What should online stores be careful about in order not to risking fines after GDPR enters into force

To avoid fines, the online stores must:

• To restrict access to customer data only for employees who need those data to perform their service tasks.
• To ensure that the data collected has a clear purpose and is not used for any other purpose.

• For a company that owns two different online stores, the data collected cannot be “shared”, because the purpose of the collection was different. Purchasing from Magazin1.ro is different from buying from Magazin2.ro. Equally different is the marketing of the two online stores.
• To have a register of records that takes account of data processing activities as their activity is not occasional.
• To ensure that third parties with whom they work are in the EU, the European Economic Area or in other states with adequate regimes and that they ensure the security of data; third party means any operator, tool, plug-in or other technical tools that use or collect personal data, including Facebook Pixel.
• To inform their customers on the check-out page about the use of the data they provide (billing and delivery data), as customer information on collected data is mandatory from the time of data collection.
• To delete data at client’s request, if the claim has a legal basis, whether by overwriting or deleting, as long as the process is irreversible.
• For large businesses that perform “regular and systematic monitoring”, the DPO (Data Protection Officer) role existing within the company is mandatory.

For online stores that already apply a good practice of using and storing personal data, they need to know that there is no need to repeat the procedures after May 25, 2018, when the GDPR application period began. For example, for subscribers to the newsletter (commercial e-mails), it is not necessary to reconsider their consent if it has been obtained correctly in advance.