing, or identifying security breaches. Still, there are no hard-and-fast rules on which organizations can rely to ensure they’re covered by a “legitimate interest” basis for data processing.

Because of that, it’s helpful to think of the “legitimate interest” basis as a process rather than simply a set of fixed criteria. To meet your obligations, you need to be able to show that you’ve weighed your own “legitimate interest” against the interests of data subjects. The British Information Commissioner’s Office suggests using a three-part test to figure out whether your “legitimate interest” claim holds water:

  1. First, your data processing should have a clear purpose that serves either your organization’s interests or those of a third party. The key here is to be specific: your purpose can’t simply be to process data as an end in its own right, but should be a clear goal that delivers evident benefits to your organization. For instance, a company might have a clear interest in checking that it isn’t being defrauded, or in identifying potential security threats. 
  1. Next, your data processing should be necessary to achieve that goal. That doesn’t mean it’s the only way to achieve a certain goal, but it does mean that your data processing should be targeted and proportionate to your stated ends. If you’re trying to tackle fraud, for instance, you should only be processing data that’s directly related to that goal.  
  1. Finally, your data processing should be balanced against the interests and rights of the data subject. It’s important to show that you’ve carefully considered your data subjects’ rights, and that you’re doing your best to minimize any potential impact on them. This is especially important if you’re handling data pertaining to children, who are singled out for special protection under the GDPR.

Such tests are in some ways more art than science. Still, conducting and documenting a formal evaluative process is vital to show that you’re properly weighing your own legitimate interests against those of your data subjects. 

Expectations and objections

Besides the three-part test, there are two other important factors to consider. 

First, it’s generally acceptable to process data in ways that users should reasonably expect. This doesn’t mean that a specific user has to actually expect their data to be processed in a certain way — just that a reasonable person would likely make that assumption.

This gives organizations some leeway to process data for expected purposes such as fraud prevention or other routine operations. It’s also worth noting that if you communicate your practices to your users, they will be more likely to expect their data to be processed accordingly. A clear, detailed data privacy policy goes a long way toward supporting a “legitimate interest” basis for data processing.

Second, remember that the GDPR gives data subjects the right to object to the use of their data. That’s especially important for data processed under a “legitimate interest” rationale, when there can be grounds for differing opinions about whether data use is justified. 

If a user objects to your use of their data, the onus is on your organization to demonstrate not just that you have a legitimate interest, but a compelling interest to continue processing that data. That’s a high bar to clear, especially since you could face steep fines if you improperly persist in using personal data following an objection. 

Most objections result in organizations either halting data usage or deleting a user’s data. If such objections become widespread, you may need to explore using a different lawful basis to justify your data processing. 

A tech solution

So is a “legitimate interest” basis right for your organization? Well, it’s certainly worth considering if you want to use data in a way that brings a clear benefit to your organization, doesn’t carry significant risk of infringing on data subjects’ privacy rights, and that data subjects should reasonably expect to occur. 

Still, a “legitimate interest” rationale for data processing comes with a unique set of complexities, including documentation requirements and the need to respond quickly and effectively to objections raised by data subjects. 

At Ketch, we specialize in helping organizations to formulate data policies that can be applied instantly across your entire data ecosystem, providing trackable real-time data privacy and compliance capabilities without the need to rewrite code or rebuild your tech stack. If you’re considering using a “legitimate interest” basis for GDPR compliance, get in touch today, and find out how Ketch can take your organization’s data processing to the next level.

The Top 5 GDPR Compliance Mistakes and How to Avoid Them

The European Union’s General Data Protection Regulation (GDPR) is a complex and sweeping data protection law that has left companies all over the world scrambling to rethink their data handling processes.  Unfortunately, ensuring full compliance with the 88-page regulation isn’t easy. In fact, many companies are still making mistakes — and with penalties maxing out at 4% of annual global turnover, in addition to potential damages payable to affected users, slipping up can be costly.

Here are 5 of the biggest errors we see companies making as they figure out how to handle their obligations under the GDPR:

1. Assuming the GDPR doesn’t apply to you

As you’d expect virtually all companies with operations in the European Economic Area are required to comply with the GDPR. But that doesn’t mean you’re off the hook if you’re based elsewhere in the world. Under the terms of the GDPR, companies that collect or process data for the purposes of doing business with European customers must comply with the regulation. An occasional European visitor to your company’s website won’t necessarily trigger the GDPR. But if you’re soliciting business from Europeans, such as by advertising in Europe or including prices in euros, then you’re likely to fall under the regulation. 

2. Misunderstanding the scope of the statute. 

It’s easy to assume that as long as you’re getting users’ consent before you collect their personal data, you’ve insulated yourself against any potential problems. Unfortunately, though, the GDPR is much more far-reaching than that, and collecting consent is only the beginning. The GDPR actually secures 8 key rights for data subjects, including the right to amend or revoke consent; the right to obtain copies of or to amend any collected data; and the right to have their data “forgotten” or completely deleted, or to object to the ways in which it’s being processed. 

For most companies, that can’t be managed simply by asking permission to set various types of cookies to log consent. Instead, you’ll need a systematic approach that lets you track a user’s personal data throughout your system, and ensure it’s never used for purposes to which a user objects. You’ll also need to be able to extract data from your system, explain where and how it is used, or discontinue processing that data on demand. For companies affected by the GDPR, static cookie-based strategies simply aren’t good enough.

3. Counting on partners doing their jobs right.

In the modern world, dataflows don’t end neatly at the boundary of your organization — they spill over to third parties and outside partners. The GDPR makes clear that data controllers aren’t responsible solely for their own handling of a user’s data — they’re also directly liable for any errors or missteps made by other processors, such as downstream partners and vendors, who use the data.

In other words, it’s no longer enough to simply put policies in place to manage your own handling of personal data. You also need to ensure that you’re promptly and reliably communicating with partners about how data can be processed. If your user revokes consent, that signal needs to propagate promptly across your entire data ecosystem, including any third parties who’ve accessed the data, in order to shield you from potential liability for GDPR noncompliance. 

4. Expecting IT pros to be policy experts (and vice versa)

GDPR compliance requires both policy chops (to figure out how personal data should be handled) and IT savvy (to figure out how to implement that across your data ecosystem). Too often policy experts feel obliged to weigh in on IT implementations, or IT teams have to parse the nuances of the statute when writing code. That can lead to mistakes as people step outside their areas of expertise, or slow the pace of innovation as projects are increasingly run by committee and require multiple stages of legal and technical approval.

The key for successful GDPR compliance is to develop an approach that allows legal teams to define acceptable forms of data usage, then rapidly and frictionlessly translate those perspectives into actionable guidance for IT teams. In an ideal world, your legal teams should never need to read a line of code, and your IT specialists should never need to wade into the dense legal language of the GDPR itself.

5. Dealing with the GDPR in isolation

The GDPR has changed the face of global data privacy regulation; increasingly, in the post-Snowden world, regulators are looking to create muscular regulatory frameworks that place significant new burdens on data controllers and processors. But here’s the rub: while many of the frameworks now being implemented share the same goals, they impose unique and varying obligations upon organizations. 

It isn’t enough to simply upgrade your data-handling infrastructure to ensure GDPR compliance. Instead, organizations need to create flexible and responsive systems that can rapidly adapt to new regulations and requirements as they are introduced. From new data laws in California and Brazil to sweeping privacy measures in India and China, organizations need to plan for the future, and put infrastructure in place to help them remain compliant with a fluid and constantly changing global regulatory landscape.

All of these mistakes are easy to make. Fortunately, they’re also easy to avoid. The key is to take the GDPR seriously, and not to try to handle everything internally. Whether it’s mastering the policy nuances or figuring out how to translate them into workable IT and data-handling infrastructure, it pays to partner with a specialist. 

That’s where Ketch comes in. Our founding team’s background in advertising and marketing technologies and data infrastructure gives us a deep understanding of the ways that data flows through modern businesses. We also understand the challenges that companies face as they try to adapt those dataflows to the requirements of the GDPR without disrupting their daily operations. 

Using our technology and our in-house expertise, we can translate your specific requirements and obligations under the GDPR into customized, crystal-clear data-management policies. Crucially, we also automate the process of querying datasets subject to those policies — so your coders and developers can implement call-outs to automatically check whether a specific action is permissible for a specific item of personal data. 

With Ketch, your IT teams don’t have to fret about the nuances of privacy laws, and your legal teams don’t lose sleep over specific implementations. And because permissions are handled centrally, you can be confident that any changes will propagate instantly across your entire data ecosystem, including outside partners, to ensure continuous GDPR compliance. 

That adds up to a frictionless and robust toolkit for companies affected by the GDPR. So stop fretting about making costly mistakes — and get in touch with Ketch to find out how we can streamline your data compliance.

After decades of the unrestricted “Wild, Wild West” of the Internet, complying with consumer rights granted by data security and privacy regulations like GDPR and CCPA in the evolving digital landscape has likely become a struggle if your company is built with consumer and customer data. And frankly, there are few, if any businesses, that aren’t.

While complying with these complex provisions has undoubtedly been a bit of a bumpy road for your business, the crux of these regulations is that consumers are empowered to request that you disclose, provide access to, rectify or delete all their personal data. That’s anything from identifiers like names, email addresses, and account numbers, to commercial records like browser history, cookies, and online transactions. And when those data subject requests come in, it’s up to you to fulfill them across any and all systems where personal data resides.

Easier said than done, right?

Orchestrating compliance requests involves a complex workflow of verifying the request, finding the data—whether in-house legacy, cloud-based, data warehouse, or third-party systems—and going through all the steps within each system to fulfill the request. Depending on the size of your business, orchestration encompasses dozens, or even hundreds, of systems that collect and store data in multiple formats across multiple business units.

Think about it. All of advertising and personalization depends on personal data—what you buy, where you live, where you go, and even what you look like. You can be guaranteed that no matter what your business, personal data about your customers resides in far more places than just your CRM. It’s in everything from financial and customer-service systems, to logs, developer data stores, backups, websites, and all over the cloud. To complicate matters, a customer may be John Smith in one system, reward member #45783290 in another, and cookie AqfaAU9kUEpEbAtlD in yet another.

Much like a conductor charged with directing dozens of instruments across various sections all playing a different score, no job in data compliance is more difficult, and more important, than orchestration. But unlike the conductor who knows exactly when and to whom to wave the baton, the time-consuming and daunting task of orchestrating data compliance requests is lumpy and unpredictable; there is no warning and no ability to plan, causing your business to scramble and disrupt daily business operations.

Sure, you have spreadsheets, documented procedures, or even third-party ticketing solutions to help you organize requests and cobble together your workflow for determining all affected systems and those responsible for fulfilling data subject requests within each of those systems. But regardless of how efficient your approach and the fictitious claims of “automation” from third-party privacy and ticketing solutions, the actual process required to manually remove personal data from every system takes time and resources.

Amidst the legal and regulatory risk of compliance and the manual, error-prone process of responding to data subject requests, you are not alone if you’ve found your business needing to hire more staff, tying up your development team, or simply pushing out all the work that you do to grow your business—all of which are bad (and expensive) choices. These are, however, choices you don’t have to make.

We built Ketch to automate the capture and fulfillment of consumer data subject requests. We actually automate workflow—not just the creation of tickets—to give you robust orchestration without having to conduct a complex symphony of systems, ending your compliance headaches and doing away with that $100K data compliance analyst job you posted last week.

Click HERE to schedule your demo and learn how Ketch can help your organization automatically orchestrate data subject requests to cost-effectively and easily comply with privacy regulations.**