Do You Accept The Terms and Conditions?

Some of you likely remember receiving an unusual number of emails from various companies and organizations in early 2018. No, it was not just another marketing strategy. In these emails, organizations asked for permissions, asked if you wanted to stay on their email lists (which you most likely do not remember subscribing to), talked about the General Data Protection Regulation (GDPR), and explained their information management policies, among other things. I remember it very well. It was hard not to notice. I asked a couple of colleagues if the same thing was happening to them, and after they confirmed it, I decided to do a little research.

In short, the Information Protection Regulations, approved in 2016, had begun to govern the European Union. These regulations are considered the largest movement related to information protection policies in this generation, giving users much more control over the information that companies gather about them.

You can watch this video for a summarized visual explanation:

The reasons are simple. Today our lives are documented, digitized, and stored practically every day. Every photo, video, purchase, move, even our sleep cycle or exercise routine is being collected, stored, and even marketed or sold. Therefore, the need for data protection has never been more critical.

Web data is used to capitalize on our searches, transactions, preferences, and interests, creating a new sector in our global economy. GDPR spotlights the irresponsible use of this personal data and creates awareness of how this data is used.

In addition to this, these regulations act as a stimulus for change within organizations, since they require establishing new data management structures and reviewing workflows, thus creating more efficient and robust processes.

Even though these rules apply directly to the European Union, the reality is that they affect all users of these companies, regardless of where we are in the world.

Taking a more regional approach, in Panama, a bill regulating personal data protection has been discussed in recent years. On March 26, 2019, Law 81 was enacted, which adopts concepts similar to those in the GDPR, such as the prior, informed, and unequivocal consent of the owner, the concepts contained in ARCO (access, rectification, cancellation, opposition), and the right to portability. The legislation even establishes five working days as the term for modifying data that is erroneous, inaccurate, equivocal, or incomplete.

Regarding the collection of information through internet platforms and digital media, organizations must demonstrate that they comply with privacy policies in clear and simple written language.

On a more local and personal level, a few months ago at the school where I work, we began to have meetings about the actions we must take as an institution to guarantee compliance with these laws. These are just the initial steps, but an effective way to raise awareness among staff about any new initiative is to involve them from the beginning. I would have liked more teachers to participate in the meetings, but, as often happens, they were not involved. A draft of the information protection policy and GDPR was eventually created, but it has not been finalized due to the current pandemic.

For educational institutions, the knowledge and implementation of these GDPR best practices are neither quick nor straightforward. Still, they are relevant in many ways and at all levels, from initial education to university, face-to-face and distance, for students and families, for teachers, and for the marketing, technology, admissions, and HR departments.

GDPR delivers a vital wake-up call to information gatherers, yes. Still, it also informs users, educates them on the use of the information stored about them daily, and empowers and protects them, thus representing a powerful tool for the end user.

It is essential to raise awareness at the institutional level. Visionary organizations will work on GDPR alongside broader digital transformation projects by reinventing their processes. It is also necessary to offer specific training in the use of intellectual property, information protection policies, digital citizenship, and other related topics. All these crucial issues are set aside to prioritize others of equal relevance; however, they should be included in any company’s induction processes and reinforced throughout the year, especially in educational institutions.

Suppose you are unsure where your organization stands in the complicated process of complying with these norms. In that case, you might want to use this tool to check what your organization has already completed and what it is missing: the Controllers checklist.