GDPR/Meeting Notes 2019-01-14

From SOBAC Wiki
< GDPR
Revision as of 20:27, 14 January 2019 by BobJonkman (talk | contribs) (Still more meeting notes)
Jump to navigation Jump to search

GDPR

Date
Monday, 14 January 2019 from 7:00pm to 9:00pm iCal
Meetup Event
https://www.meetup.com/NetSquared-Kitchener-Waterloo/events/255516932/
Location
*** Room 1300 *** -- Conrad Grebel University College, 140 Westmount Rd. N., Waterloo, Ontario Map
Event Announcement
GDPR/Announcement 2019-01-14

Does your Non-Profit organization collect personal data on people? People in Europe? And what is Personal Data anyway? Does your organization have an office in Europe? Store data in Europe? Process data in Europe? What is the General Data Protection Regulation (GDPR)? Does it apply to your organization? What policies does your organization need to have? What technical measures need to be in place? What's the SysAdmin's role in all this? Could a SysAdmin be liable?

Marc Paré will provide us with an overview of the GDPR, and outline some of the concerns for Non-Profit SysAdmins.

--Marc Paré & Bob Jonkman


Resources


Meeting Notes

  • Don't take our words as legal advice!


  • Some websites closed down rather than violate GDPR
  • Each country in EU needs to appoint its own GDPR Commissioner
  • Started last year (25 May 2018)
    • People had several years to comply before 2018
    • But European commission is not yet up-to-speed on everything, still working on enforcement and compliance


  • Personal websites don't fall under GDPR
    • Unless you're selling goods or services to European markets
    • If you don't expect visitors from Europe you should be OK
    • But GDPR exceeds boundaries, even non-European sites need to follow that law


  • Controllers: Collect the data, set standards to determine what data to collect (eg. Google)
  • Processors: Websites that don't necessarily use the data, but collects data from other sites (eg. banner ads)


  • Even temporary receipt of data falls under GDPR
    • KWNPSA site might be under GDPR, WordPress requires cookies
      • Marc has added a cookie disclaimer to https://kwnpsa.ca
      • The cookie form cannot be pre-checked
      • Newsletter subscriptions require double opt-in (subscribe, then confirm)
        • We can no longer add people's names without written permission, or subscribing with an opt-in
        • Marc & Bob gave a demonstration of the Mailman subsription process
    • Fines might be 20,000,000 Euros, or 4% of your profits


  • Could one entity cause trouble for another entity by reporting them to GDPR?
    • Compliance is largely self-adhering
    • Getting a whole website shut down isn't really possible, as long as that entity is responsive to GDPR


  • Is there an agency that reviews incoming complaints, and finds those entities that don't comply?
    • Not really defined, still setting up the framework for that
    • The European Commission will not fine people, but the individual states' Data Protection Agencies do the enforcement
    • Foreign policies affect relationships between all countries, might trigger or be triggered by other events


  • GDPR was an answer to privacy and anti-competitive incidents with Microsoft, Google, Facebook, and Yahoo


  • GDPR provides a clear policy on data collection
    • Gives users a right to see and have corrected the data collected on them
    • Only applies to e-mail (and websites) that affect European users, not e-mail that stays within Canadian borders
      • But Canada has rules of its own, not as strict as GDPR






Back to: GDPR

Retrieved from "https://sobac.com/mediawiki/index.php?title=GDPR/Meeting_Notes_2019-01-14&oldid=2264"