Sometimes I think someone thinks I'm something or other

RE: Sometimes I think someone thinks I'm something or other

Martin Atkinson — Tue, 03 Apr 2018 16:34:58 GMT

[quote user="Bob Russell"]i will be keeping a close eye on our PMS providers as that potentially may be the weak link in any practice.[/quote]I agree and also your credit card processor and HMRC/staff pension provider as they hold staff data. They should all have revised terms in their contracts with a statement that they are GDPR compliant and protecting your data.

We don't have a telephone recording system or CCTV. PMS systems should be logged off if any unauthorised person is left unaccompanied near a computer and staff passwords should be unique and changed frequently and bits of paper with personal details should be destroyed or locked away securely. Wipe your emails with any client details apart from the most recent ones that you still need. Make sure all the staff understand these precautions and record the meetings in which you discussed all the requirements and 99% of us should be fine.

RE: Sometimes I think someone thinks I'm something or other

Martin Atkinson — Tue, 03 Apr 2018 16:25:25 GMT

[quote user="robloxley"]I'm not sure 'anything' that relates to a pet could be a legitimate interest, I think you might want to be more specific[/quote]I think the words you missed out 'relating to the welfare of their pet' then anything is pretty well what it says: vaccine reminders, worm/flea products, diets, well pet testing, grooming, catteries/kennels, hydrotherapy etc etc. At the GDPR session at Snowscene Andrew Rastall suggested all these things were OK but as an example suggested that if you started promoting car sales to take the pet to the vet that would have crossed a line.

RE: Sometimes I think someone thinks I'm something or other

rhmrcvs — Thu, 29 Mar 2018 16:28:12 GMT

Look at article in in practice. Newsletter and vax amnesty does come under legit use. Don't need consent as is relevant info ,.

RE: Sometimes I think someone thinks I'm something or other

Bob Russell — Thu, 29 Mar 2018 15:48:32 GMT

Legitimate interests should prove to be the key phrase rather than relying on consent. Marketing should come within this category and this should include newsletters etc.

The key threat to any business is likely to come from legal action by a client/member of staff etc where data has been lost especially where there has been financial or other loss as a result.

We keep almost no data on bank accounts and actually spent a few minutes deleting payment details for the few clients set up for bank transfers (us to them) as there is no reason for us to keep them.

i am sure a consultant would find things that did not comply but my approach has been more risk based. Do we need the data? If we do is it safe from prying eyes? If not how do we make it safer?

I am not willing to spend a lot of money on consultants as they do seem to complicate matters to keep them in a job. Our action plans may not be perfectly documented but it will have been reasonably thought through.

I accept that certain risk are being taken but the ICO is really going to have more than enough on their plate without tackling small businesses.

i will be keeping a close eye on our PMS providers as that potentially may be the weak link in any practice.

RE: Sometimes I think someone thinks I'm something or other

Rob Loxley — Wed, 28 Mar 2018 13:44:01 GMT

[quote user="Martin Atkinson"]Existing clients have shown a 'previous intention to purchase' so anything that relates to the pet is considered a legitimate interest[/quote]

I'm not sure 'anything' that relates to a pet could be a legitimate interest, I think you might want to be more specific

[quote user="Martin Atkinson"]you can continue to send reminders/promotions without their further consent[/quote]

The ico says "You can rely on legitimate interests for marketing activities if you can show that how you use people’s data is proportionate, has a minimal privacy impact, and people would not be surprised or likely to object – but only if you don’t need consent under PECR. See our Guide to PECR for more on when you need consent for electronic marketing." https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/

RE: Sometimes I think someone thinks I'm something or other

Wren — Wed, 28 Mar 2018 11:57:30 GMT

[quote user="Martin Atkinson"]This is how I understand the situation. Existing clients have shown a 'previous intention to purchase' so anything that relates to the pet is considered a legitimate interest and you can continue to send reminders/promotions without their further consent but you should give them the opportunity to modify their contact preferences. All new clients should be given the opportunity to opt out of these. [/quote]

That's interesting as quite different from the view of the legal advisor quoted in the VR!

RE: Sometimes I think someone thinks I'm something or other

Martin Atkinson — Wed, 28 Mar 2018 09:41:30 GMT

[quote user="robloxley"]as long as you target this to clients with pets for whom this is relevant, you could argue a legitimate interest[/quote]This is how I understand the situation. Existing clients have shown a 'previous intention to purchase' so anything that relates to the pet is considered a legitimate interest and you can continue to send reminders/promotions without their further consent but you should give them the opportunity to modify their contact preferences. All new clients should be given the opportunity to opt out of these.

RE: Sometimes I think someone thinks I'm something or other

Rob Loxley — Wed, 28 Mar 2018 08:40:02 GMT

[quote user="Wren"]publicising vaccination amnesties[/quote]

as long as you target this to clients with pets for whom this is relevant, you could argue a legitimate interest

As far as what you can argue under legitimate interests, there are no hard and fast rules (as far as I can see) and it comes down to what you feel, and ultimately whether anyone will complain and therefore challenge this?

RE: Sometimes I think someone thinks I'm something or other

Wren — Wed, 28 Mar 2018 08:20:51 GMT

Has anyone come across a solution to being able to send out email newsletters? I have an article from the Vet Record written by a legal expert who says that using email addresses for the purposes of vaccination reminders and sending blood results etc. would be considered to be in the client's legitimate interest, but this would not be acceptable for newsletters or things like publicising vaccination amnesties.

It's giving us a bit of a headache as it appears that to send newsletters by email we need consent from each client which must be opt in, rather than opt out, 'unambiguous, unbundled from other terms and conditions, unqualified and trackable'. The task of obtaining this from each and every client on our database is mammoth!

RE: Sometimes I think someone thinks I'm something or other

Arlo Guthrie — Tue, 27 Mar 2018 18:54:25 GMT

[quote user="Bob Russell"]I am rather working on the assumption that the advisers and consultants will make a very big thing of not much just as they do about H&S.[/quote]

The problem is that the more time advisers and consultants spend advising and consulting, the more money they make. Plus they have to cover their derrieres. Both reasons why they will make a bigger thing of it than might be absolutely necessary.

That said, I have been reviewing our own GDPR compliance. Luckily, we hold relatively little data. None of it falls into the super-sensitive categories. And we've never done anything dodgy with it, like sell it on to third parties, or tracking people's behaviour online, or profiling or anything like that. So it's probably an easier task for us than most.

Still, I have to disagree with:

[quote user="Bob Russell"]It should not be onerous[/quote]

There's a new requirement to document all data use, which even for a simple company like mine takes a few hours. Then there are new contracts to be signed between data controllers and any subcontractors. A review of privacy and cookie policies. A review of data security. And so on and so forth. It's quite a lot of work.

RE: Sometimes I think someone thinks I'm something or other

Bob Russell — Tue, 27 Mar 2018 17:50:33 GMT

I am rather working on the assumption that the advisers and consultants will make a very big thing of not much just as they do about H&S.

It should not be onerous and making sure peoples information is kept secure and handled with care should protect us adequately. Also to respect client wishes if they don't want to be contacted in a particular way or even at all.

If it is more than this then the rules are wrong!

Big companies might have a lot more data but the same follows for them.

Hysteria will keep the 'experts' in work for years to come I am sure.

RE: Sometimes I think someone thinks I'm something or other

Martin Atkinson — Tue, 27 Mar 2018 17:14:27 GMT

[quote user="Chris Geddes"]

Perhaps they believe (rightly or wrongly) that they need to go through this exercise to comply with GDPR?

I feel the need to point out that it wasn't me who one starred you!

[/quote]Having previously been rather Ostrich like in my approach to GDPR, since I went to Snowscene the week before last and one of the lectures was on GDPR I realise that although its not s onerous as some may fear, there is an obligation on all of us to make sure data we hold is correct and clear. Maybe Chris has a point.

RE: Sometimes I think someone thinks I'm something or other

Arlo Guthrie — Tue, 27 Mar 2018 17:04:59 GMT

Which contact details could you check when you logged in? Was it just your email address? Or could you update a physical address and/or telephone number?

RE: Sometimes I think someone thinks I'm something or other

Chris Geddes — Tue, 27 Mar 2018 15:58:24 GMT

Perhaps they believe (rightly or wrongly) that they need to go through this exercise to comply with GDPR?

I feel the need to point out that it wasn't me who one starred you!

RE: Sometimes I think someone thinks I'm something or other

ell — Tue, 27 Mar 2018 15:24:59 GMT

Just love your reply to them