Earlier this week I was hanging out at Facebook HQ London (as you do) with a whole lot of small business people and the FB team.  Naturally, conversation turned to GDPR, and we were treated to a session with the FB lawyer.I came out thinking how very very extremely unlikely it was that any of the small businesses I know were ever going to fall foul of this regulation. So here’s my guide on how to get busted – it’s looking like pretty hard work, so dig in.

How To Get Fined For GDPR Non Compliance

   

1. First, annoy your contacts. You can do this pretty easily by buying lists, scraping contacts off the net, or just taking the low road of spamming your own list with stuff they really don’t want to know about.
2. Make sure they can’t unsubscribe (this is trickier because most email sending services won’t let you take the unsub link off – curse them!) If an unsubscribe is there they will just use that and go away, and that’s not going to help you get to the fine.
3. Don’t have a privacy policy on your site, or any way your annoyed contact can let you know they want you to stop with the spammy stuff.
4. Now you’ve got them good and annoyed, you’re halfway there – congrats. If you’ve done this right, they’ll get hold of you somehow and ask you to stop, or tell them what data you have.
5. Ignore them for at least 30 days – be thorough, any move from you at this stage can derail the whole thing, so don’t be tempted to acknowledge them at all.
6. If you’ve kept them annoyed enough, they can now complain to the ICO – now we’re cooking! They will need to fill our forms and submit evidence, so they’d need to be pretty riled at you still. Don’t underestimate the effort required to keep them going at this stage.
7. The ICO don’t really want to deal with SMBs as they have their hands full with big businesses who are being naughty with data, so you’ll have to wait this out. If your contact manages to get their attention, eventually they will send you a notice.  Ignore this too.
8. Keep on ignoring the notices they send you with advice on how to move towards compliance.  If you so much as twitch in the direction of doing what your contact asked you can still blow it and be let off the hook completely.
9. You’re nearly there….  keep waiting, I’m sure they’re coming for you soon, so long as your irritated contact didn’t decide they had better things to do and withdraw the complaint, and you continue to do nothing and ignore all the helpful advice from the ICO. Be patient as this will likely take many months.
10. Congratulations – you might now get fined.

So now, assuming you’re not a spammer, scraper or buyer of dodgy email lists, here are some things you could do at some point so you can rest easy at night, even though it’s really really hard to be bad enough at this to get even close to busted.  

Five GDPR Tips for Sensible Small Businesses

   

• Don’t email anyone telling them they need to re-opt-in. Millions of mails with GDPR or opt-in in the subject line are headed straight to trash all round the world right now, so this would be a crazy and unnecessary move.  If you came by your list by legitimate business means you’re fine and you do not need to tank your hard-won list to the false gods of GDPR myth.
• Put a privacy policy on your site, linked to from the footer. You can link to it from emails too if you like.  It should mention that you email your contacts, and use data for analytics, metrics, profiling and social media ads, assuming you do those things. Profiling gets you covered for lookalike audiences used for ads (if you don’t know what that is, report to me for the Smarter Facebook Ads course because every small business should be using these). Make your privacy policy transparent and readable – it doesn’t need to go into forensic detail, but should act as a way to shape expectations. It should also mention how to ask for a copy of their data, or for removal.
• Know that website cookies (tracking codes from eg. Google Analytics or the Facebook Pixel) are not covered by GDPR but by legislation that’s been in place for ages. So yes, you should have a footer note or link to somewhere that says your site uses cookies, but that’s been the case for a very long time. Notice how no authority has come after you on this point, and apply that thinking to soothe any lingering worry you have over GDPR enforcement. Pop-up cookie bars are not required, and everyone hates them.
• Be responsible with your lists by having a legal basis. This can be consent, or legitimate interest or some other more obscure things. For most small businesses, legitimate interest covers contacts who have previously purchased from you, so that’s nice and easy. You do not have to throw out all your contacts from pre GDPR, or ask them all to opt in again, so long as there was a legitimate interest reason or some consent along the way to how they ended up on your list in the first place. You’re nice businesses, right? So you’ve got this.
• If someone asks what you’ve got on them, then figure out what you have and tell them within 30 days. If someone asks you to leave them alone, then leave them alone. If someone asks you to delete their stuff, then delete it. On which subject, easiest win for not accidentally emailing them ever again is to use the exclusion feature in your email sending service – most have this.
• Finally, I’m not a lawyer. As I mentioned in the video, these tips came from the Facebook legal team. You should, of course, consult with your own legal team (because we’ve all got one of those on retainer).

And please, to make me happy, if you want to act on my tips don’t do it on the bank holiday weekend or late into the night to meet some inflated media-crazed deadline. Go have fun instead. Or come hang out with us in The Design Space Lounge, where we talk all things website design, online marketing and social media ads, and sometimes just about cats.