Melanie
The Monday Morning Marketing Podcast is brought to you by Esther of IPA Group, bringing premier online promotion to your business.
Esther
And Melanie of STOMP Social Media Training, who empowers business owners to manage social media and marketing for themselves. Welcome back to another episode of The Monday Morning Marketing Podcast. Today we're joined by Eileen Ireland, GDPR specialist of ReGDPR. Welcome, Eileen.
Eileen
Thanks for having me here.
Esther
You're very welcome. Now, GDPR is one of these topics that we all have a love-hate relationship with. We love it when we're on the receiving end of it as consumers, and we absolutely hate it when we are the businesses having to dive into all the legalities and stuff. Melanie especially hates it because it was introduced on her birthday. But that's just personal.
Melanie
It's my list on the day.
Eileen
Yeah, yeah, yeah. It would have done that. Yes, it would have done.
Esther
Yeah, right. But we're going to get into the more legality end of it rather than as a consumer part. So tell us, first of all, why GDPR is important as a business no matter where you are in the world.
Eileen
There we go. There's the dog. Sorry. GDPR is hugely important no matter where you are in the world because it helps to protect your reputation of your business. It helps to show your business as an organisation that takes personal data and any personal data they're capturing, you take it seriously. In relation to the world, if you are actively looking for clients or if you have active sales within the EU or the EA, then you have to be aware of GDPR. It is a legal obligation. The same way as when you work on a business, you should by rights be having all of your tax and insurance and things like that up to date, their legal requirement. GDPR is exactly the same thing. It's as important as that. You had a client or a visitor or a supplier or an employer or an employee or anybody connected to your business in any way who you have the data for, they have the right to ask you of what data you're storing. You have to make sure that you are aware of that and that shows the importance of it within your organisation.
Melanie
So let's assume that people are starting up a business and they're getting their website, they're getting their bank account and everything else. Is there any start-up costs to setting up GDPR as part of their business?
Eileen
I would say essentially when someone is setting up a website, I always say do it proper the first time round. We have all been there setting up businesses. We know money is coming at you and going out as quick as it's coming in. What I say to people is that when you are setting up a website, make sure you are getting a proper privacy policy, terms, conditions, and that your cookies policies are correct. At the moment, I offer that to a lot of clients, and at the moment I am updating a lot. All of my GDPR policies for clients that I've had since 2018 because of the changes to due with GA4, so that's information that's been captured at the back end of a website, that has to be updated on all privacy policies. For a rough example now, for people to come to me who have nothing on their website, who are completely blank, a standard GDPR package, including a Zoom call with me for about an hour, a follow-up advice on all areas of their business is coming in about 3.25 plus fast. I will then contact them if they need to get any additional policies and I'll advise them the way they need to do it. I would say to people, start off at the very beginning. You do not need to have the whole GDPR programme at the very beginning because only certain things are applicable to you. As you develop as a business, we can review it in six months' time, we can review it in a year. Make sure your website policies are up to date. They are your shop front window. They are where you're getting your clients in. If you are looking for consent forms or intake forms, we need to look at those to make sure they're worded correctly. Lastly, I would say one thing you need to do then is especially set up a data deletion form, because that's recording any data that you are deleting. They are really simple steps that you can do. Then I'm an external GDPR consultant. I'm a qualified data protection officer. If you come across something that you're not aware of, you jump on the call, we have a chat. It could be that it's a five-second answer. It could be you need to put a procedure in place. But you don't need to spend thousands starting it off in your business. You just need to start off in the right steps and do it incrementally as you build up your business.
Esther
I know here in the UK, we also have to register with the ICO, which is the Information Commissioner's office. Is there something similar to that in the Republic?
Eileen
There is the Data Commissioner's office, but there is no registration fee in the UK. There is, depending on the size of your business. But no, you don't have to do it here. The only people that register with the Data Commissioner's office are, if I am acting as an external DPO for an organisation, I register my name against that business. If there's any issues that come up, I am the person that they contact rather than go into the business. I'm the liaison between the two.
Esther
Right. When you say issues that could come up, how bad are we talking here? Let's not sugar-coat it.
Eileen
That's like how long is a piece of string? It depends on the size of your business. We all have seen, and it sounds funny when I say this, like data breaches are like the sexy end of GDPR. People will want to know about them, all want to read about them. That's what catches people's attention. But we're all reading about, say, the Facebooks and the WhatsApps and the Twitters and all of that stuff.
Esther
And the Ryanairs and the Easy Jets.
Eileen
Exactly. They're multinationals. Technically, GDPR fine will take into account a certain percentage of your annual takeover or your annual take home. There is a percentage of that or there is a flat fee. For organisations that are that large, that's not really going to affect them financially. It's the publicity of it. But I would always say to people, listen, you're going to hear those stories and the cow come home. It's the local businesses that you should be concerned with. It's the refuge company down the road. It's the Dunnes stores that could be in my hometown. It could be a post office that could be doing stuff. It could be a guard station that could be... Those are local to me, and they are what I want to know about. Two things, like you get your fine, the data commissioner will respond to breaches that are reported to them. If there are a multitude of breaches in relation to one organisation or one shop, they will put that as an urgent, but they can go through the fine. It will be published, it will be out there in the public domain, it will be in an annual report that they issue, it will be across social media. That is the big thing. That is the damage to your reputation as opposed to the money aspect. Secondly, another area you need to look at for a lot of businesses is your insurance. More and more GDPR and having a GDPR programme in place is part and parcel of your insurance documentation. We tick these boxes as part of our business insurance, regardless of what element we're looking at, what business we have. We tell them we have this stuff in place the same way as if they ask you about car insurance. Do you own the car? Is the car registered or parked in your driveway? We tick all of these boxes to get a quote. When we take out a business insurance, we are more and more than likely ticking a box to say we've got a GDPR programme in place. We manage data, we do this, we have a training, we have so and so. If it comes out that actually you don't have any of that in place at all, you can't be looking at your insurance company, to be paying that fee or that fine for you because you've made your insurance null and void if you don't have it in place. There are loads of different knock on implications to having a data breach on the beginning and also as well paying for it and the reputation to your business.
Melanie
I know there has to be one person responsible within an organisation, but as a sole trader, does everybody need to do a start your own business course and leave that and then go and do a GDPR course and then do a health and safety course and then do, I mean, does it annual? Do you have to do every year or?
Eileen
No, what I would say to people is, first of all, if anybody looks at my website, you're going to see the you're going to see the image of an Ostrich with his head in the sand. That is the one thing you cannot do. I'm a sole business person. Loads of people I know are sole business people or SMEs. And when someone comes to me says, can I speak to the account person? I'll be like, that's me. Can I speak to the HR person? Yeah, that would be still me. It's like I'm wearing all of the hats. And whilst we wear all of the hats, I'm not expecting to somebody to go in and be as qualified in GDPR as I am. That's my job. But they can't pretend they don't know about it, or they weren't informed about it, or they haven't got it implemented within their organisation, even in basic form. It's the same way as health and safety. If you are carrying out something, you've got to be aware of those elements. I'm not expecting you to be a health and safety officer.
Melanie
You can't get training in GDPR.
Eileen
You can if you look at the places. Like, for example, this week I'm offering a Leo training, a Leo training with Galway for three hours covering the basics and GDPR for businesses. Things like that are out there. You need to be looking about it or you need to get into touch with somebody like myself who can say, Okay, would you give me an hour training on what GDPR is for my business? When I do my training with organisations, I don't have too many in it, I think there's about 13, I ask what businesses are going to be there. I ask when we start the training so I can focus my training towards them. Because what I need to know as an organisation is different to what Melanie needs to know, is different to what Esther needs to know. It's different to what somebody who has a bricks-and-mortar shop might need to know. Might be different to somebody who has a salon and maybe has medical information. Every business is different. 80% of GDPR is the same. It's the extra 20% that is explicit to your business. You can't turn around and say there's no training out there. There is. There is opportunities for training all the time. You reach out to people. It's not as expensive as people think it's going to be, and you then get individual advice for your business. But you have to be aware of it. You can't pretend that you didn't know about it or that, because there's no the Grace period in it. The grace period took place in 2018 before it was being started. That was the transition period. We are so far into it now, like we're five years into it now, that there is no Grace period. If you're starting up a business and start up business courses should be including GDPR. It's a legal requirement.
Esther
So when you say breaches, what are we talking here? Are we talking email addresses being leaked? What?
Eileen
Okay, quick question. I do this in all of my training, either on Zoom or in person, and I'll ask it to yourselves and to all of your listeners. Have you ever been involved or have you ever been part of a data breach? That you're aware of?
Melanie
Not that I'm aware of, no.
Eileen
Okay, then you are not aware of them. Every single one of us here has taken part in a data breach. Absolutely. You have shared maybe a contact number with someone that you didn't get permission to share their number for. You might have shared an email of somebody that you didn't have to share that email for. You could have been added to a WhatsApp group that you didn't give anybody permission to add you to. All of those are data breaches. That is my data. I don't give you permission to share it with somebody else. Now listen, I live in the real world. That is why a lot of people come to me, because I'm a realist in how we work. I give examples. I would be part maybe of a network group and somebody was saying to me, Do you have the mobile number for so and so? I know they're in my network group. What I do is I go back to that person and I say, so and so is looking for your number. Am I okay? Can I share your number with them? Or alternatively, can I give you their number and you contact them? I don't want to be the person that's sharing data without anybody's permission. And that happens all the time.
Esther
But is it not different? Okay, so that's personal information, but in a business context, your number and in a lot of cases, your email address and stuff is on your website, so it's there for people to see.
Eileen
that's fine. If it's in the public domain, say, for example, you've got an info, like my one, you would have hello@regdpr. That's on the public domain. You put that in, you're going to find it on my web page, you're going to find it on my contact page. But what about if you've got employees within that organisation whose email addresses aren't out in the public? I might have an Eileen at ReGDPR. I don't, so don't be emailing me on it. Don't get yourself carried away. But for example, nobody knows how big a business is. You could have 20 people working in that and they could all have individual email addresses. They're not in the public domain. If you Google them, you're not going to find them. You can't share them. Okay, a main phone number for your organisation, if you look at it, you will probably see on my website. I don't have my mobile number on my website. I'd be antisocial like that. I'd rather people emailed me. But because I do virtual assistant work as well, my number will be out there, so I don't mind people contacting me, but I don't have the right to share anybody else's number. You have to look at the data you're sharing and say, Okay, if I am unsure about it, can I contact that person and ask that okay for me to share their email address or share their phone number. And that's all you have to do. You cannot assume consent from anybody else. Now, as I say, I'm not such a stickler for it. I always use an example. Say, for example, back in London, I was born and brought up in London. I've got a sister over there. I've got best friends still over there. If I knew that my sister came back to me said, Can you give me the number for Rita, the friend of mine. I know Risha knows my sister. I know they've already connected. They've met many times. And it could be that she just doesn't have the number. I've got no problem with that. I know Risha wouldn't have an issue with it because they've already connected. They know each other. Those situations when we're in a private capacity and it's friends and it's families and we're all interconnected, especially in Ireland, we all that. That I've got no problem doing, because I know that Risha won't have an issue and come back and say, Well, where did you get my phone number from? She'd be glad she's got it for whatever reason. Those are different situations. You have to look at the situation and say, Wait a minute now, can I assume consent for that person? Do I know them well enough? Is this a business contact? Will it come back and bite you? Because all that person has to do is complain to the data commissioner that you use their data incorrectly and they then can lodge a claim against you. So you've got to be aware of that at all times. Put yourself in that other person's shoes.
Melanie
Now, you just got me thinking there. Great segue, by the way, there, Riley. You got me thinking there about emails that I've received certainly over the last five years, and especially on my phone, you can see it's got the unsubscribe button at the top or wherever. It might be different on each phone. But then there's some that send you emails and you're not really sure where they came from and there's no unsubscribe and they don't even say, please return saying, please remove. What can you do about these, and usually they're scams, what can you do about these particular emails, if anything?
Eileen
I've had instances exactly like that, and they remind me to tell you about another instance I have which are unsubscribe, which I'm going through at the moment because it's different again. Those people, and I've had them, we've all had them, I go back and say, Where did you get my data from? How did you to get a hold of my email address and tell them that, and if they don't reply to you, say you've got 24 hours to take me off whatever list you have me on. And if they don't and you're still getting them in, report them to the data commissioner. The data commissioner's website is so easy to understand. It literally is report a data breach. There's a button there. You just press it and you report it and it gives you then a reference number. You then, if they still email you, you can go to a solicitor and say, listen, I've told them to take me off whatever list they have me on. Or alternatively, another route you can do is lodge a data subject access request, which means they are obliged to come back to you within 28 days and give you the information as to how they have your details. Show you the form you filled out, show you the consent you gave them, show them where they got their email address from. If they don't do that again, that's a data breach. You can go to the solicitor and put a claim against them. That's that one. I'm going to tell you about the other one that I have. Unsubscribe buttons are great. When used correctly. Listen, we're all running a business. I have a newsletter function on my website. If people want to sign up, I have it on my website. I am using Maila Light, but there's loads of platforms which gives you the unsubscribe option. What it is, is two ways how it works is it's called a double opt-in. Technically, if you want to look underneath the GDPR language, double opt-in isn't actually mentioned, but it's best practise because it's linked into consent. What happens is that I want to sign up to your newsletters. I fill out my email address. I then get an email back in asking me to confirm that I want to sign up. That's my double opt in. I then will receive your newsletters and I could be going, Okay, listen, I'm getting a lot of these now. There's too many coming in, which happens a lot. I want to unsubscribe. You then click that button. It then brings you to a platform. You can unsubscribe. You can give a reason if you want to. That's what happens. That is best case situation and that works 95% of the time. Brilliant. I've got one particular organisation and it's difficult because I suppose in some ways I know the organisation, I know the people that are running it, and I am fed up of getting their emails about their monthly events, about this and about that. I've unsubscribe to the cows come home and I'm still getting them because all they're doing is they're copying and pasting the stuff over to me in an email. I've gone and I actually have seen it on other... Because I manage other clients' emails. I've seen them coming up there. I'm actually at the stage now where I'm going to email them back and say to them, Why are you not unsubscribe to me? Do you know that what you're doing is illegal? It's against GDPR. I'm very much a case of I know I'm going to meet these people again at conferences and networking events and things like that. I'm happy to stand over what I'm doing. I've given them enough time and enough opportunities to update their lists. I know what's happening. Whilst you may think, Wait a minute now, I know I'm subscribing is taking me off the list. Why am I still getting that email back again? It's because they're not connected correctly at the back end. They seem to be physically going in and copying the list. I was asking somebody who's more tech about this than I am. They seem to be going in and physically copying the list every month and putting it into their email. That is on my to do list within the next couple of days, I will be going back to them to take them off that. We have that option. We have that right to do it. It's annoying that I know I'm going to come across paths with this person and they would be a confrontational person. I've got no problem with it. I've got no problem with it, because I could shout it till the roof's come home. And that could be a blog post that I might do this week just to ram it in a little bit. But that's why that's happening, and it happens all the time. And it's something that you have every right to be on top of and actually go back and query 100%.
Melanie
Brilliant.
Esther
Yeah, that brings me on to another question. So I saw in a group the other day that somebody was asking for help with their email marketing list and asking for people, asking if somebody could come in and help them to update obviously incorrect email addresses. So people that had put gnail instead of gmail.com and things like that. How legal is that to do or should they just take them off the list and if they want to come back onto the list and subscribe again at some other time, that's perfectly fine. Maybe it was a typo. How should they deal with that? Because there were two very different options coming out of that one.
Eileen
To me, I would look at how they gathered that data in the first place. Is the list that they've got a combination of where they've merged a couple of lists together? Has someone typed it in from a handwritten form?
Esther
No, it's coming through their website. But the person who owns the email address made a typo, supposedly.
Eileen
Well, I would say if it's coming through their email, if it's coming through their website, and that is what a client or a visitor typed in and is incorrect, you do not have the right to go over it and change it. The person might have typed it in deliberately, because then they know they're never going to get the emails. They're always going to bounce back. So I would take that off of the email address. You sometimes get an email addresses that you think, my God, these aren't real. These can't be real. But email addresses change all the time. I was looking at one the other day that is just .co. And I went, okay, so I checked it.
Mine's .co?
Yeah. And I hadn't heard of it before. And I went, all right, okay.
Esther
I've had a dot co for the last eight years, nine years.
Eileen
Yeah. No, I've only had people come in to me lately with a dot co. We're so used to adding a dot ie or a dot com or a dot co.uk thing. The dot co, absolutely. You're always going to have things come to you. But if somebody puts in, say, Gmail and gnail thing, I would, if it was me, be going in and deleting these people, because if they like you that much, they're going to see you on social media. They're going to follow you. They might not have realised they're not getting emails in. They can re-sign up again and do that. Do not go in and assume that you've got the consent to override us. Secondly, I always look at marketing lists and say, OK, how confident are you that you got those marketing lists correctly and you've got the consent on them? That's a huge area. I would have had a few clients come to me going, OK, I've got like 10,000 on my marketing list. And I'd be going, OK, that's great. Where did you get them from? And they'd be like, Oh, yeah, when I had another business, there was 10,000 on that. So you can't transfer them over. Absolutely not. Secondly, it could be, OK, because someone purchases something from you. You do not have the right to add them to a marketing list. And there are so many people that do that. They have to opt in to want to join your marketing list. I might buy something from somebody. That might... It doesn't mean to say I want to add to your marketing list. If I want to add to it, put the link at the bottom and let me add myself to it. Do not add people to your marketing list. So any time someone has a marketing list, I always go back to them and say, OK, have you got double optins on this? Can you trace where they've opted into this? If are unsure and you think they go back to forms that maybe they signed ages ago when they were doing paper forms at events, OK, they've opted in on that, that's fine. Send them an email and maybe check and make sure that they still want to be added on, that this is your new marketing platform, because at that time you might not have had a marketing platform. You might just been emailing them. Ask them if they still want to be added on, and this is their click of their link to do that. If they don't delete them off your list. I would rather have like... And people get really excited about sizes of marketing lists. I don't see the point of that. I'm not one of these people are getting excited about that because there's no point saying having 500 on your marketing list if only 25 people ever open it. Only 25 people may ever be a client from your marketing list. I would rather have 25 active on my list than have 500 and 475 of them just don't care.
Esther
Eileen, we could talk about this for the next three hours, and I'm sure that all our listeners have many, many questions, but we have to wrap it up at some point. So how can they get in contact with you with all their questions?
Eileen
I am in a unique position, as anybody will know, is that there's nobody else called Eileen Ireland on LinkedIn. That's the best thing to do. Connect with me on LinkedIn. There's only one person with my name on it and we can get in touch or they can email me on hello@regdpr.com. Any queries at all? Anything they're not sure about? I'm happy to jump on a Zoom on a call with people. One thing I don't like is I can't stand it when people are really confused and are too afraid to ask the questions. Ask me the questions. I am the queen of a silly question. If you think that something's coming in, you need to be worried about, Five-minute call with me and I let you know what you have to do. So even link in with me on LinkedIn and you'll see posts that I'm putting up about different changes that are taking place. Say, as I was talking earlier about the GA4 to do with Google, anything there. I've got blog post waiting to go up about testimonials, when you should be posting them, about when you should be hiring external staff. If you have part of a committee, how do you do GDPR on that? They're about three or four blog posts that's just waiting to go up at the moment. So connect with me on there and you'll find out a lot more information as well.
Esther
Brilliant. Thank you so much for joining us today. We'll be back next week with more Monday morning marketing until then. Bye bye.
Melanie
Bye, guys. Have a great week.
Esther
Do you like it any better now, Melanie?
Melanie
Well, it was a nightmare at the time, but I do understand why it's important to have GDPR in place.
Eileen
I thought you were talking about Zoom.
Melanie
No, it's just a minefield, isn't it? There's so many demands on businesses, and we're meant to be over so many different things, and especially startups. They're afraid to ask for help, and they don't know how to prioritise stuff. I think that's why podcast like this is so important, because it helps people understand there are people out there that can help. There are people who care, that aren't out literally to rip you blind financially.
Eileen
Absolutely. That's why I always say to people, Listen, I'm not the person that has to... I'm not going to charge you to talk to me. No, I'm not the bloody queen while she's dead, but I'm not the king. But I'm like that. It's like I'm not charging you. I'm not that important in the world. If you want to talk to me for 10 minutes, half an hour, I'm not going to charge you for it. If I have to go off and create a document for you, I'm not going to rip you off with it. If I think someone is starting off new and I think they're really in trouble, a lot of the times I'd be like, Listen, I just wait to see if.
