GDPR Tag Audit Process

The materials are provided AS IS without any warranty and InfoTrust, LLC disclaims all warranties, express and implied, regarding these materials. The information contained in these materials was prepared for general informational purposes and it is not intended to provide legal advice. Before applying any of the information to your situation, you should consult your legal advisors.

The first step to ensuring all of the digital marketing and advertising platforms running on your site are GDPR compliant is to understand what digital marketing and advertising platforms are actually running on your site. In the modern technology ecosystem this can be difficult due to the practice of tag piggybacking.

Tag piggybacking can pose a major problem when it comes to GDPR compliance because, for many organizations, they are not even aware of this happening in many places on their site. While ignorance can be bliss, ignorance can also mean violations within the context of GDPR.

For this reason, it is of utmost importance to understand all of the tag behavior on your site, be that tags loading directly from your source code, tags loading through your Tag Management System, or tags piggybacking and loading through other third parties you have implemented on your site.

To start this process, use a tool like Tag Inspector to create an inventory of all the tags/pixels loading and collecting information about your users.

A Tag Inventory should include the following:

The Tag Inventory provides the basis and guide for the following steps in our GDPR Compliance Audit.

Step Two of our GDPR Compliance Audit will be to go through all of the tags found in the inventory and identify the internal (and external) stakeholders that are responsible for each platform. Stakeholder mapping will allow you to assign “owners” for each tag and understand the people you will need to enlist to ensure compliance.

This is also a great opportunity to identify platforms that are no longer in use on your site and do a general tag cleanup. Under GDPR, the first of the 6 Principles is that Personal Data should be collected for a specific, legitimate purpose. If a platform is no longer in use but still collecting anything that could be classified as “Personal Data” (such as a unique Cookie ID used to target a user, an assigned User ID, email, etc.) that would put you in danger of non-compliance and those hefty financial punishments that everyone is talking about.

To organize these efforts, take your Tag Inventory from Step One and add in some columns to the Spreadsheet. To start, add in the following:

• Internal Business Owner
• Agency Partner (If Applicable)
• Keep/Remove
• Migrate to TMS?
• Priority

Following this organization, it’s time for some leg work! Work with your internal marketing and advertising teams to understand who works with and is responsible for each of the platforms. Also identify any third party organizations that help with the management of each technology.

As you work through, notate the platforms that should be kept and removed along with any tags that are currently loading outside of your Tag Management System that should be migrated and loaded via the TMS for easier management.

An optional, but highly recommended, process is to also assign a ‘Priority’ to each technology. This should correspond to how important each platform is to the business. For GDPR specifically, this is not 100% necessary, but can go a long way when trying to optimize the tagging architecture for purposes of site performance and optimal data collection.

Congratulations! You now have a grasp on the technologies that should be loading on your site. Now we need to evaluate each for GDPR compliance.

For each platform loading on your site and collecting Personal Data, you’ll need to ensure that it is compliant with the 6 Principles of GDPR. Remember, compliance is your responsibility as the Controller. If a vendor you work with is in violation of GDPR, at the end of the day you can be liable for working with that technology. To reduce the risk to your organization, all technologies need to be fully vetted and compliance must be documented.

To work through the evaluation, ask the following questions:

Personal Data under GDPR is defined as any information that can be used to directly or indirectly identify the identity of a Natural Person. Basically, this means any unique identifier that can be used to identify and target a specific person. Important for the scope of marketing and advertising, Personal Data can include a unique cookie ID, an email address, or a User ID assigned on the website.

If so, proceed to the following:

Under GDPR there are six different lawful basis options available to you. For marketing and advertising purposes, you will be working with either Consent or Legitimate Interest.

Here you need to explain why the data needs to be processed and what the end result will be. A few questions to ask:

• What are you hoping to achieve by processing the data?
• Who benefits and what are the benefits that will come from the processing?
• What are the wider public benefits, if any, that will come from the processing?
• How important are the benefits to the processing?
• Are there any impacts if you don’t go ahead with the processing? If so, what would they be?
• Would the use of the data be unlawful or unethical in any way?

An important note here is that the legitimate interest for processing the data must be clearly articulated and explained to the data subject. There must be a defensible position for why the data is being processed.

Ask yourself if the processing of the data is absolutely necessary to accomplish the stated interest or goal. A few questions to ask:

• Is there another way to accomplish the stated interest without the processing of personal data?
• Does the processing occurring really help in furthering the business goal? If so, how?
• Is the process used to go about the processing reasonable?
• Why is this processing important to the Controller/business?

This is where you balance the interest of the Controller (or business) against the privacy rights and expectations of the user. The balancing test must always be conducted fairly and without bias. If the rights of the individual outweigh the interest of the Controller, you will not have a legal basis for processing here. When conducting a balancing test, there are three main parts to consider:

• The nature of the interests (both of the Controller and Data Subject):
• Would the individual have a reasonable expectation that the processing is taking place? For example - it would likely be reasonable for a user of an ecommerce website to expect transactions to be tracked.
• The type of data that is being processed. If it is a special category of data or data related to a child then this is held to a higher standard.
• Is the interest to the Controller something that adds value to the subject? Is it something that is unwarranted or could result in harm as a result of the processing?

• Impact of the processing:
• Any impact (positive or negative) of the processing to the Controller or the subject.
• The status of the individual - is it a customer, general site user, child, etc.
• Is there any processing that involves profiling or data mining? What is the scale of the processing?
• Basically, consider the effects of the proposed processing on both the Controller as well as the data subject and what impact it has to both.

• Safeguards that are in place to protect the privacy rights of the individual:
• These are both technical as well as organizational.
• Technical safeguards are such things data minimization, de-identification, layers of encryption, anonymization, etc.
• Organizational safeguards are such things as privacy by design, extra transparency, restricted access, etc.

After considering the above, it is time to make a determination on if the proposed processing is, in fact, legitimate. Once this determination is made, make sure to maintain the documentation and information used to make the decision. Again, the responsibility is on the Controller to sufficiently defend any position taken in regard to the processing of Personal Data of a user on the site.

Once you have determined that you have a legal basis for collecting and processing the data (again for each platform used on the site) it is then time to review and ensure the proper safeguards are in place and each platform is sufficiently GDPR compliant.

This an evaluation of the technical and administrative data security measures offered by each platform. These types of evaluations should already be carried out as part of the procurement process when evaluating any new type of digital platform being used on the site.

The evaluation here would be done by the company’s security and legal teams. These will vary based upon the industry and nature of the data being collected and processed and should also include considerations of any industry-specific regulations that are also in place.

At a minimum, these contracts must set out the subject matter and duration of processing, the nature and purpose of the processing, the type of personal data, and the obligations and rights of the controller.

This, again, should be led by the legal resources at your organization to ensure all of the requirements are met. The key for documentation is to make sure these contracts are in place and organized to ensure a defensible position for GDPR.

Once you have gone through all of the platforms on the site to identify Personal Data being collected, established a Legal Basis for Processing, and ensured each platform has been properly vetted and signed off by Legal and Security, it is now the organization’s responsibility to properly notify users of the data processing taking place and ensuring their rights under GDPR are properly adhered to.

For this notification, a solid Privacy Notice detailing each platform used, the data collected, the processing activity, and the result to the user is required.

Under GDPR, it is required that the Privacy Notice must be concise, transparent, intelligible, and easily accessible. It must be written in clear and plain language. It must also be available free of charge.

For information collected on your website, according to the Information Commissioner’s Office of the UK, the Privacy Notice should contain the following at minimum:

All of this information should be provided at the time the data is obtained.

To summarize, when conducting an audit of the website in the context of GDPR it is important to go through the following steps:

Answer the above positively and you can sleep easy come May 25, 2018!