Understanding GDPR and the Arts

Over the years the amount of data companies and organisations collect from customers and Internet users has become staggering. There are very few services, products or sites that do not collect some amount of data from their visitors. Combine this with the advent of wearable technologies that collect data constantly, and it becomes clear why data protection has become incredibly important to regulators, customers and organisation alike.

What is GDPR?

GDPR will replace the existing data protection framework under the EU Data Protection Directive, and will apply to all organisations in the UK, Ireland and across the EU. The GDPR emphasises transparency, security and accountability by data controllers, while at the same time standardising, and strengthening the right of European citizens to data privacy. At it's core GDPR is about explicit consent The significant change that GDPR brings is threefold:

1. Customers must give explicit consent to data gathering.
2. Data protection authorities will have more robust powers to tackle non-compliance, including significant administrative fining capabilities of up to €20,000,000 (or 4% of total annual global turnover, whichever is greater) for the most serious infringements.
3. It will be considerably easier for individuals to bring private claims against data controllers when their data privacy has been infringed, and allows lawsuits for compensation even in cases of non-material damage.

What Do Arts Organisations Need to Do to Comply with GDPR?

Build awareness about the change and what GDPR will mean for your organisation, especially the tougher penalties. Make an inventory of the personal data you hold and how it is managed. Consider:

• Why are you holding it?
• How did you obtain it?
• Why was it originally gathered?
• How long will you retain it?
• How secure is it, both in terms of encryption and accessibility?
• Do you ever share it with third parties and on what basis might you do so?

Create a plan for any changes that you need to make in your current process. Under GDPR individuals will be able to request an audit of the information you hold on them, so you will need a clear plan in place to deal with such requests and other GDPR requirements. Your plan needs to include:

1. Who will be responsible for handling GDPR requests? Remember requests must be processed within one month, and must be free of charge to the individual making the request. Individuals have the right to access their data, have inaccuracies corrected, have their information erased and object to direct marketing.
2. What are your procedures for detecting, reporting and investigating a data breech? Who will be responsible? Remember that all breaches must be reported to the DPC or UK equivalent, typically within 72 hours, unless the data was anonymised or encrypted.
3. How is customer consent currently being managed? How do you currently seek, obtain and record consent? What changes do you need to make to this process? Remember under GDPR consent must be freely given, specific, informed and unambiguous. That means they must be completely aware that they are consenting to the processing of their personal data, and know exactly what they are consenting to - there can be no doubt. Silence, pre-ticked boxes or inactivity is not consent.
4. What information do you give individuals prior to processing data? Remember before gathering data, you need to let people know: the legal basis for processing the data, how long you will retain their data, and their right to complaint. And you must communicate all of this in easy to understand language not legalese.

GDPR and Brexit

If you process data about individuals in the context of selling goods or services to citizens in other EU countries then you will need to comply with the GDPR, irrespective as to whether or not the UK retains the GDPR post-Brexit. The UK Government has indicated it will implement an equivalent or alternative legal mechanism. It is expected that any such legislation will largely follow the GDPR. This is supported by the support previously provided to the GDPR by the ICO and UK Government as an effective privacy standard, together with the fact that the GDPR provides a clear baseline against which UK business can seek continued access to the EU digital market.

In Summary

GDPR will become effective in May 2018. In preparation, your organisation should do a data protection audit and develop a plan for change where necessary. Remember:

• Consent is required to be freely given
• Requires positive indication of agreement
• Customer has the right to be forgotten

As new information becomes available we will of course provide updates, but keep in mind compliance with GDPR is the responsibility of the individual organisation. Please contact us if you have further questions, we are happy to offer guidance and assistance.