How does the new LOPD / RGPD affect SMEs in Spain?

The Internet is increasingly present in our daily lives, so there is necessarily a set of legal regulations that regulate it.

In 2018, the General Data Protection Regulation (RGPD), which strengthens the guidelines of the Organic Law on Data Protection (LOPD) currently in force.

This European Regulation will not only have an influence on the common Internet user, but will also greatly affect SMEs, mainly in everything related to the handling of data and information, both of employees and customers.

SMEs must therefore prepare themselves to comply with these regulations, and to do so it is necessary to know how they apply to them.

Legal regulations in Spain

In Spain, data protection is a fundamental right enshrined in the Spanish Constitution and is regulated by the LOPD.

Like any law, it must be complied with by everyone, so that any person, company or organization whose business activity involves handling personal data must fully comply with it. It therefore applies to the handling of customer and employee data, thus protecting not only individuals but also companies.

The GDPR strengthens these efforts to protect the identity of Internet users. Its primary objective is to force companies to install secure and reliable systems that absolutely safeguard the security of the data provided by their customers and employees, giving them the possibility to fully control their data at all times, even after their death.

This new regulation applies to all European Union nations and was published in the Official Journal of the European Union on May 4, 2016. However, all affected countries have until May 25, 2018 to fully implement the GDPR and adapt their laws to this Regulation. With this, all data protection laws in Europe will be unified.

In the case of Spain, this translates into a new version of the LOPD including the new features of the RGPD and maintaining the aspects that already had the law and that do not contradict the European regulation.

Implications for SMEs

In this scenario, SMEs, however small they may be, must comply with the law from the very moment they begin to handle personal data, whether of employees or of other companies.

The most significant changes with respect to the previous regulations are as follows:

• Explain the reason for requesting personal data. When requesting data from users of the SME's website, the SME must make clear the use or purpose for which the data will be used. Texts such as “this website uses cookies to improve the user experience” should no longer be used. Now it must be explained what these data are specifically for, whether to develop advertising tailored to their age, gender, area of residence, etc., if it is to geolocate it or if it is simply to save your session as a user. In short, it will be necessary to inform in a clear and concise manner the purpose of requesting such data.
• Granting the ability to manage and change data electronically. If the personal data was provided by e-mail, users will have the right to modify it at any time upon request.
• Adjust legal notices to the commercial activity of each company. Legal notices clarifying the terms of purchase of items, for example, must be tailored to each company and explain the conditions of sale. This is the case for a multitude of online stores, many of which are SMEs.

Standard legal notices that are cut and pasted, and which are often in inconspicuous areas or in very small print, will not be valid.

This enables professionals and entrepreneurs to express their creativity in the elaboration of these notices, customizing them and making them fully visible, giving them an attractive form and fully complying with the law.

• Allowing minors the right to be forgotten. It is important for companies to carry out the total or partial deletion of data provided by minors when they deem it necessary. To this end, companies must have an agile system that allows the deletion to be carried out as quickly as possible.
• Limit data retention. The data provided by users must have an expiration date. Or at the very least, there must be a justification for their retention once the purpose for which they were requested has been fulfilled. This also implies that companies should allow individuals to leave instructions about the use of their data after their death.
• Adapt the contents for children under 16 years of age. In the case of minors under 16 years of age, companies must adapt the content they publish in such a way that it is understandable to them. In addition, the introduction of data must be done with the consent of the parents or, failing that, a legal representative.
• Assign a data protection officer. Companies must have a person in charge of handling everything related to data protection. The delegate will be responsible for attending to all user rights, including the right to portability. That is, the possibility for the owners of the data to retrieve them and transfer them in a format that allows them to pass them to another data controller.
• Implement a culture of prevention. Beyond acting when they are reported, SMEs must implement a culture of prevention. A good idea is to carry out awareness campaigns and give talks to their employees. The idea is to train them so that they know what they can and cannot do with the data supplied by customers.

What can SMEs do to protect themselves?

As small companies, SMEs cannot afford the costs of non-compliance with any of the LOPD / RGPD regulations. Costs that not only involve the payment of penalties, but also the loss of customers and potential partners. A legal scandal of this type can have repercussions on any business relationship they establish.

For this reason, companies must start taking precautions to optimize the security of their customers', employees' and their own data.

The sending and distribution of documents, for example, is often done via e-mail, a method that in many cases is actually quite problematic. Inconveniences such as serious errors in sending, disorderly communications and, above all, poor information protection, make e-mails an unsafe tool.

In this sense, Bilky is an excellent alternative for those SMEs that want to take care of their privacy and that of their customers, as well as optimize their communications and, of course, comply with all regulations regarding data protection (LOPD / RGPD).

Bilky offers consultants and companies a service for sending and distributing all kinds of documents to their clients and employees. Thus, those who use this software get their own portal with username and password and send and receive documents such as payroll, contracts, certificates, etc. through it. In this way the documents do not travel over the public network, i.e. they are not attached to an e-mail.

The support of document management companies such as Bilky is a way to achieve compliance with the new legal requirements regarding data protection in an easy and simple way, and such compliance has a very positive impact on the image of SMEs.