sportFACHHANDEL 08_2018 Leseprobe

36 | SERVICE | GDPR 8.2018
MISSED THE GDPR?
No cause for panic ...
... but it’s high time that we do something! Because everyone who uses personal data for their business
has to act. But with a concept, sensible tools, and a reasonable expenditure of time, a large part of the new
obligations are rather easy to implement – even now!
Text: Christian Bonk
1
Do you process personal data, e.g. for a customer file with personal data?
The principle of earmarking is valid: You are only permitted to process data
when the specific use of it is certain and documented before processing.
BEWARE OF TRAPS
Many want to earn something
through the GDPR and want
to be paid with fantastic fees
for their, partly questionable
services by referring to their
order situation, and the already
taken affects of GDPR. In
this case caution should be
exercised as much as with
questionable Internet tools
that promise GDPR security
at the touch of a button for
high fees. You are better
advised to soberly begin the
implementation, and initially
implement subprojects under
your own direction. But one
very important indication
cannot be absent: With these
indications you don’t have an
entitlement to legal certainty.
And in any case it is advised
to gather information from a
professional when there are
individual, uncertain aspects.
Such a professional can be
an IT specialist solicitor, data
protection officer, or even an
expert from a professional
association. Nevertheless, it is
valid: When you begin meeting
first requests under your own
direction, you are definitely on
the right path.
2
To do: Make a list of operations and
processes during which personal data is
processed.
Example: Customer file containing shoe sizes,
Purpose: Better and more professional consultation
during a customer’s shoe purchase by knowing
which shoe size ideally fits them.
3
To do: Create a production register: Everything
that has something to do with personal
data is recorded here. You are obliged to keep
this register. You can up on the minimum requirements
of such a register under Art. 30 GDPR.
Example: Customer file for discount campaigns,
List entry: 372 customers are in possession of one
of our customer cards, for which we needed name,
address and age.
4
To do: Ensure that computers or servers are
in a lockable room – and, of course, that it is
locked. You are obliged to create a sufficient
level of protection to sufficiently protect the data you
have gathered. These measures must also be documented.
Keep a register of persons who need to have access
to this room for job purposes. Additionally list whether
the data is saved in a cloud, and ensure sufficient
protection through passwords and certificates.
5
Do you use customer cards?
You are also obliged to document their
purpose, type of use, and extent of saved
customer data. How, and to what extent this is to
1
Do you have a website?
2
To do: The first measure to be taken on your
website is to update the privacy statement. In
order to create it, it is best to get informed on the
Internet. There are countless possibilities ranging from free
to use generators for small businesses up to fee required
services that individually adapt your privacy statement to
the new law.
be achieved can be found in the information
requirements under Art. 13/14 GDPR.
To do: Explicitly document how, for what purpose, and
what personal data you equip your customer cards
with.
6
Do you work in cooperation with
providers?
To do: Check who is using your customer
data in order to fulfil your customer order and create
instructions on how the providers are to deal with the
data. Unconditionally conclude an order management
contract with the providers.
Example: Delivery service for prepared skis via a
local courier service. Make the provider aware of
only being permitted to use the addresses for the
delivery by your order.
7
Do you expect requests by customers?
Many customers are going to be more
attentive due to the introduction of GDPR,
due to extensive rights to information on their data,
the right to restriction of processing of their data,
the right to rectification of their data and the right
to be forgotten. And you should be able to provide
this data at any given moment.
To do: Prepare for requests, and secure the processes in
order to be able to quickly and non-bindingly answer
the customers, and delete data if necessary.
Example: Customer file: Show your customers the
“data set” you have on your computer per request.
3
To do: Another important step is the
so-called AVV contract – you should
immediately update it to the current state
with your provider. Normally, the provider will
approach you, but in case of doubt, rather make an
enquiry, because they are obliged to update the “data
processing relationship” between you and themselves.