Technology has transformed the retail industry from top to bottom. With mobile applications, social media platforms, and data analytics, retailers have increased their customer reach and improved their operations. With increased digitisation, however, the sector is exposed to data privacy breaches. In turn, national and regional regulatory bodies have required companies to adopt appropriate measures to protect consumer data.
Of these, the six-month old EU General Data Protection Regulation (GDPR) has proved to be the biggest regulatory challenge for retailers and e-commerce platforms, with fines of up to EUR 20 million or 4 percent of annual global turnover (whichever is higher). Despite the harsh consequences, though, companies has made mixed efforts to comply — as little as 20 percent of US and EU companies felt GDPR-ready in July, one month after the law came into effect in May 2018, while 65 percent of UK consumers believed the law had made no difference at all three months on.
Before, most consumers simply accepted the terms of conditions of opt-back-in emails without reading them. Since the GDPR, we’ve seen the increasing prominence of lengthy privacy notices on online platforms. But in both instances, the supplied explanations failed to provide consumers with a better understanding of, or control over, how their data is used. Clearly, companies need to be more transparent and develop simple, concise privacy statements.
While early enforcement has focused on big tech companies, retailers can’t get comfortable. The law applies to all organisations processing consumer data of EU citizens, regardless of the company’s location or sector. In short, the GDPR has established unprecedented regulatory attention on companies, and retailers must understand their obligations and exposure to liability.
Because the GDPR fines are retroactive, companies must adhere to best practice as they wait for the first test case and gain insight on the law’s implementation. Retailers need to be prepared. They must determine what data they have and what are their rights to use it. Transparency, accountability, and good faith will be the best defence against scrutiny from regulators or the public.
For those already struggling to familiarise themselves with the GDPR, the EU ePrivacy Regulation and even a US privacy law are waiting around the corner. The ePrivacy Regulation is an update to 2011’s “Cookie Law” that required disclosure of tracking cookies used on websites. It aims to protect the privacy of electronic communications and is partially designed to stop the use of customer data to provide targeted advertising. The highly visible impact on retailer targeted advertising and e-commerce, means the progress of this Regulation should be closely watched.
In the US, a federal privacy law might not see the light of day any time soon. However, the growing push for a federal privacy regime by lawmakers demonstrates a keen interest in protecting cross-border data flows. In short, compliance with existing and future global requirements (and their interpretations) will be ongoing challenge for retailers for the foreseeable future.
Fortunately, these obligations offer a silver lining for retailers. Consumers today demand accountability and a trustworthy environment to foster a long-term brand-consumer relationship. A comprehensive data protection framework will therefore add value to a retailer’s business. Beyond technical measures, data protection measures should include compliance, engagement with industry groups like information sharing and analysis centres, government relations in key markets, and collaboration with technology, payment, and related industries.
Author: Ivan Ivanov, Marketing Manager, Access Partnership
This article was originally published at Retail Operations Insights on 11 December 2018.
