GDPR: Is regulation tipping against social media?

Here is a short note on some important new regulations which may strengthen the hand of individuals against wrongdoing by the media, and on social media platforms.

In May 2018, the EU’s General Data Protection Regulation comes into force, which seeks to protect the personal data which companies hold on their customers and potential customers online. Its key provisions include a new right of erasure, previously known as the “right to be forgotten”.

According to the Information Commissioner’s website, the GDPR will mean:

Individuals have a right to have personal data erased and to prevent processing in specific circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• When the individual withdraws consent.
• When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
• The personal data was unlawfully processed (ie otherwise in breach of the GDPR).
• The personal data has to be erased in order to comply with a legal obligation.
• The personal data is processed in relation to the offer of information society services to a child.
• Under the DPA [the existing Data Protection Act], the right to erasure is limited to processing that causes unwarranted and substantial damage or distress. Under the GDPR, this threshold is not present. However, if the processing does cause damage or distress, this is likely to make the case for erasure stronger.

We are not lawyers and you should seek legal advice on its details.  While the practical effects are yet to be determined, we anticipate an impact from a PR perspective. 

First, if you are subject to inaccurate stories in the press or misuses of personal data which are being shared on social media, then gaining a remedy or correction without going to court may be easier than it is now.

Second, opinion does seem to be tilting towards increased regulation both of use of data and of social media organisations. This is most clearly shown by the US Congress’ response to evidence of Russian intervention in their election, particularly via Facebook.

In general, Boscobel advises taking a pre-emptive approach to avoid inaccurate reporting or trolling, such as taking a careful and considered approach to your communications. It will be just as important, post-implementation, not to say anything to journalists on the record (or even off the record, in sensitive circumstances) which you would not later wish to see in print. If there is an issue, it is usually better to take it up with the journalist or editor in the first instance.

However, plainly the world has become more complicated with the advent of social media, and the 24/7 approach at most media organisations. The GDPR shows that regulators are beginning to catching up with market developments.