US Companies Face Hefty Fines for GDPR Violations

Europe has some of the strictest anti-spam legislation in the world. The General Data Protection Regulation (GDPR) and the ePrivacy Directive (ePD) are two of the most important pieces of legislation that govern the sending of email and SMS texts to European customers.

The GDPR is a comprehensive privacy law that applies to all businesses that process the personal data of European citizens. The ePD is a more specific law that regulates the use of electronic communications, including email and SMS texts.

Under the GDPR, businesses must obtain consent from European citizens before sending them marketing emails or SMS texts. Businesses must also provide clear and concise information about how they will use the personal data of European citizens.

The ePD prohibits the sending of unsolicited commercial communications, such as marketing emails and SMS texts, unless the recipient has given their consent. The ePD also requires businesses to include a clear and conspicuous opt-out mechanism in all commercial communications.

US companies that send email or SMS texts to European customers must comply with both the GDPR and the ePD. If a US company violates either law, it could be subject to fines of up to €20 million or 4% of its global annual turnover, whichever is greater.

Here are some tips for US companies that want to comply with Europe's anti-spam legislation:

• Obtain consent from European citizens before sending them marketing emails or SMS texts.
• Provide clear and concise information about how you will use the personal data of European citizens.
• Include a clear and conspicuous opt-out mechanism in all commercial communications.
• Use a double opt-in process for all marketing emails and SMS texts.
• Make sure your email and SMS text marketing campaigns are GDPR-compliant.
• Use a reputable email and SMS text marketing service provider.
• Stay up-to-date on the latest changes to Europe's anti-spam legislation.

General Data Protection Regulation (GDPR)

The complete guide to GDPR and compliance can be found at gdpr.eu

GDPR began May 25, 2018, and since then has levied harsh fines against violators of the EU's data privacy legislation. According to website GDPR Enforcement Tracker, the top 10 countries with the highest total fines are:

And the breakdown of violations by industry:

While the US and US companies are not represented on these tables, that's not to say their European offices haven't been fined by the GDPR. Read more about that here. Google (fined $50m by France) and Marriott ($100m fine for its Starwood customer data breach) are the two largest entities to face GDPR fines.

In a nutshell, GDPR covers businesses, government agencies, and other entities:

• In the European Union (EU);
• That offer goods or services to anyone in the EU;
• and collects, stores, transfers, or uses personal information about EU citizens

For individuals, GDPR offers extended protections regarding the use of personal data such as:

• Right to Access:
• Obtain confirmation as to whether or not their personal data is being processed, where and for what purpose 
• Access their personal data
• Correct errors in their personal data
• Right to be Forgotten:
• Erase their personal data
• Object to having their personal data processed
• Data Portability:
• Receive a copy of any personal data stored, and transfer that data to another vendor/controller

GDPR defines personal data as:

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. (source)

Canada's anti-spam laws (CASL) and its impact on US marketing

Here are the top 10 elements of Canada's CASL anti-spam legislation and its impact for US companies marketing to Canadian citizens:

• CASL applies to all commercial electronic messages (CEMs) sent to Canadian electronic addresses. This includes emails, text messages, and social media messages.
• CASL requires that you obtain consent before sending a CEM to a Canadian resident. Consent can be express or implied.
• CASL requires that you identify yourself and your business in all CEMs. This includes your name, physical address, and email address.
• CASL requires that you provide a clear and conspicuous unsubscribe mechanism in all CEMs. This means that recipients must be able to easily unsubscribe from your mailing list without having to contact you.
• CASL prohibits the sending of CEMs that are false or misleading. This includes CEMs that contain false or misleading information about the sender, the content of the message, or the purpose of the message.
• CASL prohibits the sending of CEMs that are unsolicited. This means that you cannot send a CEM to a Canadian resident unless they have given you their consent to receive it.
• CASL prohibits the sending of CEMs that are excessive. This means that you cannot send too many CEMs to a Canadian resident in a short period of time.
• CASL prohibits the sending of CEMs that are harassing or annoying. This means that you cannot send CEMs that are intended to annoy, alarm, or inconvenience the recipient.
• CASL prohibits the sending of CEMs that contain viruses or other harmful content.
• CASL provides for significant penalties for non-compliance. These penalties can include fines of up to $10 million for individuals and $100 million for organizations.

The impact of CASL for US companies marketing to Canadian citizens is that they must comply with the law in order to send CEMs to Canadian residents. This means that they must obtain consent, identify themselves, provide an unsubscribe mechanism, and avoid sending false or misleading, unsolicited, excessive, harassing, or annoying CEMs. If a US company does not comply with CASL, it may be subject to significant penalties.

Google's Blacklist, Pt 1

Email deliverability is one of the many struggles with legit businesses offering products or services through email. ContentTech just had their online marketing summit a few weeks ago and a lot of the follow-up B2B emails from the participating vendors have ended up in the Gmail spam folder, even though it was clearly stated within the online conference that you were going to be opted into partner messages if you responded to offers or downloaded sales content.

Examples of Google's spam filter messages:

• It's similar to messages that were detected by our spam filters.
• Many people marked similar messages as spam.
• It contains content that's typically used in spam messages.

In the case of T-Mobile's career center emails, the email doesn't follow the standard practices for opting out, double opt-in, nor does it even have those options in the email's footer or any identifying marks about why the user is receiving the email. A user could have registered with T-Mobile's old career center before the MetroPCS merger; but all that language is absent from the email:

2014-03-20, T-Mobile Careers Email Screenshot

This email has only one call to action: Create a new profile. Hopefully this is just a one-time broadcast. Like with most things in life, you rarely have the opportunity to make a second impression.

Canada's Online Protection Legislation (COPL) / Anti-Spam Legislation

Law enforcement begins September 2011.

Unlike CAN-SPAM, which covers only email, Canada's Online Protection Legislation (COPL) covers commercial email (CEM), is defined as any commercial "message sent by any means of telecommunication, including a text, sound, voice or image message," and includes:

- Email
- SMS
- Instant Messages
- Social Media postings such as ‘tweets’ or 'status updates'
- Some voice communications 

Commercial email requirements include:

- Express affirmative (opt in) consent
- No false or misleading headers, including sender and subject line
- Cannot alter transmission data
- Must provide a conspicuous unsubscribe mechanism
- Must include postal address of sender
- Cannot perform address harvesting to obtain email addresses or send to harvested addresses
- Liability for entities who knowingly allow spam to be sent on their behalf, even if the message was not directly initiated by those entities

Exemptions to the opt-in requirement exist under certain circumstances. Consent is deemed if there is an existing business relationship, an existing non-business relationship (such as sending to a family member), conspicuous posting of an electric address such as on a 'Contact Us' page (provided there is no statement near the address indicating that it should NOT be mailed), or where the recipient has provided the electronic address to the sender. In most cases, this implied consent is valid for two years, after which the sender must gain affirmative consent.

Key Differences between COPL and CAN-SPAM (source)

COPL: Addresses broad range of Internet issues (spam, spyware, pharming)
CAN-SPAM: Addresses spam only

COPL: Applies to all forms of electronic messaging (email, SMS, IM)
CAN-SPAM: Applies only to email

COPL: Primarily opt-in; permission based
CAN-SPAM: Opt-out; you can technically mail any person at least once

COPL: Private Right of Action (PRA) available to anyone (individuals, businesses)
CAN-SPAM: Private Right of Action (PRA) available only to ISPs

Liability:

Computer systems located in Canada used to send or access an electronic message fall under the COPL umbrella. This means that any CEM that leaves or enters Canada is subject to the regulation. COPL is primarily enforced by the Canadian Radio-television and Telecommunications Commission (CRTC), and imposes fines of up to $1 million per violation for individuals and $10 million per violation for businesses. Willful violations are the primary focus of enforcement.

Actionable Steps:

Scrub customer lists and remove any address where there is no affirmative opt-in to receive email and other commercial email.
Update privacy policies and form collection on websites (e.g., newsletter opt-in) to ensure proper consent.

Related:
Canadian Standards Association
PIPEDA or PIPED Act
COPL text

Update and clarifications - Email CAN-SPAM

Here's a cheer for all the consumers out there. *Yay!* Finally, it seems that someone has been reading all the FTC complaints and companies will have to comply if they are to stay compliant with these new proposed operating rules with regard to how a customer unsubscribes from a list. I'm sure at least one of these scenarios has happened to you when you tried to subscribe from that bacn list.

The new rule provisions address four topics:

(1) an e-mail recipient cannot be required to pay a fee, provide information other than his or her e-mail address and opt-out preferences, or take any steps other than sending a reply e-mail message or visiting a single Internet Web page to opt out of receiving future e-mail from a sender;

(2) the definition of “sender” was modified to make it easier to determine which of multiple parties advertising in a single e-mail message is responsible for complying with the Act’s opt-out requirements;

(3) a “sender” of commercial e-mail can include an accurately-registered post office box or private mailbox established under United States Postal Service regulations to satisfy the Act’s requirement that a commercial e-mail display a “valid physical postal address”; and

(4) a definition of the term “person” was added to clarify that CAN-SPAM’s obligations are not limited to natural persons.

More details - http://www.ftc.gov/opa/2008/05/canspam.shtm

Advice to Prospective (List) Vendors

Topic: e-mail marketing lists

Issue: I get requests all the time from senior managers about how we can grow our e-mail database. Most of our data comes from our existing customers. There are a few ways we could create interest in doing business with us, but that is for another blog post.

Today, I got a sales rep of a list reseller company all worked up, hostile and offended, just from asking a few basic questions about their company. Preliminary research about their company showed that they manage two websites, one is registered in the UK and the other is registered in Ireland. It has one sales office in San Francisco and a data center in India. There is zero information about their company on either website, why wouldn't I think it's a subsidiary of a larger company? Mid-conversation I realized that the company had no identity and they were completely unaware of what differentiated themselves from other list firms.

What did I ask?

What process do you use to verify your e-mail marketing data?
What is your pricing like, could you give me an example?
Tell me about your company.
How long have you been in business?
How large is your company?

What I didn't get to ask was:

How often do you scrub your database?
What's the recency of your data?
What's your policy on opt-outs?
Is your company a member of the DMA (Direct Marketing Association)?

They probably started off with good intentions, but there's nothing on their website to suggest that they are CAN-SPAM compliant or value the integrity of their data. Heck, they offer e-mail lists for purchase. Standard practice is that qualified industry e-mail lists are for rent. Any prudent marketing firm knows that the database is the lifeblood of the company. A good list company will manage their relationships really well, be it a business buying a list to target prospective customers, or managing a publication's subscriber list.

It doesn't matter what position you hold within a company. When a stranger greets you at any random place: the mall, a party, a corporate event, a wedding, the park, or standing in line at the local deli, you need to be able to give good details about your company, who you are, what products/services your group is responsible for, and be proud of it in some way enough to generate interest about your company. After all, if you aren't interested in your own employer, why should anyone else be?

And, you can never lose your cool because once you do, you may never get that customer back.

Conclusion: When I was asking for specifics about the company, we got disconnected. Sure, that happens a lot if you're using a VoIP connection. While we were disconnected, the rep took the time to send me an e-mail with sample records of what their data looks like. The first file that I opened had a sample record of someone from my own company. Hey, that looks cool right? This is where I would have had my "data recency" question answered.

The contact name listed, supposedly an EVP of audit services, wasn't an employee anymore since they didn't show up on our intranet employee directory. Out of curiousity, I looked up the telephone number that was associated with that contact record. Guess what it came back as? Admin mail services. Yeah, I can see how *cough* accurate this data is.

One record does not make or break a company. But having erroneous data of the company you're trying to sell to is an inexcusable mistake.

Email Authentication

Today's web surfing takes me to investigate email authentication and its implementation costs. The hooplah that started this inquiry was from a press article about Goodmail partnering with AOL and Yahoo! to essentially get rid of the free whitelist system and replace it with a fee-based system for commercial senders. The concern for a publicly traded bank is whether or not its competitors will adopt such an authentication system to have their emails handled on a preferential basis by a consumer because it contains a "trust" tag.

What does email authentication do? Well, for starters it tries to manipulate how a commercial email is handled by an email service provider. The perception for the consumer is exactly like that of a 1st Class postage stamp versus a pre-sorted indicia, the latter of which almost entirely is for bulk postal mail, like pieces addressed to "Dear Head of the Household" or to "Current Resident." Here's Wikipedia's definition.

Goodmail is new to email authentication and has only been in existence since June 2003; not nearly enough time for it to have developed relationships. Goodmail's online documentation infers that by using their paid token system, it guarantees delivery of a commercial sender's email without blocking html, pictures, or embedded hyperlinks, to a consumer's email inbox. Click here to view their process.

There is a lot of unseen resources consumed by using or considering to use an email authentication service. Goodmail, for example, is a fee-driven company. The more fees, the more revenues. Let's just look at a few of the ones from Goodmail. There's a $399+ signup fee, an accreditation fee, token purchase fees which can rise by 25% if you ever show up on their watchlist as a probationary company, and per-email fees based on email volume.

I asked Goodmail to send me case studies of companies in the banking industry who are currently using their service and a list of references; the basics of consideration for any vendor offering. So far, no response yet.

Best practices are still the way to go, and the FTC has guidelines for business to comply with the CAN-SPAM Act of 2003.