Comments on: The Complete WordPress GDPR Guide: What Does the New Data Regulation Mean for Your Website, Business and Data? https://wpshout.com/complete-wordpress-gdpr-guide/ A hub for advanced WordPress users, developers & savvy business owners. Thu, 10 Nov 2022 07:54:42 +0000 hourly 1 https://wordpress.org/?v=6.4.3 By: Vesna https://wpshout.com/complete-wordpress-gdpr-guide/#comment-13614 Mon, 21 May 2018 11:05:00 +0000 https://wpshout.com/blog/?p=24375#comment-13614 In reply to dejudicibus.

Im EU GDPR certified and was interested in the new regulation from BA point of view. You cannot send emails without an unambiguous consent given by your users. So firstly you must define the purpose for collecting the data and than ask the users to opt in (given by choice) for each segment of the service you wish to offer and opt out which should be mandatory. So the site should clearly state “would you like to receive our newsletter” for ex. You may have users who would be happy to visit the site to comment on it but not to receive newsletter…that’s how it should work. Another ex. the statement of this site “by signing up you agree to the basic rules, Terms of service and privacy policy….is not EU GDPR compliant.

]]>
By: Karen Mas https://wpshout.com/complete-wordpress-gdpr-guide/#comment-13613 Mon, 14 May 2018 06:54:00 +0000 https://wpshout.com/blog/?p=24375#comment-13613 I’ve only just found out about this new GDPR law. I only have a WordPress blog (cookery and handicrafts). It’s not a business, just a hobby. I have very few followers (around 45), even after having set up my blog 4-5yrs ago. Do I also have to advise my followers about this? I don’t think so, but – just in case!
Thanks
Karen

]]>
By: craftycoding https://wpshout.com/complete-wordpress-gdpr-guide/#comment-13612 Tue, 08 May 2018 07:09:00 +0000 https://wpshout.com/blog/?p=24375#comment-13612 Thanks for this article. One thing that’s missing though is this cookie compliance part. I’ve been reading a bit about that and basically shouldn’t we be allowing users to opt-in for cookies too? It seems bloody nuts, but there you have it. There’s a couple of paid plugins cashing in on this as well. I’m just wondering whether it’s really necessary to have big ugly confusing cookie opt-in’s everywhere just because I want to use Analytics.. any thoughts?

]]>
By: Arjun Chatterjee https://wpshout.com/complete-wordpress-gdpr-guide/#comment-13611 Tue, 08 May 2018 04:27:00 +0000 https://wpshout.com/blog/?p=24375#comment-13611 One interesting thing about the GDPR is that it makes running a service using advertising illegal. If you go check article 29 working group, they have guidance on consent. A party is said to not give consent freely when the service they are signing up makes allowing personal advertising a pre-condition. I.e – Facebook now has to introduce a paid service in order to be able to continue with its ad supported free service. I feel that it is a gross intrusion of privacy by the EU and should be contested in court. Essentially, they are saying, a person cannot make a contract with another party to allow them to track their personal data (even if he/she chooses) to gain access to a service or product which is free. This is not about data protection at all, it is about the free availability of information hindering something.

]]>
By: Barbarella Buchner https://wpshout.com/complete-wordpress-gdpr-guide/#comment-13610 Mon, 07 May 2018 14:59:00 +0000 https://wpshout.com/blog/?p=24375#comment-13610 In reply to Kristaps Horns.

But what, for example, if someone had an email like 029893fjkjfka@blah.com? That, in my view, is not something that could identify anyone as an “identifiable natural person”, or could it?

]]>
By: Kristaps Horns https://wpshout.com/complete-wordpress-gdpr-guide/#comment-13608 Mon, 07 May 2018 14:08:00 +0000 https://wpshout.com/blog/?p=24375#comment-13608 In reply to Rising Goat.

“I don’t see how this can qualify as data collection in any manner, Kristaps.”
GDPR art. 4 (1) – ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
GDPR art. 4 (2) – ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

]]>
By: Kristaps Horns https://wpshout.com/complete-wordpress-gdpr-guide/#comment-13607 Mon, 07 May 2018 14:05:00 +0000 https://wpshout.com/blog/?p=24375#comment-13607 In reply to Barbarella Buchner.

While the use cases you both have described are reasonable, there are still a number of genuine reasons why they are not wholly excluded from the scope of the Regulation. At the end of the day you still perform processing of personal information. Please note that this only applies to individuals, and not legal personas or business representatives in their official capacity.
There are 2 general exceptions that would apply, however, they would not completely exclude you from the applicability of GDPR, but would instead change the scope of its applicability.
Under the “legitimate interest” consent exception you can assume that consent is given and that you can lawfully process the email address in order to return a question from your client. It is possible to put most everyday business interactions under the “legitimate interest” basis, but that does not really help you long term when it comes to other concepts under the GDPR.
In terms of processing email with forms and other methods, it is not exactly true, that there is no personal data stored. Even when you forward the data from the form to an SMTP server, it is usually both the server logs (depending on the application, such as WordPress, possibly also application debug logs) and the email infrastructure itself that preserves the personal information for unusually long period of time.
Most of the hacks related to low traffic sites are aimed at this in particular, since most low budget hosting companies will store these files and backups, sometimes for years, and allow full access to all the emails and related information both from logs, backups and other database sources to anyone looking for them.
In essence, it is sometimes not per se negligence, but just bad practices that have flourished over the years due to nobody really caring that this is now quite difficult to come to grasps with.
In short. Processing emails for legitimate reasons is fine, as long as its done properly and with privacy in mind.
Contact forms and naked emails do not automatically exclude you from the GDPR applicability. You should always investigate the procedure, and take the necessary compliance steps.

]]>
By: Barbarella Buchner https://wpshout.com/complete-wordpress-gdpr-guide/#comment-13606 Mon, 07 May 2018 13:24:00 +0000 https://wpshout.com/blog/?p=24375#comment-13606 In reply to Rising Goat.

“1. What if I got rid of all the contact forms and plugins and simply use an email address that people click on to contact someone? Would that qualify as not collecting data?”
I don’t see how this can qualify as data collection in any manner, Kristaps. If I publish my own email address on my site and someone clicks on it or copy it and, then, they send me an email, I am NOT collecting personal information at all. Excuse me but it does nor make sense at all.”
That was exactly my thoughts!!!!! I mean, they are contacting ME, not me contacting THEM. Otherwise, hey, would the law not then need to also extend to your friends (or anyone for that matter) emailing you and you emailing them, if the above scenario is included in the new law?

]]>