What is the GDPR?
GDPR stands for the General Data Protection Regulation.
The GDPR will be enforceable from the 25th of May 2018. It is designed to protect user data storage and usage, and to ensure that the user is in control of their data, rather than companies being in charge of user data.
GDPR代表一般数据保护条例。
该GDPR将于2018年5月25日开始强制执行。它旨在保护用户数据的存储和使用，并确保用户控制他们的数据，而不是公司负责用户数据。
Key GDPR Definitions
To help you understand the GDPR for apps, there are a few key definitions that we will refer to throughout this article.
Data Controller: A Data Controller is the entity that determines the purposes for and means of collecting and processing personal data. If you own a website or mobile app, and you're deciding what is collected, how it is collected, and for what purpose, you are a Data Controller.
Data Processor: A Data Processor is an organization that processes personal data on behalf of a data controller. For example, third-party services that plug into your website or app, such as Analytics (Google Analytics, KISSMetrics), Cloud Services (AWS), that access or host your customer data.
Data subject: a natural person whose data is processed. For example, an app user or a website visitor.
For a full list of GDPR definitions, you can read the Article 4of the regulation.
关键GDPR定义 为了帮助您理解应用程序的GDPR，我们将在本文中参考几个关键的定义。
数据控制器：数据控制器是确定收集和处理个人数据的目的和手段的实体。如果你拥有一个网站或移动应用程序，并且你正在决定收集什么，如何收集它，以及出于什么目的，你就是一个数据控制器。
数据处理器：数据处理器是一个代表数据控制器处理个人数据的组织。例如，插入您的网站或应用程序的第三方服务，如分析（谷歌分析，KISS），云服务（AWS），访问或托管您的客户数据。
数据主题：一个数据被处理的自然人。，例如，一个应用程序用户或一个网站访问者。 有关GDPR定义的完整列表，您可以阅读该法规的第4条。
Does the GDPR affect me?
Most likely, yes!
The GDPR applies to all businesses with customers, or website/mobile app visitors who are from the European Union (EU). This means that any organization in the world that works with EU residents' personal data in any manner has obligations to protect their users' data and be GDPR compliant.
What does "Personal Data" refer to under the GDPR?
"Personal Data " under the GDPR includes any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
The scope of this is broad, and includes anything from personal information, to a cookie placed on someone's browser by an analytics tracking tool you might use to track your website usage.
For your website or apps, this means you have to be considering how you collect and store personal identifying details such as names and email addresses, but also consider things such as users' IP addresses and device IDs (unique IDs that devices share with external SDKs for ads and analytics).
GDPR下的"个人资料"包括与可识别的人有关的任何信息，这些人可通过参考标识符直接或间接被识别。
这一范围很广泛，包括从个人信息，到通过你可以使用的分析跟踪工具放在某人的浏览器上来跟踪你的网站使用情况。
对于你的网站或应用程序，这意味着你必须考虑如何收集和存储个人识别信息，如姓名和电子邮件地址，但也要考虑用户的IP地址和设备id（设备与外部sdk共享的广告和分析的独特信息）。
What does the GDPR mean for your mobile app?
The fines for not being GDPR compliant are high - either 4% of annual global turnover or €20 million (whichever is greater!).
With GDPR compliance becoming a requirement for every business with either customers or website visitors, or app users in the EU, you're probably concerned about whether or not your mobile app is GDPR compliant.
As a mobile app publisher, you will need to understand how you obtain, transfer, store, and handle your user data. You should take some time to understand exactly how you currently ensure data security for your users, and what you can do to improve this in order to have a GDPR compliant mobile app.
Cennydd Bowles sums up why you should be compliant, even if it may be a lot of work initially:"You may end up with less rich customer insights than you had before. Some KPIs may slump. But for companies that have direct customer relationships, it's all manageable, and on the upside you not only reduce your compliance risk but benefit from the increased trust your customers will show in you and the online world in general."
There are some key highlights that are relevant to your mobile app and business in general that will help you ensure GDPR compliance.
Scroll down to find the 9 things you should consider in order to have a GDPR compliant mobile app.
**1.**Privacy by Design
Privacy by Design is now a legal requirement under the GDPR. From the moment you start creating your mobile app, you should be considering your users' privacy.
According to GDPR Article 23, your app must only hold and process user data that is absolutely necessary.
This means that when you're developing your mobile app, or having a third party develop it, you need to consider data protection and user privacy.
Privacy by Design is not a new concept and pertains to thinking of your users data privacy in your app, website, or software from the very start, rather than leaving it as an afterthought. The idea of privacy by design includes deciding what data you need, and what data you don't. In Brian Pagan's overview to designing apps with privacy in mind, he asks if you really need a users name AND date of birth. In many cases, just one of these fields is enough. He writes:"the risk of someone opening a credit card in my name far outweighs the benefit of getting that "happy birthday" spam marketing e-mail from your company."
It's worth considering all options when designing and building your mobile app.
As well as being a legal requirement, your app users will appreciate the extra privacy considerations you have in place for their benefit!
Our Recommendation:
Think about your user data from the very start, and don't let it be an afterthought.
If pages from your website are loading within your mobile app (e.g. a contact form), consider the data collection happening on the website when reviewing your app.
You should be thinking about Privacy By Design when you're creating new features, or creating a new page on your app in order to remain GDPR compliant.
As well as this, you should encrypt personal data with strong encryption algorithms. This will help you minimise the impact of a data breach.
2. Ask for Explicit Consent
Under the GDPR, businesses must request and receive user consent in order to collect, use, and move personal data.
This includes data collected for advertising, analytics, crash logging or anything else. The opt-in must be understandable and clear. You won't be able to get away with confusing Terms and Conditions that no one is likely to read or fully understand.
Explicit Consent can be granted easily through an opt-in screen when your app launches. Your app users chose to download your app in the first place, so the likelihood is, most people will be happy to grant consent in order to use your app and receive further communications from your business, provided the recipient can see a benefit.
Your users must also be able to withdraw consent as easily as they are able to give it. You may need to update your Privacy Policy to address this, and add another page on your website where users can opt-out.
Our Recommendation:
When someone registers on your mobile app, they should be asked to opt-in to have their data collected, or to receive communications, such as emails or Push Notifications.We highly recommend showing a consent screen on app launch, as this is the only way to be fully GDPR compliant. You should also notify users on these screens exactly where their data will be used. For example, will they be tracked in Google Analytics, or have data sent to Google Admob to show them relevant ads? Your users need to know, and it's your obligation to inform them as soon as they begin using your GDPR compliant mobile app!
As well as this**,** your GDPR compliant mobile app should have a dedicated page where users can opt out of communications from you, or ask for their data to be removed from them.
MobiLoud provides mobile apps with a Push Notification settings page, which helps at least for what concerns your app's notifications.
3. Providing Visibility and Transparency
One of the most important aspects of GDPR is how the data you collect is actually used. If you are a data controller, you need to be aware of how your users can effectively manage, and protect their user data.
Proving visibility and transparency through a clear, and understandable Privacy Policy not only benefits the users of your mobile app, but it's a requirement from the App Stores. Google will remove your app if they can't find a Privacy Policy on your Play Store's profile page and accessible inside your app.
You should also provide information to your users over which third parties you are using to collect or process user data.
For example, if your app connects to external services such as user analytics solutions (e.g. Google Analytics, Fabric), advertising providers (e.g. Admob, MoPub), or push notification providers (e.g. Firebase, OneSignal), you should disclose this to users clearly in your Privacy Policy.
You should also make sure that all third-party providers which collect any user data are GDPR compliant. They'll be "data processors", while you remain the "data controller". As such you should have written agreements in place which meet the level of assurances in terms of data protection and security which GDPR requires. For some of them, you'll be able to sign data processing agreements which add the required wording to the existing terms of your agreement.
Our Recommendation:
Create or update your app's Privacy Policy page for your mobile app. You may choose to have a Sidebar or Menu item that links to the legal terms of your mobile app. This will enable users to easily find, read, and understand how your mobile app is using their data.
If you've built your app based on your website's content and you're using MobiLoud, this is very simple and can be done by adding a link to your app's menu from the Menu Configuration tab in your app's settings.
4. Respond to User Requests
If someone asks how you are using their data, under GDPR you are legally obligated to respond to them. This is called a Subject Access Request.
A Subject Access Request may be done physically, or digitally. When a user asks for information about their data or a copy of their data that is used in your mobile app, you have one month to respond. For complicated requests, you will have up to three months to respond.
This may sound like you'll need to invest more time and effort into customer service, but if your business is set up to have GDPR compliant processes, it shouldn't take too much of your time. At the end of the day, providing high quality customer service to your customers and mobile app users is a good thing!
Initially you can respond to these ad-hoc, but eventually you'll want to have an internal process to generate a response for this sort of request.
Our Recommendation:
Create a page on both your website and mobile app that includes your business contact information. This will allow users to contact you easily, and provide transparency from your side. Make an effort to respond quickly and clearly to all Subject Access Requests.
5. The Right to Be Forgotten
Article 17 of the GDPR highlights the Right to Erasure, or the "right to be forgotten". This means that when a user asks you to remove their data acquired through your website or mobile app, you are obligated to remove every personal detail you hold about them in all systems, whether you control their data directly or through a tool or SaaS you use in your app (for example, Google Analytics).
If you want your mobile app to be GDPR compliant, you could choose to provide solutions such as deleting user data from your own database directly from the app, or having a simple contact form or dedicated page where a user can request their data to be erased.
Our Recommendation*:*
Be transparent and allow users to easily contact you about erasing their data. When someone asks for their data to be erased, take the request seriously and comply with the request on every system you control.
You are also obligated to notify Third Party Data Processors that the data must be deleted from their servers too. This can be done through calling an API of theirs that allows for the deletion of personal data (if this is made available by the provider).
6. Review services and SDKs you use
If your app sends personal data to an external service for processing (e.g. to analyse app usage), you need to be clear and transparent about where this is, and who will be in control of the transferred data.
Then, you should sign Data Processing Agreements (DPAs) with your data processors. Written contracts between your business and your data processors will be a general requirement under the GDPR. The sooner you get this done, the better!
Don't assume that all Third Parties and SDKs connected to your app are GDPR compliant. If there is a data breach on one of your Third Parties that leads to your user data being exposed, you are responsible.
It is the responsibility of the data controller, in this case, you, the app publisher, to ensure that all Third Party data processes are GDPR compliant, and have appropriate data security measures in place. To ensure this, you should talk to your third party partners directly, ask them about their latest Privacy Policy and Terms and what they're doing for GDPR compliance.
You should thoroughly analyse the vendors who process your data, and take time to understand whether or not they are GDPR compliant. If they're US based, are they registered under theEU-US Privacy Shield Framework? Any business can self-certify under this, and having this certification is required for that vendor to be GDPR compliant.
It's worth the time it takes -
Marcus Turner, CTO of Enola Labs says that, "Ultimately, higher levels of cyber security are a necessary and worthwhile investment for business owners that care about protecting their customers and safeguarding their business. I often tell businesses that they can pay an upfront cost now to protect their data, or wait until a cyber security attack and pay an even bigger price later to clean up the mess. Waiting may very well cost you your business ".
So, make sure you take the time to review your technology suppliers and invest in necessary ones that will help safeguard your business from being in breach of the GDPR.
Our Recommendation:
You should only have contracts with providers who can provide 'sufficient guarantee's that GDPR requirements will be met, and your users' data is sufficiently protected.
Many vendors will have GDPR pages on their website, or have updated their Privacy Policy or Terms and Conditions to ensure GDPR compliance. You should familiarize yourself with this, or talk to someone from their support or legal team to understand if they are GDPR compliant or not.
7. Data Breach Notifications
To increase trust between customers and businesses, and in the wake of notable data breaches from companies such as Yahoo!, Uber, Equifax and more, the GDPR is enforcing tighter deadlines for businesses to notify national supervisory authorities and their users. Disclosure must happen within 72 hours.
To ensure this is possible for your business, you may need to invest in technology to ensure continuous surveillance of your data, and that notifies you when risks are present. You should also establish a clear procedure about how you will react to a data breach - including how you will inform users, and how you will protect their data.
Our Recommendation:
Establish a clear step by step process that you can use in case of a data breach that includes how you will inform users and national supervisory authorities of the breach.
8. Appointing a Data Protection Officer
Your company may need to appoint a Data Protection Officer (DPO) in order to be GDPR compliant. This applies to you if:
- You are a public authority (except for courts acting in their judicial capacity);
- Your core activities require large-scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or
- Your core activities consist of large-scale processing of special categories of data or data relating to criminal convictions and offences.
While this may not apply to all readers, if your website or mobile app processes large amounts of individual data you should be considering whether or not you need a Data Protection Officer to help you monitor internal compliance, inform and advise on your businesses data protection obligations, and act as a contact point for data subjects (i.e. your users) and supervisory authorities.
Our Recommendation:
Assess whether or not your business needs a DPO in order to be compliant. If so you should appoint one, and inform your website or mobile app users of how they can contact your DPO.
9. Encryption and data storage
Your mobile application should use SSL or HTTPS for external communications. When communicating personal information of any kind, that data must be encrypted. Not encrypting data means that information sent will be in clear text and will be exposed over the internet.
If you built an app that connects to your website or web servers and transmits sensitive data (e.g. a username/password), you should verify that you're using SSL for all connections from your app.
Encryption is not only relevant for external communications. All data that your mobile app collects should be stored in a safe place and, and your backups should also be encrypted. Users should also know how long their data will be retained for.
Our Recommendation:
Ensure that your app uses secure communications through SSL and HTTPs, and make sure your SSL certificate has been properly deployed.
All data stored should use encryption, and you should provide transparency to data subjects over how long you retain this data for.
10. Log and Justify Your Data Collection
Article 30 of the GDPR outlines that each data controller, or representative of the controller, "shall maintain a record of processing activities under its responsibility"
This means that in order to ensure your GDPR compliance, you should start documenting all the data that you collect (either yourself, or through a third party).
You should create a secure, comprehensive log of your data collection activities.
For a good example of how to do this, we would recommend reading Step 1 of Startup Resources guide to GDPR compliance.
This log should include all and any kind of personal data that you are collecting on website visitors and users. From people's names (if collected) to IP addresses to the country they're located in.
Then, you should justify why you're collecting this data. You need to identify where you're storing it, how long it is stored for, howcan the data collection be justified, and more.
Our recommendation:
Make sure you're fully aware of every kind of user data that you're collecting and ensure you can justify why you're collecting it.
Clear, complete documentation that you can refer back to will not only help you when customers or users ask about your GDPR policies but ensure regulatory compliance and safeguard both your business and mobile app.
Wrapping Up
GDPR is a legal requirement, and unavoidable for any business that interacts in any way with people and customers in the EU.
Anyone whose data is processed must be able to exercise their rights over their data, even if it is in your control.
You will need to have a GDPR compliant mobile app. Without ensuring compliance, you risk large fines and losing the trust that your customers have in your business! For this reason, creating a process to ensure compliance for your business and mobile app, should be a priority for you.
We believe you should not see the GDPR as a headache, despite its strict rules. Providing your users with a GDPR compliant mobile app will let them know that you value them, and are committed to their data security. For many businesses, ensuring compliance will be a value-add, and make your users trust your mobile app, so you should embrace it!
If you want to learn more about GDPR, we have included links to several resources below:
- Read the entire General Data Protection Regulation as published by the European Parliament to get familar with it.
- Read Kyvio's excellent guide to understanding the GDPR, this article from SafeDK and this practical GDPR guide for developers.
- Read Startup Resources' Quick and Dirty Guide to Getting Compliant for Startups and Small Business
- Self-certify your business under theEU-US Privacy Shield Framework. This provides companies on both sides of the Atlantic with a mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States.