Preparing for the GDPR (EU Privacy Regulations)
Rosemary O'Neill
Crowdstack
❤️
-
Blog Post CommentHi Ted, I'm guessing this is not possible, but it would be great if we could use Circles to apply the GDPR settings only to members to whom it applies. As it stands, we're telling clients in Europe that they will have to drop membership if they want these features, because we are not willing to enable these restrictions for everyone when less than 1% of our clients are in Europe. If we had the ability to have a Europe Circle, and only enable this for them, that would be ideal. Thanks, Mary
-
Blog Post CommentHi @MHK@CS2 , there's currently no way to set permissions up or use recipes as you've described. I'm not a lawyer, but I'm not even sure that approach would work from a GDPR perspective. You would technically need to identify members by first collecting some information about them in order to determine whether to give them the "GDPR treatment" or not. I'm not sure that would pass muster. It's definitely an interesting idea, so you could always suggest it separately in the support section of...
-
Blog Post CommentHi Brian, I understand what you're saying. We're in a different situation than most of your clients, I believe. Our community is 100% business related; all members are paying clients and they engage us to provide jurisdiction-specific regulatory information. Members cannot join our community on their own - they have to execute a contract for our services first, which includes agreeing to our terms of use of the community. Our members are chief compliance officers of (highly regulated)...
-
Blog Post CommentMy best recommendation would be to consult a lawyer about what your GDPR requirements are. If you are not doing business in the EU or directly marketing to users in the EU, you may not need to comply. You also might consider your specific workflow. If these users are doing direct business with you, you could make it clear in your separate onboarding / contracting process that their personal information will need to be used in your internal system (Hoop.la) as a contingency of being a...
-
Blog Post CommentAgreed - we are working with a law firm on this. If they have anything interesting to add I will let you know!
-
Blog Post Comment#3 "request deletion of all of their content by the admin" is a problem for message threads where a user's content is critical to the rest of the user's messages in that thread. They should not have the right to ruin other people's contributions if their post is important or replied to. What I would suggest is that they have the right to remove their NAME from posted content, not the content itself, in order to make their content anonymous. At our 'lesson' content site, we view all posts as...
-
Blog Post CommentExcellent! Thank you. > On Mar 27, 2018, at 4:59 AM, Social Strata < [email protected] > wrote: > >
-
Blog Post CommentThat item is a "request" by the member for the admin to delete their content. You can refuse to delete their content, if you feel it's within your rights. We're just providing the mechanism that will support compliance with GDPR; what you choose to do with it is your decision as the owner/admin. Unfortunately, when technological solutions are legislated, they don't always think of the consequences for all scenarios. Sadly, online communities were not really given deep consideration when...
-
Blog Post CommentHi Rosemary, will Social Strata be adding a feature for people to opt-in to emails? Our CRM is adding this feature so we can be compliant with GDPR.
-
Blog Post CommentHi @Lynda ! We aren't currently planning on making any changes to the notification system in Hoop.la as part of the upcoming GDPR changes. I'm not aware of any specific requirements in GDPR related to email delivery or opt-in. Here's the list of the key changes being introduced by GDPR: https://www.eugdpr.org/key-changes.html Hope that helps!
-
Blog Post CommentHi @Brian Lenz thanks for getting back to me so quickly. The issue I'm talking about is the consent provision. From what I understand, GDPR is the oppposite of CAN-SPAM - meaning people need to give a specific opt in (unless the use qualifies as legitimate use) rather than opt out. Right now on the registration form there's no specific way people can opt in to receive communications, is there?
-
Blog Post Comment@Lynda , I don't see GDPR as being related to CAN-SPAM. GDPR deals with privacy and processing of personal data. Part of that is the consent provision you mentioned, but that's about consent to collection of personal data, not specifically related to communications/email. With the GDPR updates to Hoop.la, you will have the ability to put a description (optionally) on any profile field so that you can give clear purpose as to why each field is being collected. You're right that there is no...
-
Blog Post Comment@Brian Lenz Actually GDPR is the exact opposite of CAN-SPAM; it's not related at all! We've been following CAN-spam using what you describe below as our guidepost but I've sat in on sessions with attorneys who are saying we need to get explicit opt-in from people in order to email them with GDPR if we are collecting their data. Our CRM has offered an automatic feature to comply with this requirement, that is why I am asking. And it's due to the consent provision of GDPR. I can DM you the...
-
Blog Post CommentI see, @Lynda . We currently don't have any plans to add such a tool, as we aren't aware of GDPR requirements relating to email communication. We can certainly discuss a possible customization if that's of interest to you. Perhaps we should take this conversation to our support channel so we can discuss options, customizations, etc. in private.