Who can manage customers personal information

Neither here, GDPR does not impose strict limits, but requires from the operators – in our case the online stores – to provide organizational and technical measures for personal data protection to make sure that data is used for legitimate purposes only. This refers to any natural or legal person that process the data collected by the operator.

So, we refer to:

• online store staff
• any service provider outside the store that has access to the data collected by the store (called by law “authorized”)

What are the obligations of online store employees when they are processing data? 

For employees, the online store should both oblige them to respect the purpose for which data is processed and their confidentiality, but also to instruct them on why it is important to do so.

Personal data can be processed according to the conditions provided in art. 6 of GDPR:

• consent
• execution of a contract to which the data subject is a part of or to take action at the request of the data subject prior to the conclusion of a contract
• fulfilling a legal obligation of the operator
• protecting the vital interests of the target person or other individual
• performing a task that is in the public interest or resulting from the exercise of the public authority with which the operator is invested
• legitimate interest

What happens to the data processed for marketing

Of all the above-mentioned legal conditions, the most secure one in online marketing is consent (agreement), which, very importantly, must be a clear and free action of the user.

The only exception could be the use of “legitimate interest”, but online stores should know that legitimate interest must be proven and balanced with users’ rights. This depends very much on the level of intrusion into the private life of the type of marketing used: one is to send a newsletter per month to a former client and it is quite another thing to analyze each of his / hers move on the site.

In order to establish the correctness of the “legitimate interest” invocation, a detailed analysis should be made, analysis that starts from the collected data and its purpose and reaches the user rights, to determine if the legitimate interest can indeed be considered as a legal basis in that specific case. This is not necessarily a simple thing to be done, so the recommendation for online stores that do not have the necessary expertise is use consent as a legal basis.

Where the data is stored

Storage is less important. The law requires only that this storage to meet the appropriate security conditions. This includes hosting data in a country that has a proper protection regime – the European Union or other states where this level is recognized, including US firms.