The GDPR, short for the General Data Protection Regulation, governs how websites and businesses treat data that belongs to residents of the European Union, regardless of citizenship. This regulation applies to businesses and organizations around the globe, not just members of the EU. The GDPR requires an affirmative “opt in” to allow companies to collect website user’s personal data, rather than the traditional opt out we have all become accustomed to. The goal of the GDPR is to give back control of personal date to individuals by granting the following rights:
• The right to be informed that data is being collected and how it is being used;
• The right to object;
• The right to access that data;
• The right to change the data; and
• The right to have the data erased.
These changes likely mean that the “Terms of Use” on most websites will need to be updated to explain what data is being collected on the site and how to request that your information be forgotten. Additionally, in order to obtain the “opt in” or affirmative consent required by the GDPR, a pop-up window or “lightbox” feature can be used with a box or button for the user to click prior to proceeding to use the site. Furthermore, the GDPR requires notification within 72 hours of a breach to authorities in each country where users are affected.
While it may seem like these regulations wouldn’t apply to the typical real estate agent here in the United States, it is strongly advised to implement these updates as the potential fines for a breach of confidentiality are significant – up to $20 million Euros or 4% of a company’s annual global income, whichever is greater. The GDPR applies to the collection of the following information: name, phone number, address, e-mail address, IP address, cookie identifiers, location data, genetic information, mental/psychological information, economic information, cultural information, and any information pertaining to a person. If you have a website with an IDX, a newsletter sign up form, a listing request form, a “contact us” form, or any place where a user inputs their information on your website, you need to make sure you are GDPR-compliant.
These regulations under the GDPR became effective May 25, and while the GDPR may not apply to all real estate businesses, we recommend that you speak with your website vendor to discuss what data is collected and whether you should to update your website to become complaint these rules. It is also recommended that you speak with your insurance company to determine whether you would be covered in the event of a breach.
For more information, please visit the links below:
•
https://www.nar.realtor/sites/default/files/documents/GDPR-Article-FINAL.pdf
•
https://www.youtube.com/watch?v=NobDiwZQZJk