Editorial
Are marketing technology vendors invested in compliance readiness for the General Data Protection Rule (GDPR)? Or have they taken the casual, toss-up-a-few-blog-posts kinda approach? Tim Walters, partner and privacy lead with New York City-based Digital Clarity Group and a GDPR analyst, told CMSWire the commitment from MarTech vendors is all over the map. Taking an informal survey on MarTech vendor websites, he was surprised to see a lack of GDPR insight given the GDPR will "fundamentally affect the way most companies do business around any kind of personal data." Walters called the lack of information suspicious and problematic, adding lately he has seen some vendors “getting on the bandwagon.”
They surely have a lot of work to do, as we discussed in this week's report on MarTech vendors and GDPR compliance.
Beyond GDPR Whitepapers?
Walters is not alone in his thinking. "Vendor responses to the 'preparation for GDPR' question range from detailed, dedicated GDPR website pages to the offer of generic 'here's how you prepare' themed whitepapers," said Lisa Loftis, principal consultant for CI Advisory Services for SAS Best Practices. “And frankly, given the compliance deadline of May 2018, I believe that any vendor who is not deep in the throes of formulating solutions for this has already missed the boat.”
Zachary Paruch, product manager and legal analyst at Termly, where he works to build legal policies for American companies and vendors, thinks most MarTech vendors are only vaguely aware of GDPR. "As it is EU legislation, those of us in the US are skeptical of its scope and efficacy, particularly here in the states," he said. "MarTech vendors do not recognize the extent of the overhauls they need to make, and are waiting for the legislation to take effect in May to see what pans out."
Anne P. Mitchell, attorney and CEO/President of SuretyMail, believes far too many are behind the curve, and very few are ahead of it."In the industry groups to which we belong," she told CMSWire, "we're only just starting to see the panicked questions."
MarTech Vendors on GDPR
Let's crack the vendor code, shall we? We caught up with a few MarTech providers about their GDPR compliance plans.
Related Story: The GDPR Deadline is Looming: Here is How To Get On The Road To Compliance
Janrain
Janrain had already implemented EU-U.S. Privacy Shield self-certification and third-party audits and security controls for compliance with ISO 27001:2013 and the SOC 2 Type 2 Availability, Security and Confidentiality Trust Principles.
On Tuesday, Janrain formally announced two cloud security certifications, including one specifically for PII handling, which is a central part of the GDPR legislation, company officials said.
Sitecore
Ryan Donovan, SVP of product management for, Copenhagen-based Sitecore said the company is reviewing its internal practices and product features. "In the upcoming versions of Sitecore we will add new features to help our customers address GDPR compliance, including a renewed focus on personally identifiable information (PII)," Donovan said. "We are improving encryption (data at rest encryption) to personal data in the Sitecore Experience Database (xDB), and ensuring that specific features our customers may choose to implement in response to GDPR, such as Right to be Forgotten and Data Portability, are supported."
Campaigner
EJ McGowan, general manager at Campaigner, a j2 Global company, said Campaigner supports both single and double opt-in formats, provides forms to ensure acceptance and confirmation and permanently stores the IP address and timestamp of the confirmation.
"The platform will not send to customers who are in the 'pending' state of opt-in," McGowan said. "For customers who may not have opt-in information, we currently provide all the tools necessary to reengage them. We are considering wrapping these tools into a specific feature for reengagement if we find it something that will help them in their businesses."
Acquia
A spokesperson for Boston-based Acquia said the company is building on work it's done to obtain and maintain its EU-U.S. Privacy Shield framework certification, as well as work with customers around the EU model clauses that Acquia has also implemented. "We're focused not only on meeting our own obligations, but also on providing the tools that our customers will need to help them meet their obligations under GDPR as well," the spokesperson said.
Learning Opportunities
Webinar
Apr
30
Supercharge Contact Center Efficiency with Generative AI
Learn practical strategies to reduce post-call documentation time by over 8 minutes.
Register
Conference
May
1
Qualtrics X4 Salt Lake City 2024
Register
Webinar
May
2
Unleash AI for Crisis Management: Transform Threats into Triumphs
Learn how Sprinklr Insights provides real-time insights on current events, trends, and brand crises to empower your team.
Register
Webinar
May
9
Driving Customer-Centricity in the Financial Services Industry
Discover how financial organizations are leveraging generative AI technologies.
Register
Conference
May
9
An Irish Roundtable in the Valley: The Economic Impact of AI on the World of Work Stanford 2024
Exploring the Impact of AI On the World of Work with Irish diaspora leaders and tech business champions from the North of Ireland
Register
Conference
May
13
Gartner Marketing Symposium/Xpo Conference London 2024
Register
BloomReach
It continued to stress GDPR compliance in a release on it BloomReach Experience web content management platform last month.
"As a result, we have built out an end-to-end, privacy-by-design framework to help organizations comply with their GDPR obligations with out-of-the box tools available as part of the Bloomreach Experience platform," said Irina Guseva, senior director, product marketing.
BloomReach has built out custom data collectors, consent cookies and forms, the right to be forgotten and deleted upon request, ability for customers to specify what types of personal data they are allowing to collect and how it should be used, etc. All of that is already available directly in the BloomReach Experience solution, Guseva said.
Oracle
Redwood City, Calif.-based Oracle is working to operationalize the new data protection requirements applicable to Oracle's processing of online marketing and advertising data throughout the entire Oracle Marketing Cloud and Oracle Data Cloud service data lifecycle, a spokesperson told CMSWire. With the GDPR's focus on pseudonymization, data science, analytics and related technologies, Oracle intends to continue enhancing its current data handling practices toward that goal.
Oracle Marketing Cloud and Oracle Data Cloud priorities for GDPR readiness are:
- Reviewing the systems and processes that handle personal data
- Assessing the GDPR's enhanced privacy and security requirements
- Enhancing the diligence process surrounding the Oracle Data Cloud's data sources and Oracle's service providers
- Creating trainings and guidance for employees
- Monitoring developments and guidance provided by data protection authorities
- Updating contracts and privacy policies before May 25, 2018
Acxiom
Episerver
Episerver's recent EU-U.S. Privacy Shield certification and Peter Yeung's appointment as global data protection officer are part of a larger security and compliance initiative at Episerver to ensure comprehensive preparation for GDPR legislation.
Stockholm-based Episerver's Privacy Shield Certification is just one of many ongoing initiatives to reinforce its commitment to data protection and privacy and market leadership in cloud security, Yeung told CMSWire.
Episerver's focusing on privacy by design, affirmative consent, data encryption, retention, deletion and pseudonymization policies and procedures.
Demandbase
Dom Lindars, VP, product and marketing solutions at San Francisco-based Demandbase, said Demandbase has not historically captured or stored PII, but data protection and privacy is becoming a serious part of how they "manage data and work with customers and individuals." The organization is currently in the process of hiring a chief privacy officer.
SDL
UK-based SDL is getting ready for GDPR by using not only guidance from the Article 29 Working Party and Supervisory Authorities, but interactions with worldwide customers. "As SDL is a potential data processor — for a range of customers both in the regulated and non-regulated industries — we learn from our customers' interpretation of the GDPR requirements, which helps us develop commercially pragmatic solutions for GDPR compliance," an SDL spokesperson said. "We are monitoring progress with the promised UK Data Protection Act as it will be a key factor in considering the likely situation post-Brexit for processing personal data in our global business."
Act-On
David Fowler, head of digital compliance at Act-On Software, said it's "all hands-on deck" for GDPR compliance.
"We have evaluated all aspects of our business that may be impacted by GDPR," he said, "and have conducted both internal and external analysis of any gaps that we may need to address."
Learn how you can join our contributor community.
