Overview

Relicus Group Inc. (“ SMARTFIELDFORMS“) is committed to maintaining the privacy of nonpublic personal information that is provided to us by our Customers, and of course, we conform to all applicable laws intended to protect such data, including the General Data Protection Regulation (GDPR).

What is GDPR?

“GDPR” stands for the European Union’s General Data Protection Regulation. It replaces the Data Protection Directive. The purpose of GDPR is to ensure appropriate protection of personal data in a digital society. GDPR, like the Data Protection Directive before it, finds its roots in Article 8(1) of the Charter of Fundamental Rights of the European Union, which echoes Article 12 of the Universal.

Declaration on Human Rights adopted by the UN General Assembly in 1948, and Article 16(1) of the Treaty on the Functioning of the European Union, pursuant to which “everyone has the right to protection of personal data concerning him or her.” Though GDPR was adopted in 2016, it does become enforceable on May 25, 2018.

This regulation affects all businesses who are established in the EU, control or process data of data subject(s) who are EU natives. Essentially, almost all businesses working with personal data will be affected by it.

What are my main responsibilities under GDPR?

Your responsibilities under GDPR will depend on the nature of your business and your personal data processing activities. Nonetheless, broadly speaking, GDPR requires that personal data be:

• Processed lawfully, fairly and in a transparent manner
• Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes
• Adequate, relevant, and limited to what is necessary for achieving those purposes
• Accurate and kept up to date
• Stored no longer than necessary to achieve the purposes for which it was collected
• Properly secured against accidental loss, destruction or damage

Further, GDPR places additional obligations on companies to document their processing activities and be able to demonstrate their compliance with the above principles.  It also codifies the requirement that companies apply data protection by design and by default when developing and designing processes, products and systems.

In addition, if you use service providers to process personal data on your behalf, you will need to ensure that you have an appropriate contract in place that ensures that they are obligated to apply GDPR’s data processing standards. Similarly, if you are transferring EU personal data outside the EU, you may only do so if it is being transferred to a country deemed by the EU Commission to have adequate data processing regulations.  For transfers to countries not deemed adequate, you must ensure appropriate alternative safeguards are in place.  Currently, under the Directive, approved transfer safeguards include the EU-US Privacy Shield and standard contractual clauses.

Depending on the nature of your business and your personal data processing activities there are various other GDPR obligations that may apply.  You should consult with a qualified privacy professional to understand how GDPR applies to your specific business.

What “personal data” means under the GDPR?

Personal data means data that relates to an identified or identifiable natural person (aka “data subject”). An identifiable data subject is someone who can be identified, directly or indirectly, such as by reference to an identifier like a name, an ID number, location data, an online identifier or to one or more more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Importantly, this is a very broad definition and can encompass data like IP addresses of a user’s personal device, their device ID, or their phone number.  It does not matter that the identifier could change (e.g., that the user could change their phone number or device ID). What matters is that the information can be used to “pick that user out of the crowd” even if you don’t know who that user is.

It is also important to note that the definition of personal data is not tied to concerns about identity theft the way that definitions of personally identifying information (PII) are under many US data breach laws.  So, even if it seems like there would be little privacy harm if someone got ahold of your users’ IP addresses, that does not mean that those IP addresses are not personal data.  It just means that this data may not require the same level of data protection as more sensitive personal data like your users’ credit card numbers.

When GDPR does not apply?

GDPR has broad scope and reach.  That said, it is not unlimited.  So, if you do not have an establishment in the Union and you do not process personal data of EU individuals, GDPR will not apply to your activities.   If you do not know whether you process EU personal data, then you should consider whether you are offering any goods and services (even free ones) to individuals in the EU or if you’re monitoring the behavior of individuals in the EU.  If so, then you are subject to GDPR.  Recital 23 of GDPR does indicate that GDPR is not intended to apply to entities that may inadvertently process EU personal data, but are not trying to provide their goods or services to people in the EU.

Legal Communication

SmartFieldForms Data Protection officer: Donatas Kairys, donatas@smartfieldforms.com

For all other or legal communication not related to privacy and security questions please contact us at info@smartfieldforms.com

Your GDPR Rights and Requests Forms