Digital Impact's Heather Noelle Robinson and Chris Delatorre call on the responsible data community to reflect on the first 12 months of the GDPR.
Digital Impact 4Q4 Podcast: GDPR One Year Later, Part 1
SUBSCRIBE TO THIS PODCAST ON iTUNES.
00:00 CHRIS DELATORRE: This is Digital impact. I’m Chris Delatorre.
HEATHER NOELLE ROBINSON: And I’m Heather Noelle Robinson.
CHRIS DELATORRE: And we’re bringing you a special miniseries on the GDPR. One year after the EU General Data Protection Regulation – or GDPR – went into effect, we wanted to know – how has the regulatory landscape of data privacy and protection changed? How are organizations responding?
HEATHER NOELLE ROBINSON: And what might be in store for the future of data collection and privacy.
CHRIS DELATORRE: So, look for a few short episodes in your feed over the next few days.
HEATHER NOELLE ROBINSON: Let’s start with the basics. Chris, can you introduce us to the GDPR and what it does?
00:39 CHRIS DELATORRE: The GDPR went into effect on May 25th 2018. The regulation mandates a baseline set of standards for organizations that handle the data of persons residing in the European Union. It requires organizations to protect the personal data and privacy of EU residents. And this goes for organizations that operate inside and outside the EU.
HEATHER NOELLE ROBINSON: And why did the EU put this law into place? What’s the big picture goal?
CHRIS DELATORRE: Well, the main aim of the regulation is to better safeguard the processing and movement of personal data. If you think back about a year ago, you may have noticed a lot of pop-ups and banners on websites asking you to opt in to their privacy policies. That’s theGDPR at work.
HEATHER NOELLE ROBINSON: So opting in to data collection (as opposed to opting out) is a feature of the GDPR. But it’s a lot more than that.
CHRIS DELATORRE: Absolutely. One of our partner organizations, The Engine Room, describes the GDPR as “a promising step in the direction of taking a rights-based approach to working with data.”
HEATHER NOELLE ROBINSON: And this is in line with your values if you’re a people-driven organization, and your mission relies on collecting, sharing, and protecting data.
CHRIS DELATORRE: As our very own Lucy Bernholz outlined before the new law went into effect, the GDPR provides a framework and a set of user-centered guidelines about data that may just align with that mission.
02:01 HEATHER NOELLE ROBINSON: But Chris, we’re in America (specifically at Stanford in northern California- Go cardinal) – so why should we care?
CHRIS DELATORRE: Well, again, the regulation applies to organizations operating inside and outside the EU. And it protects everyone residing in the European Union – even non-citizens. Since most data collection nowadays happens online, the GDPR applies to nonprofits here in the United States and to NGOs working abroad.
HEATHER NOELLE ROBINSON: Right, so if I got a job in Paris, and I was living there – but I visited the website of a nonprofit in the United States, like to give a donation to a food bank in the town where I grew up, then the GDPR would apply to me.
CHRIS DELATORRE: And more importantly, it would apply to that nonprofit’s collection of your data – like your name, credit card information, address, and any cookies their website uses to track you around the internet.
HEATHER NOELLE ROBINSON: Alright, now that we’ve got the basics, let’s hear from the experts.
CHRIS DELATORRE: There was a lot of fear and uncertainty about the GDPR, especially in the social sector, as it was going into effect a year ago. Here we have Bryan Breckenridge of Box.org talking about the response from their audience.
03:15 BRYAN BRECKENRIDGE: GDPR readiness is something we’ve prioritized at Box, so when we were putting out content about that, we literally got more traffic to our blog and to our websites than when we covered when Beyonce released her secret album on her website using Box. So GDPR was literally more popular as a topic for our community than when we helped Beyone get her secret album off her website and out into the public, years in advance of that.
HEATHER NOELLE ROBINSON: I love that! The GDPR is more popular than Beyonce.
CHRIS DELATORRE: But it’s different than Beyonce, obviously – the response Bryan describes gives us an idea of the anxiety throughout the social sector. A lot of organizations were worried about compliance, understanding the law, and how to build the expertise on their teams to respond to it.
HEATHER NOELLE ROBINSON: What about an example of a specific nonprofit and what they did to prepare for the GDPR?
CHRIS DELATORRE: I talked to Jeff Warren at Public Lab about how his small team is dealing with this massive shift. Here he describes how they evaluated their current data collection, and how consent plays into that.
04:22 JEFF WARREN: And so for us it was really complicated to look at every decision point, every uh moment where someone would consent to something very activity the way that the GDPR rightly demands. And the privacy policies are a cornerstone of that. In fact, you could bake a lot of what your site does and how you approach it and what you’re disclosing and what you’re asking people to consent to into the privacy policy. We don’t have a legal team in house, you know. So what are we going to do? Google, Facebook, all these big entities probably had hundreds of people working on GDPR around the clock for a year or two leading into that. We’re a staff of like, you know, less than 10 people. So, I think that’s one thing that stands out with GDPR is that it’s intended to have the biggest effect on entities like Google and Facebook and Apple, but – and Amazon. But it does also affect everyone else. And it does it proportionally, they wrote that into it.
CHRIS DELATORRE: At Public Lab, they’re collecting a lot more than someone’s name and email address – they work on citizen science projects.
HEATHER NOELLE ROBINSON: And science can’t exist without data!
CHRIS DELATORRE: So they have contributors from around the world, constantly uploading new data, and that data could be anything from geographical data, to personally identifying data, to the story of a particular environmental concern within a specific community. So the GDPR would affect the most important aspects of that data collection.
HEATHER NOELLE ROBINSON: Jeff also makes some important points in that clip – especially that GDPR was intended to create consequences (like fines) for big companies, but it’s written in such a way that everyone has to comply.
CHRIS DELATORRE: A lot of small organizations are feeling the impact of that. And there are a few other things about it that make it less than perfect.
Digital Impact’s Lucy Bernholz sees the GDPR as a framework that may align with your mission.
HEATHER NOELLE ROBINSON: Let’s listen to what Tris Lumly at New Philanthropy Capital says about GDPR, and whether it’s effective.
06:20 TRIS LUMLEY: So I think GDPR is a good thing, in theory. As we’re interested in strengthening people’s rights and it’s a set legislation focused on individuals’ rights. But I think I’m not sure it’s achieved any of its kind of deeper purpose, certainly yet. I think the main changes that you’ve seen in the nonprofit sector are: A. everyone freaking out for a while and all boards having a session about data – “ah, data!” – purely about compliance. So, I’ll come back to that because it’s been about compliance, it’s not been about the opportunity of data. So, freaking out about that, and then the result being that everyone’s got a much smaller reach.
07:11 HEATHER NOELLE ROBINSON: What Tris means by social sector organizations having less reach is that many people have dropped off of email marketing lists (for example), or donor lists, or simply unsubscribed from everything when a nonprofit suddenly asked them for consent to collect their data.
CHRIS DELATORRE: Which is what all those pop ups were about. Like we said, the regulation isn’t perfect. But it’s a start.
HEATHER NOELLE ROBINSON: So quick recap.
CHRIS DELATORRE: The GDPR intended to give individual people more control over their data, while holding big companies accountable with consequences like fines.
HEATHER NOELLE ROBINSON: But social sector organizations have had to change their operations to comply with the law. And many small groups have struggled with the capacity and expertise to comply.
CHRIS DELATORRE: Next time, we’ll go deeper into that very issue. On the one hand, compliance has been a challenge for social sector organizations.
HEATHER NOELLE ROBINSON: On the other hand, doing a full audit of your data practices and consent policies can be a really good thing – an opportunity to make sure you’re handling data responsibly.
CHRIS DELATORRE: Thank you, Heather.
HEATHER NOELLE ROBINSON: Thank you, Chris.
CHRIS DELATORRE: And a special thanks to Bryan Breckenridge at Box.org, Jeff Warren at Public Lab, and Tris Lumley at New Philanthropy Capital. Thanks for joining us, we’ll see you next time on the Digital Impact podcast.
Digital Impact is a program of the Digital Civil Society Lab at the Stanford Center on Philanthropy and Civil Society. Follow this and other episodes at digitalimpact.io and on Twitter @dgtlimpact with #4Q4Data.