The general data protection regulation (GDPR) comes into force on May 25th, 2018. It covers both the European Union and Great Britain- which amounts to more than 500 million users. WordPress, meanwhile, owns more than 50 percent of the CMS market and powers almost 28 percent of global websites. The result? If you’re using WordPress like we are at Pagely, GDPR matters. The challenge? Understanding how GDPR will impact WordPress deployments and what this state of affairs means for your organization. Worried about WordPress? Unsure about GDPR? Let’s dive into the basics. GDPR Basics and What We Know Right Now GDPR replaces Data Protection Directive 95/46/EC, and according to EUGDPR.org is “designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy.” Improving privacy and empowering user control over personal data are primary goals of this legislation- accomplishing this aim requires significant changes which impact companies at large, no matter what type of platform they’re using. These include: Increased Scope– The new legislation clearly lays out specific types of protected data such as name, address, ID numbers, Web location, IP address, cookie data, and RFID tags. Health, genetic, biometric, ethnic, political views, and sexual orientation data are also covered. Global Expectation– Under GDPR, companies processing the personal data of any subject “residing in the Union” are subject to new privacy requirements, regardless of their geographical location. For example, companies in the United States processing data for U.K. or French customers must abide by GDPR regulations. Substantial Fines– Companies found in breach of GDPR can be fined 4 percent of annual global turnover or 20 million Euros, whichever is greater. There is a sliding scale for minor offenses up to full-blown refusal to comply. Breach Notification– If a data breach occurs which will “result in a risk for the rights and freedoms of individuals,” notification must be made to regulating bodies within 72 hours and to customers “without undue delay”. Portability– Companies must have processes in place to provide individuals all personal data they have provided in a “commonly used and machine-readable format” upon request. How GDPR Impacts WordPress With so much of the Web leveraging WordPress, it’s worth having the conversation: What happens to WordPress sites and users when GDPR goes live? Companies using WordPress should address several specific areas and how each one is impacted by GDPR. Data collection: As noted by Code in WP, common ways that WordPress sites collect data include user registrations, comments, contact forms or analytics. Under the new laws, consent must be informed- it cannot be assumed. WP sites must be reviewed and amended to ensure all data collection follows consent policies. Best bet? Tell users who you are, why you’re collecting data, how long you’re going to store it, who will have access and for what purpose. Plugins: Site owners are ultimately responsible for the data collection and storage methods of any plugins or third-party software used, meaning it’s critical to audit existing plugin libraries and address anything that needs clarification before May 25th- there’s a WP GDRP Compliance plugin available through WordPress to help identify key issues. Third parties are also a critical concern here since the data “controller” – the company collecting personal data – is responsible for its handling and storage. As a result, businesses must ensure that third-party plugins are compliant with GDPR. Automatic consent: Companies using WooCommerce or other WordPress eCommerce options need to ensure that all marketing materials, newsletters, etc. are “opt-in” rather than “opt-out” since already-checked consent boxes are considered a breach under GDPR. According to IT Governance, approved options for lawful consent requests include clicking an opt-in button or link, selecting from “equally prominent” yes/no options or responding to an email requesting consent. Filling in the Gaps While it’s unlikely that substantive changes will be made to GDPR legislation before it goes live, any regulation this complex can include grey areas. Here are three worth watching: The Case for Consent – While consent is critical under the new legislation, it’s not the only lawful ground for processing data, creating confusion among organizations. For example, if you have an existing contract with individuals or must process data to meet legal requirements, consent may not be required. As noted by Lexology, there are six lawful grounds for processing data listed in Article 6 of the GDPR: Consent Contract Legal obligation Vital interests Public interest risk Legitimate interests Given the potential ambiguity of “vital” and “legitimate” interests, companies should be prepared for more specific guidelines regarding this type of processing after the law goes live. Best bet? Stick to informed consent wherever possible. Age Limits – Initial drafts of the GDPR set the EU age limit for choosing to hand over personal data at 13. But pushback changed this limit to 16 – under Article 8, member states can now choose a lower age if they wish. With protecting children’s data as a priority for this new legislation, WordPress sites must be diligent in obeying local age limit regulations and keep an eye on potential revisions. New Technologies – Article 35 of the GDPR lays out the need to asses the risk of new technologies for processing and storing data on the risk to personal information. The problem? The scope of “new technologies” isn’t defined, nor is there any template to assess risk. For WordPress deployments, this begs the question: What if a new plugin that streamlines data collection is considered a “new technology”? How do companies assess risk? What happens if/when specific guidelines are put into place? Here, it’s a good idea to err on the side of caution – don’t introduce sweeping policy or plugin changes in May and June – and keep an eye on GDPR news after the law goes live. The Current State of Affairs Given the current state of GDPR and potential areas of concern, there are three basic interpretations for WordPress site owners. These are simply observations and should not be taken as advice: Same old, same old – If your site doesn’t collect or store any information, this may be true, but chances are high that modification will be necessary. While this “wait and see” approach requires minimal spending and effort up-front, it could lead to substantial fines for non-compliance. Complete overhaul – This is the “all in” approach, using what’s known about GDPR to completely overhaul WordPress sites. It has the benefit of better alignment with upcoming policies but could see companies revising newly-minted policies as real-world interactions around consent and breach reporting compel legislative evolution. Finding a middle ground – Opting for a “middle ground” model may provide the path of least resistance for WordPress sites. By reviewing current consent, data storage, and ease-of-retrieval policies it’s possible to address the bulk of GDPR expectations and streamline the process of implementing new data-handling requirements as the law dictates. Resources to Stay Informed on GDPR Worried about WordPress under GDPR? You’re not alone. The new legislation comes with significant impact for data collection, informed consent and direct user control over personal data. Things you can do right now? Review your site before May 25th to ensure consent requests are obvious, clear and concise, all plugins follow GDPR guidelines and consumer information is properly stored, encrypted and available upon lawful request. Still looking for more help? Start here: EUGDPR .org – This site lays out critical changes coming with GDPR and how they could affect your business. WooCommerce Introduction to GDRP – Using WooCommerce for WordPress? This guide offers a basic overview of GDPR impacts. GDPR for American Organizations – Not operating in the EU? GDPR could still have a big impact. Educate yourself here. Bookmark these resources: https://www.eugdpr.org/ https://www.codeinwp.com/blog/complete-wordpress-gdpr-guide/ https://wordpress.org/plugins/wp-gdpr-compliance/ https://www.itgovernance.eu/blog/en/gdpr-when-do-you-need-to-seek-consent/ https://www.lexology.com/library/detail.aspx?g=9f53635d-4b06-49e6-a06e-eb3e47e301ba https://gdpr-info.eu/art-8-gdpr/ https://www.pcmag.com/article/356899/gdpr-what-americans-need-to-know We are doing everything we can to become experts on GDPR and make sure our sites, and whatever we do that impacts our clients, is covered. As always we are here as a resource for the WordPress community. Don’t hesitate to reach out and speak with our team.
B A N A N A S Pretty much sums up the last year – It’s been bananas. Never ending Pandemic, New Brands, Growth, Working towards compliance, New Product Launches, and more. This September 2021 is a very special month for us. Pagely, and by extension the entire multi-billion dollar Managed WordPress Hosting channel, is 12yrs old! Quick Flashback: In Early 2009 I opened up my IDE and started looking at some code we wrote in 2006 for a website builder based on WordPress. I added a few features to it, picked a new leet domain name, and in September 2009 – Launched Page.ly – The world’s first Managed WordPress hosting company. All the WordPress hosting buzzwords you know and love: Automatic Backups Automatic Updates Blazingly Fast Secure like Fort Knox 1 Click Staging Caching All. Of. It. Started. Here. Yes of course it is true we did not actually create everything under the sun, however the early work we did in the space is the parent to every Managed WordPress product offering available, regardless of the company selling it. Except billing for Pageviews, eff that noise – we don’t want any part of that. Team Retreat in 2015 Always Forward As Pagely begins it’s 13th year we have a strong wind at our back once again. I’m sure in some companies, especially investor fueled ones, growth is always fast and up while profitability is tied up in ropes and cinder blocks, then thrown off the end of the pier. In our company we’ve had our periods of growth insanity and just normal one foot in front of the other measured progress to increased profitability and high NPS scores. 2018 through most of 2020 was a bit of an odd timeframe for us when looking back – we invested heavily into the development of NorthStack and gained deep technical learnings. These lessons were then applied to Pagely as the decision was made to pause the NorthStack product while we felt out how the world was going to react to a fast spreading novel Coronavirus. Team Retreat Early 2020 As we came up to a major revenue milestone in 2020 we turned our focus inward to reevaluate our processes and to create new ones, address team makeup, and revisited our mission and values. We took the time to prepare for what was coming and to lay the foundational groundwork for our future goals. Less manic startup energy – more “we’re a real business now” mentality. We hired into newly created roles in team management, finance, enterprise sales, and compliance. Sally and I handed off more and more of the day-to-day responsibilities to our skilled team so we could take stock of where we are, and where we needed to go. Then we all worked together to formulate the plan to get us there. Allison’s (SupportOps Manager) dogs: Winne and Lola (“Karen”). The last year has been all about executing on that plan. We added 30% to our headcount – while improving and expanding our benefit offerings. We’ve engaged the services of an auditing firm and will shortly achieve SOC 2 – Type 2 compliance certification. Our brand glow up – which is the culmination of months of work by our Dir of Marketing Dave Amirault, and the creative team at Struck – will be launching momentarily. We’ve delivered on many of the requested features to our Enterprise clientele such as Single Sign On (SSO) to our services, and expanded support models and enhanced SLA’s. Back of the napkin math tells me our employees significantly increased their usage of PTO – after much encouragement and prodding from myself and their team leads. We launched Mercury just a few weeks back, which is a major win for our bottom line and our customers’ site performance. 20-30% faster network speeds on every request at cheaper data rates. Truly a win-win. These and many more items that are part of our strategic plan have resulted in a steadily growing sales pipeline and a pronounced upward shift in our momentum heading into 2022. Did I mention we are hiring? Get your tech jobs here. Times have changed. The important stuff has not. Jeff Matson’s doggo – Henry 2021 was also an emotional roller-coaster as we all bared witness to the, at times, abject selfish nature of people — and — the grit, empathy, and kindness of others. Sally and I have personally seen all of this up close and personal this year, a story we may share at another time. Each day though we took heart that by and large, the world is good and things tend to work out in the end. Keep the good people in your life close, and hug your kids every day. It costs you nothing to be kind. We lean on our core values as we make decisions and plan for the future. We also relied on them heavily in the past as we navigated the ups and downs of the pandemic. Sally has always said that if we do the right thing, success will follow. Doing the right thing by the people in our lives, our companies, and our communities is typically a selfless act with no expectation of return. At times though, the universe does surprise you with a healthy payback of goodwill, tenfold. There are lot’s of new faces at Pagely, as we said goodbye to others. It seems everyone has collectively reevaluated how they wish to invest their work time. Many leaned into the stability of good careers, others felt it was time to explore new options. At each coming and going I’m thankful to see new faces embrace our vision and values and old friends take a little part of the Pagely magic with them as they move forward to a new adventure. We are just as committed today as we were yesterday, and every day prior to becoming the best version of Pagely we can be. Branding work in 2021 Looking forward is as exciting today as it has been at each one of our 11 prior birthdays. I want to personally thank the team here at Pagely, and all of our customers and the fans we have in the WordPress community for being part of our journey thus far. Happy Birthday to Us. This coming year is going be the most interesting chapter in our story yet. I guarantee it.
