Do Bloggers Really Need To Worry About Data Protection?

This is a guest post from Graham Tappenden.

It may be that I have just frightened off a large portion of Mike's readers with the title alone. I hope however, that I have not, because this is serious stuff and I bet most bloggers do not even think about it. And yet many - especially businesses - are doing things on their sites that should make them think hard about data protection legislation - before someone else does the thinking for them.

Image: Salvatore Vuono / FreeDigitalPhotos.net

Let us start by defining "data protection" and getting one of the popular myths out of the way.

Data Protection is the not the same thing as IT security.

If you make sure that your computer has a virus scanner on it, your network has a firewall, and your blog is secure and backed up, then that is IT security. (You do backup your blog, don't you?)

Data Protection is concerned with personal data, and protecting people's privacy. It affects you as a business when you store data about your employees, your customers, or simply anyone who has contacted you about your products.

I guess most bloggers do not have employees, but if they are selling products then they certainly have customers. And what about the readers?

Here are some examples of the names and e-mail addresses, that I suspect many of you are collecting:

people leaving comments on your blog
subscribers to your mailing list
purchasers of your e-book or membership site

Depending on where you live in Europe, you will have to follow different rules. But many of these rules are the same across the EU, and at the very least you should be aware of what data you are saving - and as the title says, you should be protecting it.

In some EU countries you have to document this in a particular format, in others you have to nominate a data protection officer, and in some you even have to notify a local government agency that you are storing the data. Get it wrong, and you can in for a hefty fine.

But what if you do not store the data yourself, but use an online service instead. Is your mailing list with Aweber? Is your e-book being sold on e-junkie? Do you use a plug-in like Disqus?

Then document that instead! But be aware that you can still be held responsible for the data, as they are storing that data for you and in some cases being paid to do so, and yet it is your decision to do things that way and not to self-host.

There is even a concept of "exporting data", which is when you transfer someone's personal data to a system outside the EU, in which case special rules apply.

To name two good examples of companies catering for European bloggers, I'd like to mention Zendesk and Amazon S3.

Zendesk are part of the "safe harbor" arrangement (sorry, it really is spelled that way), which means that they adhere to EU principles as far as data protection is concerned, even though they are a US company. It makes it a lot easier to prove that your data is being held according to the EU rules if the site you are storing it with provides certification to that effect.

Amazon S3 offer you a choice of locations for your online storage space, one of which is in the Republic of Ireland. Store your backup here, and the data does not cross the virtual EU borders.

I could continue, but rather than frighten off those that have stayed with me this far, I would like to invite you to join me in the Beyond Blogging Project instead - where I can go into more detail (if you want me to).

Oh, by the way, where is your web server located?

Graham Tappenden is a self-employed IT consultant and British ex-pat living in Germany. He blogs about his life in Germany at AllThingsGerman.net and is a founder member of the Beyond Blogging Project.

1/ How will the EU cookie directive affect European bloggers?

2/ How do you sell an affiliate product?

3/ Advertising contracts? don't bother!