• Published in Combined Media                              

---

An interesting aspect of how the GDPR will affect marketing departments is the way social media platforms are planning to change the way they handle personal data to comply with the new regulation. Because of these changes, the imminent General Data Protection Regulation that will come into force on the 25th of May 2018 will have a major effect on how businesses will be able to use social media to promote their products and services.

But how are social media platforms going to adapt to the changing regulation and how is this going to affect social media advertising?

The most important provision affecting marketing use of social media is the way businesses will seek consent to use or store users’ data. Effectively, consent and data use will be covered by terms and conditions and privacy notices of each social media platform, to which both users and advertisers agree to.

Does this mean that advertisers have nothing to worry about? That’s not quite the case. Let’s see for example how two social media like Facebook and LinkedIn plan to cope with the new data law and what this means for advertisers.

On the 29th of January Facebook released a statement where it explained how it is going to comply with data protection laws. More information about Facebook and the GDPR is also available here. Firstly they have assured that the Facebook team is working to review the tools people use to manage their privacy, as well as hiring a Data Protection Officer, as required by the new legislation to companies that process of special categories of personal data on a large scale.

Facebook also made clear its position as either data controller or data processor. This is key for businesses to understand as the two roles have different duties and responsibilities under the new legislation. In most cases, Facebook is going to serve as data controller which means that it must comply with GDPR rules on how it collects and uses personal information. A data controller “is the individual or the legal person who controls and is responsible for the keeping and use of personal information on computer or in structured manual files.“[1]

As a data processor however, Facebook has a limited set of responsibilities, mainly regarding the safety of the data processed.

As a data processor however, Facebook has a limited set of responsibilities, mainly regarding the safety of the data processed. This is the case when companies use Custom Audiences – lists of customers that companies have on their database that they can use to target with Facebook ads; another case is when Facebook processes campaigns’ data on behalf of the company to provide insights about the campaigns’ performance or when using Workplace Premium. Particularly when using Custom Audiences, companies should make sure that all the data processes comply with the “criteria of legitimate data processing”, that is in accordance with the principles of data protection and that specific requirements are applied to sensitive categories of personal data[2].

Similarly, companies will not be allowed to use their followers’ details, such as emails, for an email campaign. In fact, personal data can be used only after acquiring explicit consent from the data subject. It doesn’t even need to be as personal as an email address: even using social media handles in a CRM system will need the subjects’ consent.

In a statement last month, LinkedIn clarified that the GDPR will have some effects on LinkedIn Marketing Solutions products due to some updates with their customers’ agreements. In particular members will have “more control over how their data is used for targeting purposes, such as their demographics and third-party data”. This means that LinkedIn members will have the option to opt out of allowing use of their demographic data in ad targeting. LinkedIn will also delete personal data stored in advertisers Campaign Manager platforms if not used or inactive for 90 days.

Another interesting aspect mentioned by LinkedIn regards Lead Generation ads and Lead Generation forms. LinkedIn makes it clear that the Audience Management partner and LinkedIn are both processors of the data, while advertisers are controllers of Lead Gen Forms data. Thankfully, LinkedIn comes to help by specifying that “with respect to data gathered by customers through the lead gen form, we updated that form to better call out the customer’s privacy policy and how it will use the data, along with the users’ consent to it, as described here. In addition, members will be able to revoke their lead gen submission and have the data deleted from LinkedIn at any point during the 90 days period during which we hold the lead data.”

In the case of Lead Generation ads, Facebook is “currently reviewing our disclosures to determine whether any changes need to be made regarding user consent to sending their data to the advertiser and further processing by the advertiser.” In particular, advertisers will probably need to be very careful in adding a suitable Privacy Policy and Disclaimer to lead generation forms on any advertising platform. Moreover, consent to process the data will always need to be explicit, unambiguous, affirmative (no pre-ticked forms), freely given, specific, and informed[3].

Here’s an interesting article on how to implement the new legal requirements on Facebook Lead ad forms.

Like for Facebook Custom Audiences, LinkedIn mentions how advertisers (data controllers) will be responsible for any personal data provided to LinkedIn particularly in the case of LinkedIn Matched audiences (that is, LinkedIn’s version of Facebook Custom Audiences), and for the content of the ads. The good news is that data advertisers will not need to take any additional action to use LinkedIn Sponsored InMail, unless of course they are targeting their own databases, in which case they will need to have the right under the GDPR to provide LinkedIn with any personal data. It also states that high-performance targeting and analytics capabilities will not generally be affected, except when the GDPR will require LinkedIn or advertisers to obtain an explicit opt in.

In short, when a company is providing personal data to any advertising platform, for example in the form of an email list, they will need to have the right to do so under the GDPR. Regarding lead generation, we expect that every platform that enables generating leads through lead generation forms will facilitate the expression of consent in the terms specified by the GDPR and the addiction of a clear privacy policy in the form. But in the case of Lead Generation Ads, the main responsibility is certainly in the hands of advertisers.

[1] https://www.dataprotection.ie/docs/Are-you-a-Data-Controller/y/43.htm

[2] http://ictlaw.com/data-protection/duties-of-data-controllers/

[3] https://www.taylorwessing.com/globaldatahub/article-understanding-consent-under-the-gdpr.html