§ GDPR: Your key obligations as a WiFi hotspot operator

Time is running out: May 25, 2018 is fast approaching. It is still unclear what enforcement of the new regulation and the announced inspections will look like. Nevertheless, it is advisable to be prepared and to observe the most important principles. With globally increasing data traffic, data theft and misuse are unlikely to decrease in the future; therefore, it is generally welcome when legislators create greater awareness of the topic and greater responsibility for companies. By now, it is impossible to avoid media coverage of the GDPR. Even so, a surprisingly large number of companies are still not prepared, or not sufficiently prepared. Time and again, we hear questions like these:

“Does this really apply to us—do we have to do anything?” The answer is clear: YES.

Today, all companies process personal data, which means everyone is affected—from sole proprietorships to large corporations.

Once that has been clarified, the next two questions are usually: “What is this actually about?” and “What do I have to do?” We would like to answer these here in the form of a brief overview:

@Question#1

The aim of the General Data Protection Regulation is to adequately protect the security and privacy of natural persons in an age of mass data processing and global data networks. The regulatory framework already entered into force in 2016. What is happening now is merely the transition period during which there were no systematic checks and no penalties for violations. From May 25 onwards, penalties may apply of up to 4% of a company’s worldwide total turnover.

@Question#2

To answer this, it is best to take another look at the most important obligations the regulation imposes on us:

• 1. § ART 5/1B and 1C – DATA MINIMISATION: No more data may be collected and processed than is absolutely necessary to fulfil a purpose or assignment. For example, if you offer free WiFi access for restaurant guests, there is no reason to ask for address data. If, however, you are interested in where your guests come from—which can certainly be a legitimate interest for a restaurant operator—you may ask them, but your guests must disclose this information consciously and voluntarily (see #3), and you may prefer to ask only for the postal code.
  

  How does the Privacy Toolkit help me with this?

  Even without the kit, IACBOX helps you by offering data-minimising login methods, where a room number, a ticket ID, or other weakly personal parameters can be used for authentication. The Privacy Toolkit does even more by being able to document all login methods, including those integrated externally (see obligations under #4), and it also issues warnings when privacy-critical settings are configured.

• 2. § ART 5/1E – STORAGE LIMITATION: Data may not be stored longer than the time required to fulfil an assignment or as required by other legal provisions.
  

  How does IACBOX help me with this?

  IACBOX supports you with an adjustable anonymisation and deletion function. Although anonymised data is no longer personal and could theoretically be stored indefinitely, unnecessary data is ultimately just ballast—why keep it forever? The Privacy Toolkit also warns you if you have configured critical retention periods. Of course, you may have good reasons for doing so, which is why it also offers the option to override the warnings.

• 3. § ART 5/1A – LAWFULNESS AND PROCESSING IN GOOD FAITH: Data subjects have the right to know what their data is used for, and they must be able to rely on purpose limitation. Therefore, a prohibition of tying applies: the collected data may only be collected for the agreed purpose—such as using the guest WiFi in a restaurant. Forcing consent to receive a newsletter at the same time is no longer permitted. You may, of course, invite your guests to sign up—but please do so separately and clearly recognisable.
  

  How does IACBOX help me with this?

  IACBOX’s Login API enables integrations with CRM or mailing software, allowing you, for example, to add a small newsletter sign-up to your login page with an additional checkbox for consent. ATTENTION: Such processing activities must be justified and documented—see #4. The Privacy Toolkit helps you with this by adding your information and justifications to the dynamically generated data processing register.

• 4. ART 5/2 and 30 – ACCOUNTABILITY AND DOCUMENTATION: The GDPR obliges all of us to document and be able to demonstrate compliant handling of personal data. You must record in a data processing register which categories of data are collected from which categories of persons and what happens to them. Is the processing carried out by you, or is it outsourced to service providers? Is the data transferred to a non-EU country? Is there comparable legal certainty there as in the EU? This is perhaps the most difficult topic, because even if you outsource an assignment or commission a cloud service, you still bear responsibility for legal compliance towards data subjects.
  

  How does the Privacy Toolkit help me with this?

  With IACBOX’s new Privacy Toolkit, you can create a dynamically generated data register. In doing so, IACBOX checks which login methods and which data fields are in use and generates an individual register as a PDF, including date and timestamp. You can print and file this register as often as you like: after every change, or only when needed—that is entirely up to you. If your IACBOX is connected via Login API to a PMS, CRM, a database, or another backend, you also have freely editable text modules available where you can specify what happens to the data as part of this integration—so that you can fully and conveniently meet your documentation obligation. It also includes a data processing agreement that you can present to any service provider you may commission to ensure that they, like you, safeguard data protection.

• 5. § ART 5/1F and 28 – CONFIDENTIALITY AND INTEGRITY: You must ensure the confidentiality of the data and ensure that it is not altered. How are you supposed to do that—what if a malicious hacking attack occurs? Do not worry: the GDPR does not require you to be better than law enforcement itself and prevent it. However, you are required to implement technical and organisational measures to protect your customers’ data to an appropriate extent. The regulation does not specify exactly what this must look like. Common standards—such as a TSL (formerly: SSL) certificate for your data-collecting website, as well as training and a confidentiality agreement with employees who have access to this data—will certainly be expected.
  

  How do IACBOX and the Privacy Toolkit help me with this?

  Since documentation is not only an obligation but also an essential prerequisite for meeting the accountability requirement, IACBOX and the Privacy Toolkit do a great deal for you here. For one thing, IACBOX’s TSL certificate itself is continuously updated, so you are on the safe side. In addition, all access by your admin users to data is logged by IACBOX and is therefore documented and traceable. You can also use the Privacy Toolkit to display a confidentiality agreement to each admin user, which they must accept before starting their work. The training and agreement are included as a PDF for printing and signing, as is a data processing agreement, the full text of the GDPR for reference, as well as a template for reporting a data breach and a list of the competent data protection authorities.

• 6. § ART 12, 13 and 15 – INFORMATION AND ACCESS: You are obliged to provide information at any time to the data subject whose data you process. This information and the privacy notice must be written in clear, understandable language, and there must be a way for the data subject to contact you.
  

  How do IACBOX and the Privacy Toolkit help me?

  IACBOX requires a contact to be inserted into the privacy notice displayed on the login page. The notice itself is written in clear, understandable language. However, you can also use your own privacy notice—just be sure to include a contact option. With the Privacy Toolkit, you also have the option of responding to a potential access request by sending the dynamically generated report. This allows the requester to see exactly what happens to their data. If they request deletion, this is possible under the Privacy tab, with or without the Privacy Toolkit. Please note, however, that data may not be processed only on the IACBOX if backends are integrated, and you should supplement the report accordingly.

At IACBOX, we assume that in regular operation no data classified as sensitive by the GDPR in Art. 9(1) is processed—data relating to racial or ethnic origin, political or religious beliefs, trade union membership and worldview, genetic or biometric parameters, sexual orientation or sex life, or health. This is generally prohibited, except in the legitimate cases listed in Art. 9(2), which include, among other things, the protection of vital interests. In this case, a data protection impact assessment pursuant to Art. 35 is strongly required. However, in all other cases it also helps to understand the obligations that apply to every data processor, if only by raising awareness of the unpleasant consequences that negligent handling of data security can have—regardless of whether a WiFi hotspot is operated or not.

Would you like to order your Privacy Toolkit now? Contact your local IACBOX partner.