“ ORGANIZATIONS FOUND TO BE NON- COMPLIANT COULD RUN THE RISK OF FINES OF UP TO 4 PERCENT OF GLOBAL REVENUE OR € 20 MILLION – WHICHEVER IS HIGHER ”
that while the UK will leave the EU next year , British companies will still have to comply or risk facing infringements and major fines . And while Canada is a great distance away from the bloc , companies here will have to comply if they do business in one of the 28-member states . The new regulation says any business which processes data should be compliant , meaning any Canadian company which uses , stores , manages or collects the data of an EU citizen must comply . As far as data is concerned , names , email addresses , phone numbers , addresses , even personal notes are considered as personal data under the new law . Privacy Commissioner Daniel Therrien said the EU ’ s new privacy regime ' raises the bar ' for Canada following a parliamentary report earlier this year which reviewed the Personal Information Protection and Electronic Documents Act ( PIPEDA ). The report suggested modernizing data protection laws in Canada , which would make any new legislation very similar to the EU standard . The report made a number of suggestions including strengthening requirements for consent to use personal data , the right to withdraw consent and the right to erasure online .
ASK THE EXPERT
John Charlton is a business catalyst with Birmingham-based Bart Dalton Consulting in the UK . He has a thorough understanding of the change in the law and has spent recent months guiding companies from various industries as they embark on a journey to compliancy . He predicts the vape industry will shift focus to niche marketing as a result of the GDPR . “ I think over the last five years consumers have become a little savvier about who they give their email address too and also having multiple email addresses to differentiate between close contacts and businesses . This has meant that the buying of email lists has declined as a method of teaching people . I think over the next couple of years in the vape world , we are going to see a greater use of permission marketing and businesses focussing on their niche consumers who want to hear from those brands .” We asked John if there were any at risk areas in this industry , with the GDPR in mind .
“ The vape industry has always skirted close to the line when it comes to advertising . I think that it is only going to become harder for the industry to reach consumers via traditional channels . The power of social media has already become apparent with fake news and skewing voting results , so even with the advertising channels like Instagram and Snapchat , we may see increased difficulties .” Of course , here in Canada , advertising e-cigarettes on television , radio or billboards may soon become the new norm . John is optimistic about the industry ’ s response rate and that is something he thinks is essential for building engagement levels that maybe didn ’ t exist before . “ The industry is fast to respond to change and new technologies , so I don ' t see the future as bleak . The GDPR has introduced new rules , but most businesses were already working within the previous guidelines . I think that the vape industry will see small groups of more engaged individuals and the social element will play a big part in how vape companies reach new consumers and markets .” For now at least , the GDPR is another item on the to do list for Canadian e-cigarette firms who want to expand across the Atlantic . With the TVPA , TPD and exciting export possibilities ahead , the global industry never seemed so at one .
For more information on doing business in the EU after the GDPR , go to eugdpr . org . For UK-specific information , visit ico . org . uk .
VMC | 57