The GDPR’s requirements around consent for data processing are complex, and we aren’t the only ones thinking about what this means for our business or how to best comply with the regulation. Below, we’ve shared a few links that give some added context around consent as it relates to the GDPR.
How the GDPR will disrupt Google and Facebook
The title says it all. This article speculates on how Google’s and Facebook’s current consent request processes might have to change in order to become compliant with the GDPR’s consent and data use requirements. It lays out a GDPR risk scale, examines where different consent methods fall on this scale, and then evaluates personal data use by Facebook and Google to estimate where those different data uses rank and what changes the tech giants may need to make in order to continue processing this data in a post-GDPR world. The conclusion is that, while much of this personal data processing can be done in a way that is GDPR-compliant, the requirement to obtain consent will disrupt the ability to use data for marketing and advertising purposes. The extent to which this impact will be visible to the average user remains to be seen.
WP29 Guidelines on Consent under Regulation 2016/679
In our GDPR Resources: Whois Changes post, we looked at a letter that the Article 29 Working Party (“WP29”) sent to ICANN; here’s another great publication from the same advisory body, offering guidelines on how consent can be used as the legal basis for data processing under the GDPR. WP29’s interpretation of the GDPR aligns with our own understanding of the consent requirements and serves as a helpful resource for anyone working to create their own consent request processes.
ICANN’s GDPR legal analysis
The second and third memos from Hamilton Advokatbyrå have been published, following the first memo which we discussed in a previous GDPR Resources post. The most recent memo focuses on how the Whois system would need to change to be compliant with the GDPR, and refers to a conclusion drawn in the first memo: although consent would be a possible legal basis for publication of Whois information, it would not result in a fully accessible Whois like we have today, since data subjects will be able to withdraw consent, preventing any “extra” data (which isn’t necessary to providing domain registration services) from being published. Anyone keeping up with GDPR policy will want to keep a close eye on these Hamilton memos and the domain industry’s responses to them.
We’re happy to see that many of the assessments and practices being discussed by other key players in the industry are in line with our own plans for a gated Whois system and revamping of our consent request processes. We want to support our resellers through this transition by providing useful resources and maintaining a high level of transparency about our own GDPR implementation plans. Sign up for GDPR updates to make sure you’re kept in the loop!
Learn more about the GDPR:
GDPR Updates – Understand Enom’s approach to the policy
- GDPR-Related Contract Changes (Published on Mar. 5, 2018)
- The GDPR’s Right to Be Forgotten (Published on Jan. 18, 2018)
- Consent and the GDPR (Published on Dec. 21, 2017)
- How will the GDPR impact Whois? (Published on Nov. 9, 2017)
- The GDPR Overview (Published on Oct. 30, 2017)
GDPR Resources – View third-party resources on a specific GDPR topic
- Right-to-be-forgotten-related resources (Published on Feb. 1, 2018)
- Whois-related resources (Published on Dec. 7, 2017)
- GDPR Basics & Best Practices Resources (Published on Nov. 9, 2017)