Privacy, your website and you

If you’re not totally sure how your website handles visitors’ privacy, then “Houston, we have a problem.”

(Disclaimer: I’m a web designer and database manager. Not a lawyer. This is not legal advice. You should seek competent legal counsel before making decisions about how you handle personal information on your website or in your business/organization.)

There really isn’t a website around today that doesn’t collect some kind of personal information. Some people think that their websites don’t. But, to quote Igor in Young Frankenstein: “Well, they were wrong, weren’t they?”

In fact, if a website really doesn’t ever collect any personal information, then we need to have a serious talk about what the website is doing for you and your business. Because there is clearly no way for website visitors to communicate with you.

At the very least any website today has a contact form. Letting visitors contact you. (Dropping that form to just display an email address doesn’t change anything — it only kicks the privacy issue downstream a bit. And welcomes SPAM.)

Personal information collected on your website

Here’s a list of points on a website that collect personal information:

Contact form
Survey
Poll
Appointment booking
Event registration
Specialized form
Information request form
Freebie download form
Email signup form
User registration/login
Product/service sales form/cart
Payment/donation processing
Analytics
Cookies

While your website may not include all these options, you will have at least a few of them. Plus there may be other functions that can collect personal information.

Mass email list

If you have an email list, that’s another place that stores personal information. Could be as little as just an email address. But probably there’s more information gathered about the contact. Plus data about what emails they were sent, which ones they opened, how they responded and so on.

Since people may choose to stop receiving your emails, that list must provide a way to unsubscribe in every email sent out. You must comply and stop emailing people who unsubscribe. As well as ensure that they don’t simply get added back in from someplace else (unless they themselves choose to resubscribe).

Personal information collected in your business/organization

Then there’s the whole business backend:

CRM (Customer relationship management) — the database where you keep track of customers and leads, including all kinds of helpful information about your interaction with them, their favorite color and the dog’s name. CRMs are wonderful for helping build your relationships with customers and potential customers. But that’s a lot of personal information in there.

Bookkeeping and financial processing is another area that contains personal information.

Job files and client records created in the process of doing regular business work. You or I probably don’t have as big and extensive files as a doctor’s office, but it can still add up. And contain a plentitude of personal information tidbits.

The address book for your email service. Which could be almost anybody you ever emailed, even if just once.

The phone book on your mobile phone. For many of us a very eclectic collection of numbers. Many of which are no longer relevant.

Social media accounts

Every social media account you use also involves personal information of your friends/followers. But since the social media platform is the actual holder of that information, rather than you, I’ll not spend much time on it here.

However, if someone requests that you forget them off your system, it might be a good idea to unfriend them or otherwise block them from following you on social media.

Managing that personal information

For a long time we’ve treated all that information as something we owned and could do whatever we wanted with. So you might add someone to your bulk email list without actually getting their permission first. Or you collected any information about anybody that you could dream of for whatever reason.

That was then. This is now. You can’t have missed a large number of privacy scandals. Facebook and Cambridge Analytica. Amazon listening in on your conversations through Alexa. And many, many more. All leading some people to throw up their hands and just say that there is no privacy anymore, so why fight it?

But the fight for privacy isn’t over and there are regulations that we do need to pay attention to:

GDPR

In 2018, the General Data Protection Regulation (GDPR) went into effect in the European Union. The most important change in data privacy regulation in 20 years. The stronger rules mean people have more control over their personal data and how we can use it. One big change is that it made consent much more explicit. We can’t just add someone to an email list and say “They can always opt out if they don’t want to be on there.” Get consent first, then add.

The reason this is a big thing, is that GDPR covers all residents of the EU. Doesn’t matter that your website is outside the EU. If someone from inside the EU interacts with it, you have to handle their personal information in accordance with GDPR. In effect all websites need to be compliant.

CAN-SPAM

Similarly, all websites and mass emailers need to be compliant with the CAN-SPAM act, which is not just about bulk email, but includes all commercial messages. Penalties can be quite severe. So don’t want to cross the line here.

CCPA

In 2020, the California Consumer Privacy Act (CCPA) goes into effect. It enhances privacy rights and consumer protections for residents of California. Again, it doesn’t matter where the website is located. The key is that your visitors are in California.

Dealing with personal data and privacy

I am for privacy protection. Because self-regulation has been proven not to work, we do need regulation in this area. Too many businesses will do anything with personal information if there’s money to be made.

Considering the lists above, do you truly know all the locations in your organization where personal information is stored? If I asked you to remove my information from everywhere in your system tomorrow, could you do so and be sure that you did in fact remove it all?

When working through getting compliant with GDPR, I encountered a range of responses to the new privacy law:

Ignore it. Usually on the notion that “I’m way too small fish. They won’t come after me. So I don’t have to worry.” Interesting take. I assume you take the same approach to paying taxes. How is that working?
Block visitors from countries/states with stricter privacy laws. Intriguing concept. “I will choose not to do business in a particular area, so as not to have to comply with their laws.” Challenge is, how are you going to block those countries? That could easily become more trouble than just getting compliant (and all a sunk cost that isn’t helping the bottom line). — Note that just putting a notice on your website that you won’t deal with customers in a particular area is probably not going to be enough, if your website is found to contain personal information of people from that area.
Comply with applicable laws. Turned out that getting compliant with GDPR wasn’t that complex at the end of the day. My websites now offer different email signup options, depending on where somebody is coming from (using geolocation). There was extra time and cost in setting things up, but I’m now ready to do business in all areas.

The right to be forgotten

One more thing: a feature of GDPR (and as I understand it CCPA) is the right of a person to know what information we store about them and to be forgotten. That’s where it becomes vital to know all the locations on your website and in the business where personal information is collected and stored. We need to be able to tell people what info we collect, why, and what we do with it. Plus we need to be able to remove it if requested. Documenting the fact that we did so.

Display a privacy policy

Your website needs to have key legal documents, for your and your visitors’ protection: Terms of use and Privacy policy (also recommend a Disclaimer document to comply with other regulations). It’s important that you outline what information is collected, why, and how it will be used. Some tools offer basic boiler plate language and encourage you to add your own words to that. Might be cute, but don’t do it. Because you will have no idea if that language covers what a privacy policy really needs to cover to hold up if tested in court.

There are templates from a variety of sources online, that can be customized for your situation. Here’s a link to a package developed by an Intellectual Property lawyer. It is unique as he includes video training to help you understand exactly what the document covers and where and how to personalize it for your business. It’s the set of website legal documents I use on my websites.

Going forward

A website that delivers results will need to collect personal information. That’s part of the relationship we have with our customers. How we handle that information is key in building and maintaining trust.

Be clear about what information is collected.
Know where personal information is stored.
Collect only what is needed.
Keep the information only as long as needed and have a system to purge outdated information.

As the business/website owner, please do take time to understand how various privacy laws affect you. Then make plans for how to manage the personal information in a responsible manner. Because neither you nor I want to be the next headline about a data breach that exposed personal information for a ton of people (or even just a few).

The real benefit of handling our customers’ personal information with care and integrity: We earn their trust. Which means they actually want to do business with us.