GDPR- Unlearn and re-learn: Busting the GDPR Myths

GDPR- Unlearn and re-learn: Busting the GDPR Myths

If a sapling was planted every time there was a misconception about GDPR, we'd have probably defeated global warming by now. Any new revolution, be it in technology, philosophy or any other dimension, always creates chaos and confusion during its inception, bringing along with it, a plethora of misconceptions as well. However, it is time we got it all cleared from our heads. 

You might have been a victim of this contagion as well, or have you not? Let us unlearn the (un)popular misconceptions and try to bring in the clarity of crystals to our GDPR understanding.

Consent is an alias of GDPR

The worst of dreams by the GDPR experts will probably involve them yelling 'Consent alone is not GDPR!!', into the psychic space of their co-workers. Because this is, by far, the biggest misunderstanding. GDPR does put high emphasis on consent, but it is not the whole picture. 

There are six lawful bases and they're all equally valid. Say you are a firm based out of Amsterdam and you are employing locals. You don't need to get their consent for storing their information on your register, because the law mandates it. It will fall under the 'legal obligation' umbrella. If a person gets interested about your product and asks for a quote, you don't have to bother him with consent. Because you can process his contact information based on 'Contract'.

Hence, we must keep an open eye and consider all the six lawful bases before applying them to our data processing activities.

Consent is just a check box

Most of us are thinking that the holy check in 'I agree to the Terms & Conditions and Privacy Policy' is the consent we need. Well, no! In fact, that is the first example of what is not a consent, in the ICO website.

There are specific rules to be kept in mind when consent is taken. We must first state all ways in which we shall process the data we are collecting. And furthermore, we must not make it a precondition of a service, which is exactly what we do with the 'I agree to the Terms & Conditions and Privacy Policy' check box. Consent must be given freely with no pre-checked boxes. And even if the boxes are not checked by the subject, the service must not be denied. Hence, before taking the consent route, the whole processing tree must be analysed, and the decision on whether or not to take this route should be made.

GDPR is the Villain


When GDPR first came into picture, there was a massive wave of negativity that accompanied it. Social media was flooded with posts talking about how GDPR will cause a huge expense hole in organisations’ budget and why it will create so many problems that didn’t exist in the first place. Many organisations, by default, assumed that they shall end up non-compliant and some of them even expressed their idea of conjuring up funds for a possible fine due to non-compliance. One could almost feel the need to hit the psychological reset button.


However, we must understand in our bones that GDPR is a set of laws that just demand  Good Business Practice; GDPR must be welcomed with positivity because not only does it provide a company with a better legal and policy framework, but it brings acompetitive advantage as well.


GDPR, in many ways, will change the way businesses are conducted, but one of the main shall be the cognitive advantage that a company shall possess in the minds of its clients, when it becomes GDPR compliant. A GDPR compliant company shall do better positioning in their customer’s head when they can flaunt their compliance tag.


My business is small, so I'm kind of exempt.


Only in specific cases like the one for appointing a DPO, does the GDPR talk about company sizes. GDPR has an attitude and it doesn't care about your firm's size. If you happen to, in anyway, cross any data path of any EU resident, you are under the GDPR radar.

Forget small business! Even if you're a solo-pruner who runs a fashion blog, with an emailing list under your sleeve, you must be GDPR compliant.


I don't collect data from users, so I'm cool.


No, you're not. GDPR originates from 'what data you hold', which means that not only a massive introspection into
your data inventory is needed, but also an analysis of 'all' data that you have on subjects is required. Even if you don't collect data through web forms or portals, you still need to worry about the data pertaining to EU subjects. 

You might scrap the publicly available information on individuals and try to convert them into leads. You might even have purchased your competitor's leads (Highly not recommended, though. Just saying) or it could be a person on social media who has liked your page. In all these cases, though you haven't obtained data from the user directly, you still have to respect the data you have on him/her and process it under the GDPR.


There is only one type of consent


Firstly, there's private data and sensitive data. The former refers to data like the IP address, pin code etc., while the latter covers aspects like religion, sexual orientation etc. Naturally, the consent mandated for these types vary.

There are two types of consent : Explicit & Implied Consent


Implied consent is when the subject, by providing you a particular data, is accepting it to be used in a certain way. In effect, you don't have to shout out loud by asking him to check a box, but you can just 'imply' consent by stating the way the data is going to be used. But it does have to be unambiguous, which means there should not be more than one interpretation possible for that particular way in which you plan to use the data. Explicit consent is where the subject literally says 'I agree' to your consent statement, which must clearly state what data you are collecting, how you are going to use it, what it means to your subject and how this data will be transferred and the related risks of the transfer.Yeah, that's a lot. But this consent is required only when sensitive data is collected. 


I need to be a data democracy: All rights to all


The data subject rights caught so much attention that GDPR pursuers became too obsessed with it. For example, right to be forgotten was seen as a white elephant in the room and it perhaps got too much attention. Not all rights need to be given all the time. GDPR gives us six lawful bases, which is nothing but the underlying reason behind processing of data. And as your reason varies with the kind of data and processing method, the data rights you need to offer shall vary as well. 


Lawful Basis(row)/Rights applicable (column)

Right to be informed

Right of access

Right to rectification

Right to erasure

Right to restrict processing

Right to data portability

Right to object

Rights related to automated decision making

Consent

 Y

 Y

Y 

 Y

 Y

Y

 

Contract

 Y

 Y

 Y



 Y


 Y

Legal Obligation

 Y

 Y

 Y

 Y




 Y

Vital Interests

 Y

 Y

Y 






Public Tasks

 Y

 Y

 Y




 Y


Legitimate interests

 Y

 Y

 Y

 Y

 Y


 Y

 Y


Consider the above depiction, which correlates between rights and the lawful basis. A data field processed on a basis of contract, cannot be asked to be erased as such. Similarly, a data processed for vital interests cannot be objected. So, being aware of why you process the data that you do, and categorizing them based on applicable rights and lawful basis is an extremely crucial function.


I can use 'Legitimate Interest' for marketing uses relating to personal data, without consent.


The best one is saved for the last, because this is something that can really get you into trouble. Legitimate interest is not the silver bullet you can use when you have run out of options. Usage of legitimate interest has to be weighed against the privacy of the user before it can be applied to a marketing related activity(Any activity, for that matter! ). Even though marketing is an example of legitimate interest given by the ICO itself, it does not rule out the fact that the user must agree to be communicated for marketing. 


A clear 'Opt-in' is always preferred, which is not treated as consent, and it is, in some form, necessary to proceed with marketing communications.

 



    • Recent Topics

    • JOB Sheet can not send PDF as service rapports and more info needed other topic

      Goedendag, - Jullie hebben nu job sheet erin gedaan en dar is echt super goed, enkel kunnen we de werkbon ( JOB sheet) nu niet verzenden als PDF als een service rapport naar onze hoofdaannemer hoe we dat nu doen als bewijs van de levering van het werk

    • Tax Deduction at Source (TDS)

      I issued a sale invoice outside UAE , the customer apply TDS on the invoice , i checked my Zoho ( professional version ) i couldn't find the option of Enable TDS to let it appear while posting the incoming payment , please how to make it and how to configure

    • UNAPPROVED record management

      When the unapproved list of duplicates is long, one needs the some tools to manage them - when this list has over 1500 records, we cannot manage it without some tools, such as: 1. The ability to apply a filter - ie similar to creating a CREATE a NEW VIEW

    • Zoho mail filter Add to WorkDrive doesnt't work

      Hello, We have a problem with using the filter in the email. So, we want that when a bulk payment confirmation from the online store arrives, this email is automatically saved in HTML format on the drive using the action 'Add to Zoho WorkDrive -> Email

    • Introducing Zia GenAI: Zoho's Native Generative AI for Zoho Desk

      Hello everyone, Zia GenAI is available on Early Access for Zoho Desk Enterprise subscribers. Kindly fill out this Registration Form to request early access. We are excited to announce the Beta release of Zia GenAI in Zoho Desk, now available through our

    • Add blueprint buttons to listview and kanban

      Hello, just started to use the Blueprints feature - really useful. I have one suggestion to help this work even better - can there be transition buttons that appear on the top of listview & Kanban? Maybe an option as well - "Blueprint transitions appear

    • Deleted message in SPAM

      In one of my gmail accounts (getnickifit@gmail.com) I had an email from PayPal in the SPAM folder. I thought I was moving the message to the inbox from the zoho mobile but it looks like it was deleted. It is no where to be found--inbox, trash, etc. Can it be restored?

    • CRM x WorkDrive: File storage for new CRM signups is now powered by WorkDrive

      Availability Editions: All DCs: All Release plan: Released for new signups in all DCs. It will be enabled for existing users in a phased manner in the upcoming months. Help documentation: Documents in Zoho CRM Manage folders in Documents tab Manage files

    • Multiple Facebook Pages under Single Brand

      Hi everyone, I'd like to know if there is a possibility of connecting multiple Facebook pages under a single brand on Zoho? At the moment, there are different Facebook pages of a single brand and would want to keep under the same brand on Zoho as we

    • Zoho Books Estimate to Zoho CRM quote?

      I'm not sure why this isnt automatic, but maybe I'm missing something. When we create a quote in zoho books we have a custom function that pushes the contact into a deal within the CRM. I can not for the life of me figure out how to push an estimate from

    • Zoho Developer Hangout (ZDH) – Episode 17 | Optimizing Organizational Processes through Automation

      Hey developers! Running a business can get quite overwhelming especially when juggling multiple tools like those in the Zoho ecosystem. Although integrating most of them is a piece of cake, manual intervention is needed at times. Being able to automate

    • Zoho One not working

      I'm having several issues accessing Zoho One. Some pages don't load (for example, Zoho Directory) and the labels are all messed-up (oz.account.directory.display.shorname, oz.settings...., etc.)

    • Apple Messages for Business in Omnichannel communications?

      Hello, Apple launched "Apple Messages for Business" but Zoho CRM or Zoho Desk don't appear in the list of possible integrators. Zoho already promotes https://www.zoho.com/crm/omnichannel.html Omni Channel integration, but Apple Messages does not yet appear.

    • Kaizen #140 - Integrating Blog feed scraping service into Zoho CRM Dashboard

      Howdy Tech Wizards! Welcome to a fresh week of kaizen. This week, we will look at how to create a dashboard widget that displays the most recent blog post of your preferred products/services, updated daily at a specific time. We will leverage the potential

    • Schedule meeting monthly on a particular day

      Suppose I wanted to schedule HR meeting every month on the first Tuesday with each employee separately for 20 minutes each. How could I automate these type of meetings? And if Sunday occurs on the first Tuesday I would like to shift that meeting on next

    • In ZohoCRM Dashboards - Editing Shown Columns on Drilldown of Components

      Hello! I'm working with some Dashboards inside of ZohoCRM. When creating a component (In this case, specifically a KPI Ranking Component), I'd like to customize which fields show when trying to drilldown. For example, when I click on one of the sales

    • Added Domain but SSL is not being set properly

      We added a Domain for our landing page and it pushed an SSL cert to it. The Cert is generated by LetsEncrypt, but it doesn't match our subdomain (i.e., it's just pointing to zohosites.com). How do we get the cert properly setup there?

    • Zoho CRM Widget not displaying 2 related lists (JS)

      Okay so I basically have 2 relatedLists that I want to get and render: ZOHO.CRM.API.getRelatedRecords({ Entity: data.Entity, RecordID: data.EntityId, RelatedList: "Notes", page: 1, per_page: 200, }) ZOHO.CRM.API.getRelatedRecords({ Entity: data.Entity,

    • KPI widget with percentage

      I'm trying to create a KPM widget that displays current performance as a percentage - something like the picture below. I've tried following the instructions at https://www.zoho.com/analytics/help/dashboard/kpi-widgets.html#chart but nothing ends up being

    • Canvas List View Not Saving

      Hi, I am trying to edit a list view to look different depending on the tags. Everything worked well and saved well with multiple views, but when I have gone back in to make some small changes like moving one of the icons it comes up with the error message

    • QR code image is not exported in PDFs

      The new QR code field works fine when I include it in a report template and I choose the print option: https://creatorapp.zoho.com/<username>/<app_link_name>/record-print/<report_link_name>/<record_ID>/ But when I try to save the document to a .pdf file

    • QR codes in templates

      I'm excited about the new QR code generator. I have included a QR code that contains the record ID setting "${ID}" as input data. In the report detail it works perfectly but when printing it in a template the code is not shown.

    • This mobile number has been marked spam. Please contact support.

      Hi Support, Can you tell me why number was marked as spam. I have having difficult to add my number as you keep requesting i must use it. My number is +63....163 Or is Zoho company excluding Philippines from their services?

    • Zoho CRM search not working

      The search bar is not showing any results in our CRM installation. We have a lot of items and can not search them by using the navigation each time. Can someone please check this asap.

    • Reload page with widget

      Hi all, I hope I can find some help here. I developed a small widget for Creator that is integrated into a page as a component. The page contains other content as well. When the widget is sent, the entire page should be reloaded to apply the changes to

    • Tip of the week #37 - Manage all your Telegram business conversations directly from your shared inboxes.

      Tired of switching between multiple apps to manage your business conversations? With Zoho TeamInbox's multichannel inboxes, connect your Telegram channel to a shared inbox. This way, your teams can easily handle c View, reply, and collaborate on them

    • Tags on notes aren't syncing correctly on Android

      I've created notes on the desktop version that have several tags assigned, but on both my Android devices those notes only have ONE of those tags instead of all of them, despite the actual content of the note being correctly synced, and I'm also starting

    • Reports - custom layout - duplicate report

      Do you also have this problem and what is the possible solution? I duplicate a report that has a "custom layout". Unfortunately the custom layout is not duplicated. To be improved for a future release by Zoho. I export the custom layout and import it...

    • How to map a global picklist from one module to another

      Hi there, i currently have a new field that is called sales office which we use for permission settings between our different offices located in different countries. It is a global set picklist with three different options: MY, SG and VN. I want to be

    • Pageless mode needed to modernise Writer

      When we switched from GSuite to Zoho, one of the easiest apps I found to give up, was Docs. In many ways, Writer has always been more powerful than Docs, especially in terms of workflows/fillable forms/etc. However, I went back into Docs because I notice

    • Changing the Logo Size on Zoho Sites

      My company logo incorporates both an image and text, and I would like it to be much more prominent on the page than is currently allowed by the small logo box in the template.  Is there any way to hide the page name and then make the logo box much bigger since my company name and logo are connected / are all in one file?  Thank you. 

    • Is it possible to Select Item Serial Numbers from a Sales Order?

      Our accepted estimates are converted to Sales orders for our warehouse staff to pick.  How can my warehouse staff select the serial numbers for an item when editing a Sales Order?  Logically when staff pull an item and have the serial in front of them they update the Sales Order and select the serial. I understand a serial can be added when creating an invoice but how can accounts team know the serial if the warehouse staff can't select it! A basic flaw!

    • MORE BUGS: Client Script, Deluge and Widget JS SDK don't work as expected when trying to retrieve a record that has been "rejected" as part of an approval process.

      Client Script $Page.record is null when accessing a record that has been "rejected" as part of an approval process. Deluge zoho.crm.getRecordById(moduleName, recordId) returns {"status":"failure"} when recordId is a valid, but rejected record. OK... I

    • Zoho CRM Widget not displaying 2 related lists (JS)

      Okay so I basically have 2 relatedLists that I want to get and render: ZOHO.CRM.API.getRelatedRecords({ Entity: data.Entity, RecordID: data.EntityId, RelatedList: "Notes", page: 1, per_page: 200, }) ZOHO.CRM.API.getRelatedRecords({ Entity: data.Entity,

    • Zoho Books and Zoho Projects Task Status Update

      How can we create an automation using custom functions for the following scenario. When our zoho books invoice status changes to paid. I want a task in Zoho projects to change to completed.

    • Default Sort Order in Project Tasks View

      It should be possible to specify a default sort order (or have the last explicit sort order restored upon reload) for the tasks in the project tasks view. Currently the sort order must be manually re-selected for each sub-group whenever any changes are

    • Assigning Tasks and Requests to Groups... how do I?

      Guys, I've spent many hours exploring Zoho Support and we are generally satisfied with the system.  I'm trying to understand how a system that has so much to offer can be missing GROUP assignment and queue functionality.  I am hoping that there is a way

    • Parsing of SQL query failed. Please check the SQL syntax.

      I am trying to have Zoho Analytics recognize that if the a Deal is in Stage "Need Docs" it should also be counted as a Deal in the Stage "New Lead" /*New Lead*/ SELECT "ID" 'New Lead' AS "Stage" From "Deals" Where "Stage" = 'Need Docs' Union All Error

    • Where is the setting to enable/disable 2FA?

      The following links show where enable/disable 2FA is supposed to appear, but neither appear for me: https://help.zoho.com/portal/en/kb/zohosites/faq/account/articles/how-do-i-enable-or-disable-two-factor-authentication-for-my-account shows Security >

    • How to Assign Record Ownership in a Custom Form via API?

      Hello everyone, I’ve created a custom form in Zoho People and I’m using the API to manage its records. I would like to know how I can assign ownership of these records to specific users via the API. Is there a specific parameter or field in the API request

    • Next Page