GDPR/Meeting Notes 2019-01-14 - Revision history

BobJonkman: Moved resources and talking points to Meeting Notes

2019-02-06T23:41:28Z

Moved resources and talking points to Meeting Notes

BobJonkman: Final meeting notes

2019-01-15T02:02:40Z

Final meeting notes

BobJonkman: Still more meeting notes

2019-01-15T01:27:51Z

Still more meeting notes

BobJonkman: More meeting notes

2019-01-15T00:31:25Z

More meeting notes

BobJonkman: Added meeting notes

2019-01-15T00:06:43Z

Added meeting notes

BobJonkman: New page

2018-10-14T01:05:21Z

New page

New page

{{:GDPR}}

==== Resources ====
* [https://www.techsoupcanada.ca/en/directory/vocabulary/13 TechSoup Canada Catalogue]
* [[Wikipedia: General Data Protection Regulation]]



Back to: [[GDPR]]

[[Category:KWNPSA Meeting Notes]]

@@ Line 5: / Line 5: @@
 * [[Wikipedia: General Data Protection Regulation]]
@@ Line 90: / Line 161: @@
 * There are sites with sample policy wording that can be followed.
 ** Do analytics companies like Piwik offer their own sample polices? No, because they could not make it specific enough for all regulations, too much liability
@@ Line 105: / Line 169: @@
 * Ultimate goal is to restore people's confidence in spending money on the Web

← Older revision		Revision as of 02:02, 15 January 2019
Line 57:		Line 57:
	** Only applies to e-mail (and websites) that affect European users, not e-mail that stays within Canadian borders		** Only applies to e-mail (and websites) that affect European users, not e-mail that stays within Canadian borders
	*** But Canada has rules of its own, not as strict as GDPR		*** But Canada has rules of its own, not as strict as GDPR
		+	*** Canadian fines aren't as high, only $100,000
		+	** In the US the only state that's updating its rules is California
		+	*** But other states are expected to follow California
		+
		+
		+	* GDPR rules just make common sense for the user
		+	** For website developers it's more onerous
		+	** Also onerous for those people running secure browsers that clear the cookies allowing cookies...
		+	** Compliance is built into some frameworks like WordPress.
		+	*** But we (KWNPSA) still need to write and publish our policies on cookies and data retention.
		+	*** The current disclaimer text is no longer adequate, even for Canadian rules
		+	*** GDPR and Canadian rules are moving towards requiring encrypted collected data storage
		+	*** Organizations with 250+ employees must have a full-time, certified GDPR Data Protection Officer
		+	**** But there is as yet no framework for this certification
		+	*** Will there be a standard for encryption?
		+	**** Probably as part of the framework for certification
		+	**** All the usual encryption problems apply (decryption in the server, decryption between storage and transmission)
		+	** Political organizations, Charities, and Non-Profits don't have to follow the Canadian PIPEDA regulations for mailing lists
		+	*** But CANSPAM still applies (but there are tools and services to check if your fundraising letters are conformant)
		+
		+
		+	* There are stringent rules about publishing policies, reporting breaches, timeline for reporting breaches
		+	* Organizations that are too small to have a dedicated Data Protection Officer can share one between them
		+
		+
		+	* Marc shows some sites that are GDPR conformant, eg. IBM
		+	** IBM in Germany does not have a cookie popup.
		+	** Shell has a nicer cookie popup than most (small, unobtrusive box at the bottom)
		+	** Volvo has every cookie itemized in their policy (GDPR encourages that, Canada is likely to follow)
		+
		+
		+	* There are sites with sample policy wording that can be followed.
		+	** Do analytics companies like Piwik offer their own sample polices? No, because they could not make it specific enough for all regulations, too much liability
		+
		+
		+
		+
		+
		+
		+
		+
		+
		+	* In Canada:
		+	** PIPEDA is the equivalent of GDPR, updated in November 2018
		+
		+
		+
		+	* Ultimate goal is to restore people's confidence in spending money on the Web
		+

@@ Line 35: / Line 35: @@
 *** Newsletter subscriptions require double opt-in (subscribe, then confirm)
 **** We can no longer add people's names without written permission, or subscribing with an opt-in
 ** Fines might be 20,000,000 Euros, or 4% of your profits
 Back to: [[GDPR]]
 [[Category:KWNPSA Meeting Notes]]

@@ Line 8: / Line 8: @@
 ==== Meeting Notes ====
 ===== Subtopic =====
 * Point