Canadian Marketing Association releases guide to help interpret the General Data Protection Regulation

Toronto – The General Data Protection Regulation (GDPR), proposed and adopted by the European Union (EU), comes into full effect on May 28. To assist Canadian marketers with GDPR compliance and planning, the Canadian Marketing Association (CMA) created and published the CMA Guide to the European Union (EU)’s General Data Protection Regulation (GDPR) and ePrivacy Regulation. This guide is intended to provide CMA members with an overview on general requirements, as well as insight on Canadian implications.

The guide includes eight key rights included in the GDPR:

1. The right to be informed – Companies must include some form of privacy notice indicating how they use the personal data of their customers.
2. The right of access – This continues the right of data subjects to access the personal data that organizations hold about them without incurring fees.
3. The right to rectification – Customers will be entitled to have incorrect information rectified. Third parties must also be notified if this data has been disclosed to them.
4. The right to erasure – The removal of personal data can be requested if there is no reason for its continued processing.
5. The right to restrict processing – Customers will have the right to ‘block’ personal data processing. Companies can still store the data, but not process it.
6. The right to data portability – This allows customers to transfer and use personal data across different services.
7. The right to object – This allows customers to object to their data being processed.
8. Automated decision making & profiling rights – Safeguards are provided against the risk that a potentially damaging decision is taken without human intervention.

The GDPR’s expanded extra-territorial reach means that marketers must consider how the full scope of the regulations could apply to Canadian organizations. The GDPR will apply to any organization, wherever located, that uses the personal information of EU residents to market products to, or “monitor the behaviour of”, such residents. This application extends to the processing of personal information whether within the EU or outside of it, by both data collectors and data processors.

“Canadians expect governments, marketers and consumers to work together to ensure that personal information is protected,” said John Wiltshire, CMA President and CEO. “To that end, the CMA is committed to establishing and ensuring best practices for marketers in Canada and has created the GDPR Guide as a resource to assist members with understanding and compliance of this new and far-reaching regulation.”

Many of the GDPR’s restrictions and requirements are consistent with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). And many Canadian organizations may already have policies and procedures in place that would be considered compliant. However, to ensure GDPR compliance, the CMA recommends the following:

• Determine whether GDPR applies to your organization.
• Obtain expert advice on the application of GDPR to your business activities, and what you may be required to do to comply.
• Protect your company’s most important data: ensure the sensitive data under your control is protected across devices, apps, and cloud services and on-premises environments.

Benefits also come along with the changes that GDPR will bring. Both consumers and businesses may witness the development of additional services as a result of the clearer, more consistent rules, which will likely lead to a greater sense of security, legal certainty and trust in the market.

For more information on GDPR and its impact on Canadian Business, click here.

For a full copy of the General Data Protection Regulation, a PDF copy can be viewed and downloaded here.

Source: Canadian Marketing Association