General Data Protection Regulation (GDPR)The Expectations vs. Realities of GDPR

What Effect Did the General Data Protection Regulation — or GDPR — Really Have on Merchant Operations?

The General Data Protection Regulation, commonly abbreviated as the GDPR, was one of the first global data protection policies. Officials claimed these regulations would “strengthen and unify data protection for individuals within the European Union.” That was before implementation back in 2018, though.

Did the initiative really deliver on that promise? What more could be done?

In order to fully grasp the benefits and pitfalls of GDPR, we should reexamine what it is, its intended purpose, and the unintended problems it might have introduced to the global market.

When Did GDPR Go Into Effect? Who Does it Apply to?

The General Data Protection Regulation is a regulation in data protection and privacy regulation implemented as part of EU law on May 25, 2018.

The GDPR applies throughout the European Union and the European Economic Area. The ruleset is an important component of EU privacy law and human rights law, particularly Article 8 of the Charter of Fundamental Rights of the European Union.

GDPR was revolutionary in the sense that it was the first effort to extend EU data protection laws to international businesses. Both local and international businesses that sell to EU customers were impacted by the regulation. Any company that controls or processes personal data of EU residents is subject to the law.

What Purpose Does GDPR Serve?

In short: the objective is simply to protect the privacy of consumers and keep their data safe.

Obviously, it’s not the intent of most businesses to use consumer data in a nefarious or irresponsible way. Regardless, the GDPR was implemented in response to consumer concerns about how businesses use and retain that data.

Those concerns weren’t unfounded. 88% of UK companies suffered breaches between 2019 and 2020. The figure rose to 90% in Italy, 92% in Germany, and a whopping 94% in France, the concern is definitely warranted. Indeed, according to international insurance group Hiscox, one small business is successfully hacked in the UK every nine seconds. 

The purpose of GDPR was to increase and mandate consumer protections in the EU and abroad. The legislation broadened and diversified the definitions and utility of privacy terminology.

GDPR Affects Anyone Who Does Business in the EU

If you sell goods or services to anyone that resides within, or is a citizen of the EU, then GDPR applies to you. This is true regardless of your location. So, even tech companies in the US could be subject to the law if they might track, analyze, and market to EU citizens. So, the only way to opt-out of General Data Protection Regulation is to refuse to do business in the EU.

Businesses are required to procure and prove that they have invested in technology that will detect data breaches and allow for disclosure within 72 hours. Failure to comply with GDPR rules like this could be extremely costly.

An inability to establish this effective “privacy by design” structure will result in severe consequences. Fines of up to €20 million or 4% of annual worldwide turnover (whichever is greater) could be assessed.

Businesses must consistently demonstrate that they are doing more than complying with the letter of the law regarding GDPR rules. They must also actively innovate and implement new data solutions that protect consumers.

This doesn’t necessarily seem like a bad thing, at least from the outside. But, as most merchants will already know, it can become an expensive and time-consuming process. 

Key Policy Changes Imposed by GDPR

As mentioned above, EU policymakers created GDPR regulations to standardize and improve consumer protections. It was also to broader consumer understanding of — and agency over — their own data.

The law redefined much of the terminology concerning the mining, storage, and processing of consumer information and privacy to achieve this goal. These changes include:

The 7 Principles of GDPR 

Article 5.1-2 of the General Data Protection Regulation lays out the seven principles the GDPR aspires to address. These are as follows:

These seven principles are meant to ensure that individuals have the right to refuse the use of their data for privacy purposes. They also have the right to restrict businesses from obtaining or using this information without consent. 

Does GDPR Deliver on Expectations?

Love it or hate it, the General Data Protection Regulation did increase protections for EU consumers pretty much across the board. In this way, yes, it does deliver on its central promise.

From this standpoint, GDPR is an overwhelming success. It has elevated consumer trust and confidence, improved transparency between merchants and consumers, increased competition between companies, and helped mandate necessary fraud precautions that affect everyone. 

Despite all of this, many merchants feel GDPR has fallen short of the marks. It has not streamlined regulation in their view; indeed, many merchants claim GDPR remains an infuriating, complex set of rules that fail to provide either benefit in any meaningful way.

According to Law.com, there are glaring enforcement disparities at the national level. These stem from gaps in resources, diverging enforcement traditions, and different interpretations and applications of the 80-page privacy bill.

In a further failure, EU-wide harmonization of the rules has also been an issue. The EU’s executive body simultaneously hails the bill as “an overall success” while admitting that “harmonized and consistent implementation and enforcement of the GDPR across the EU” fail to meet preferred benchmarks. 

So, what’s the deal here? Does GDPR work, or not? The answer, much like the law itself, is dense and complicated. 

Realities of GDPR

Naturally, when the General Data Protection Regulation came into play, every merchant from Florida to Singapore freaked out. Essentially, any business that has customers in the EU region believed the regulations would utterly hamstring their businesses.

They had no idea what compliance would require, how much it would cost, nor how non-compliance might affect them. Add to this a general chafing regarding their inability to opt-out regardless of their size or vertical, and you had a recipe for panic. 

While inconvenient to some, the protections that the GDPR put in place are great for customers. Buyers are generally happy to spend money with companies who hold their best interests at heart. That said, there are a few downsides to GDPR that still affect many merchants today, especially here in the US, where the law is less forward-facing:

However a merchant feels about GDPR, there isn’t much wiggle room when it comes to following the compliance guidelines. Businesses that fail to comply with the rules are in for a rude awakening, as hefty fines and legal action are very real possibilities.

Take Control of Data Protections

GDPR increased, streamlined, and improved consumer data protections by holding merchants accountable for the data they collect and store. That can certainly be considered true for the consumers impacted by these laws. For merchants, though, the law often presents a further complex hurdle to regular business practices. 

However you feel about the regulations, if you intend to do business in the EU, then the General Data Protection Regulation applies to you too. That said, the protections laid out in the GDPR shouldn’t come as a surprise by this point– and what’s more, they shouldn’t feel exclusionary to any business, either. 

Even if you are not yet an international seller, it would be a good idea to stay one step ahead of the game by prepping your business for compliance in advance. The additional benefit to these preparations can also decrease your risk of fraud, increase consumer trust and loyalty, and ensure that your business is future-forward and prepared for any eventuality. 

A few best practices include:

To take this future-forward approach one step further, it is a good idea for merchants to approach fraud prevention with the same amount of forethought. 

Adopt a Multi-Layer Strategy

To remain compliant with GDPR, you will be required to adopt a strong, multi-layered approach to fraud prevention and management. You need to useadvanced tools like AVS, CVV, and geolocation… to name just a few. The more safeguards you have in place and working together, the better. 

Fighting back against fraud isn’t going to be your only concern, though. Although GDPR doesn’t directly impact your rate of chargebacks, your business will be affected by them no matter where in the world you operate. 

Pairing effective fraud and chargeback management together can help your business not only meet the demands laid out in GDPR but could help you exceed them. To make this a reality, having a professional team with industry knowledge and expertise in your corner could be exactly what you’re looking for. 

No one understands this better than the experts at Chargebacks911®. That’s why we offer the most comprehensive chargeback management services and products available. Call us today for your FREE ROI analysis.