An interesting aspect of how the GDPR will affect marketing departments is the way social media platforms are planning to change the way they handle personal data to comply with the new regulation. Because of these changes, the imminent General Data Protection Regulation that will come into force on the 25th of May 2018 will have a major effect on how businesses will be able to use social media to promote their products and services.
But how are social media platforms going to adapt to the changing regulation and how is this going to affect social media advertising?
The most important provision affecting marketing use of social media is the way businesses will seek consent to use or store users’ data. Effectively, consent and data use will be covered by terms and conditions and privacy notices of each social media platform, to which both users and advertisers agree to.
Does this mean that advertisers have nothing to worry about? That’s not quite the case. Let’s see for example how two social media like Facebook and LinkedIn plan to cope with the new data law and what this means for advertisers.
On the 29th of January Facebook released a statement where it explained how it is going to comply with data protection laws. More information about Facebook and the GDPR is also available here. Firstly they have assured that the Facebook team is working to review the tools people use to manage their privacy, as well as hiring a Data Protection Officer, as required by the new legislation to companies that process of special categories of personal data on a large scale.
Facebook also made clear its position as either data controller or data processor. This is key for businesses to understand as the two roles have different duties and responsibilities under the new legislation. In most cases, Facebook is going to serve as data controller which means that it must comply with GDPR rules on how it collects and uses personal information. A data controller “is the individual or the legal person who controls and is responsible for the keeping and use of personal information on computer or in structured manual files.“
As a data processor however, Facebook has a limited set of responsibilities, mainly regarding the safety of the data processed. This is the case when companies use Custom Audiences – lists of customers that companies have on their database that they can use to target with Facebook ads; another case is when Facebook processes campaigns’ data on behalf of the company to provide insights about the campaigns’ performance or when using Workplace Premium. Particularly when using Custom Audiences, companies should make sure that all the data processes comply with the “criteria of legitimate data processing”, that is in accordance with the principles of data protection and that specific requirements are applied to sensitive categories of personal data.
Similarly, companies will not be allowed to use their followers’ details, such as emails, for an email campaign. In fact, personal data can be used only after acquiring explicit consent from the data subject. It doesn’t even need to be as personal as an email address: even using social media handles in a CRM system will need the subjects’ consent.
In a statement last month, LinkedIn clarified that the GDPR will have some effects on LinkedIn Marketing Solutions products due to some updates with their customers’ agreements. In particular members will have “more control over how their data is used for targeting purposes, such as their demographics and third-party data”. This means that LinkedIn members will have the option to opt out of allowing use of their demographic data in ad targeting. LinkedIn will also delete personal data stored in advertisers Campaign Manager platforms if not used or inactive for 90 days.
Here’s an interesting article on how to implement the new legal requirements on Facebook Lead ad forms.
Like for Facebook Custom Audiences, LinkedIn mentions how advertisers (data controllers) will be responsible for any personal data provided to LinkedIn particularly in the case of LinkedIn Matched audiences (that is, LinkedIn’s version of Facebook Custom Audiences), and for the content of the ads. The good news is that data advertisers will not need to take any additional action to use LinkedIn Sponsored InMail, unless of course they are targeting their own databases, in which case they will need to have the right under the GDPR to provide LinkedIn with any personal data. It also states that high-performance targeting and analytics capabilities will not generally be affected, except when the GDPR will require LinkedIn or advertisers to obtain an explicit opt in.