A website currently serves as a company's business card and has significant marketing significance. While it often collects personal data, the administrator who collects it isn't always properly prepared. GDPR regulations outline the basic guidelines that must be followed to ensure data processing is lawful.
A personal data controller is responsible for fulfilling the obligation to provide information to all data subjects. How is this most often accomplished? Primarily through a Privacy Policy or Information Clause, which contain the basic information listed in Article 13 of the GDPR. These documents should include: the controller's contact details, the purpose and legal basis for processing, information about the recipients of the data, the duration of processing, and information about the rights of the data subjects. Where applicable, we also provide information on automated decision-making or data transfer to a third country within the meaning of the GDPR.
These documents should be placed on every subpage of the website, as well as in every place where personal data is collected, including, among others, the contact form. If the website offers users the use of the administrator's services that involve the collection of personal data (e.g., placing an order), then the clause must include detailed information about the data being processed. When creating forms, it's worth remembering the principle of data minimization, which involves collecting only the data necessary for the purpose being pursued – most often, providing your name and email address will suffice. The issue of checkboxes, i.e., boxes allowing consent to data processing, is also important – these should be closely linked to the principle of accountability.
Data controllers who process data beyond the scope indicated above, for example, by sending newsletters, messages, and promotional offers, must consider the need to comply with the information obligation to a greater extent. Furthermore, if data processing is based on consent, the data subject must be informed of the possibility of withdrawing consent, which must be as easy as providing it.
Regarding cookies, they are small files containing information about a website, which are then transmitted and stored in the memory of the user's browser/device. Identifying browser and device characteristics may be necessary for the website to open and function properly.
The GDPR focuses on the protection of personal data, meaning data that can be used to identify a specific individual. Due to their analytical or statistical function, cookies do not collect personally identifiable information; they only provide information about their preferences related to the service provided. However, it is worth considering implementing a cookie policy, especially if we collect cookies beyond those required for the proper functioning of the website.
Analyzing a website's compliance with data protection regulations is closely linked to the tasks it is expected to fulfill. A simple website administrator has different responsibilities than an online store owner. Due to the prestige and security of data, data leakage or loss cannot be allowed, therefore, all organizational and technical measures should comply with the latest IT requirements and knowledge. An appropriate approach to data protection also builds trust with customers and potential partners, confirming the professionalism of the services provided by the data administrator.
The author of the article is the Data Protection Inspector.
