For most Canadian small businesses, the GDPR mattered less than feared and differently than expected: consent with records, contracts with the services handling your data, and a privacy policy that describes what really happens.

Twelve months of the European rules

Tomorrow marks twelve months since the General Data Protection Regulation, the GDPR, took effect across the European Union.

Around the day it took effect, inboxes filled with privacy policy updates and requests to confirm subscriptions. Cookie banners appeared on sites that had never mentioned cookies. Some American news sites simply blocked European readers.

For most Canadian small businesses, the months since have been quiet, not because the rules stopped mattering but because what they ask turned out to be narrower than the fuss suggested.

Narrower, and more specific: a few things done properly rather than a great deal done nervously.

Who it reaches in Canada

The rules reach a business outside Europe when it offers goods or services to people in EU countries, or monitors their behaviour there. Merely being visible to European visitors is not enough.

The fourth catches businesses that sell nothing abroad: following European visitors around the web with advertising can count as monitoring their behaviour.

What was already familiar

Much of this was not new to a business already following Canadian law.

Canada's anti-spam law has required consent for commercial email since 2014, so a clean, consented list was much of the way there. PIPEDA, the federal privacy law, has long let people see what a business holds about them.

What was new was mostly proof and paperwork: consent you can show, contracts with the services that handle data for you, and a privacy notice that says plainly what happens. Those three turned out to be what mattered.

Consent you can show

Consent under the GDPR has to be a clear choice: a box the person ticks, not one ticked for them, beside wording that says what they are agreeing to. Withdrawing it must be as easy as giving it.

The business also has to be able to show it was given: when, how, and what the form said at the time.

Most email services already record the date and source of each sign-up. The gap is usually the website's own forms, where a newsletter box sits on a booking form and nothing records what it said last year.

Not everything needs consent. Details needed to fulfil a booking or order are part of providing the service; consent is for extras such as newsletters.

The services that hold your data

A small business rarely keeps personal information in one place. The newsletter service, the booking system, the online store, analytics and email hosting all handle some of it on the business's behalf.

The rules call these processors and expect a written contract with each, setting out what they may do with the data.

For most services small businesses use, that contract already exists as published terms. Some apply automatically; others must be accepted in the account settings.

A policy that describes your site

The largest fine so far, 50 million euros against Google in France in January, turned on exactly this: privacy information split between several documents, and consent that was not specific enough.

A small business is unlikely to face anything on that scale, but the lesson applies. The policy has to describe what the site actually does, in words a customer can follow.

Templates fail that test in both directions. They list things the business never does, and miss the things it does: the booking system, the Facebook pixel, form entries kept in the website's database for years.

A worked example

A whale-watching company on Vancouver Island takes many summer bookings from Germany, the Netherlands and France, through its website's booking system and German pages added in 2017.

Last May it emailed its whole list asking everybody to opt in again. Most never replied, and six years of subscribers shrank to a fraction.

This spring it looked at what the rules really asked. The newsletter box on the booking form had been ticked by default; it now starts empty, beside a sentence saying what the emails contain.

The email service already kept the date and source of each sign-up, which became the consent record. The booking system's processing terms had never been accepted; that took a minute.

The privacy policy, copied from a template, described a loyalty program the company had never run. The new one names the booking system, the newsletter, analytics and the Facebook pixel, and says how long booking records are kept.

The parts that were overdone

Some of last year's activity was unnecessary, and some did harm.

Re-consent emails went to lists whose consent was already valid, and cost businesses subscribers who were happy to stay but never clicked. Cookie banners multiplied, many describing tracking the site did not do.

And privacy policies grew longer without growing more accurate, which is the opposite of what the rules ask for.

When someone asks what you hold

People in Europe can ask a business what personal information it holds about them, ask for corrections, and in many cases ask for deletion. The answer is due within a month.

Canadians have a similar right of access under PIPEDA, with thirty days to respond, so the request itself is not new.

What makes it hard is not knowing where everything is: form entries in the website's database, the inbox they were emailed to, the newsletter service, the booking system, the spreadsheet somebody exported.

The counter-case

Plenty of Canadian businesses sit outside the European rules altogether.

A trade or clinic serving its own city, with no European customers and no advertising aimed at Europe, answers to Canadian privacy law alone: PIPEDA, or provincial law such as BC's for activity within the province.

Some cases need more than a checklist: health information, large lists, or regular sales into Europe, which can require naming a representative there. Those belong with a privacy lawyer, working alongside whoever builds the forms.

For everyone with European customers, or European visitors they market to: consent you can show, contracts with your processors, and a policy that tells the truth.

The checklist

  1. Decide whether you sell or market to Europe.
  2. Untick any pre-filled boxes on your forms.
  3. Keep a record of each consent and its wording.
  4. Accept the processing terms your services offer.
  5. List where personal information is kept.
  6. Rewrite the policy to match the site.
  7. Set a retention period and keep to it.

Step five is the one the others depend on. Consent records, contracts, policies and requests all assume you know where personal information goes, and most businesses have never written it down.

Checking that policy against the site, line by line, is covered in reading your own privacy policy.

Frequently asked questions

Does the GDPR apply to Canadian businesses?

Only to those offering goods or services to people in EU countries, or monitoring their behaviour there. Being visible to European visitors is not enough by itself.

What turned out to matter most?

Consent the business can show, written contracts with the services that handle personal information for it, and a privacy policy describing what the site actually does.

Does every form need a consent box?

No. Details needed to fulfil a booking or order are part of providing the service. Consent is for extras such as newsletters, and those boxes must start unticked.

What is a data processing agreement?

A contract with a service that handles personal information for you, such as a newsletter or booking system. Most publish standard terms, some accepted in the account settings.

How fast must I answer an access request?

Within a month under the GDPR, and within thirty days under PIPEDA. Knowing where personal information is kept is what makes either deadline easy.

Were last year's re-consent emails necessary?

Often not. Lists with valid consent did not need them, and many businesses lost subscribers who were happy to stay but never clicked to confirm.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Bookings or customers from Europe?

We will map where personal information enters your site and what needs a consent record, a contract or a clearer policy.

Start a Conversation