20


PR professionals get ready for GDPR Basic steps for


. By Séamus Dooley


GDPR. The term is likely to send a shiver down the spine of many readers. This month I have been working closely with Dr Martina Byrne, CEO of the Public Relations Institute of Ireland, and have reached an agreed understanding on how GDPR impacts on the work of PR professionals interacting with journalists and media organisations PR practitioners, many of whom are NUJ members, have legitimate reasons to contact journalists and journalists have an expectation – or in GDPR terms, a “legitimate interest” - in receiving information from PR professionals. GDPR impacts differently on working journalists so our emphasis has been on how our PR members deal with GDPR provisions. With that in mind I met PRII members at their Dublin office on May 10th, and it was interesting to hear their perspective on what GDPR means – and does not mean. Much of what is sent on behalf of clients or employers by public relations professionals to journalists is unsolicited, and unlikely therefore to have involved informed opt-in consent from the recipients.


Here is a summary of key points raised by


Dr Byrne and myself, but of course it comes with a health warning: It does not purport to be a legal guide:


Generally public relations practitioners and


press officers have access to a media contact list or database/s in some form. Many use Excel sheets. These databases contain journalists’ names, who they work for, their work and possibly personal email address, their work and possibly personal mobile number. According to the GDPR, storing such data electronically, or in hardcopy, constitutes processing of personal data.


(Continued on page 21)


the PR industry Step 1: Whose and what personal data do you hold? Who has access to it? Why do you hold/store/use it? How do you secure it? How long do you hold it for? Is it on mobile devices? If so, are they encrypted? Are mobile devices wiped clean when obsolete and about to be replaced? Document the legal basis on which the


organisation relies in relation to the data it holds and processes. Step 2: Agree and publish a data protection policy (or privacy notice). This should confirm that only necessary data is held, that it is held for the legitimate interest of doing business, that the data is secure, that it will not be shared, and that it can be amended or deleted at the request of the individual data subject within one month, on request. This policy document should be easy to find, for example, on an organisational website and can be signposted on the organisation’s ‘boiler plate’ on emails. Step 3: ‘Clean up’/update media contact lists/data regularly, delete old and unnecessary details e.g. date of birth, home addresses. If in doubt, check the details and get clear, informed consent from the individual to retain the personal data e.g. if a personal mobile is being used to contact a journalist who also has a mobile number for work purposes. Step 4: Take care to target media materials to those journalists for whom a case of ‘legitimate interest’ can be made. Don’t ‘scatter-gun’ media materials to entire media lists. Use bcc (blind copy) when using mailing lists in emails. Step 5: Be ready, willing and able to respond in a timely manner to requests from journalists or others to have their contact details removed from the PR organisation/team’s database. Ensure no one else in your organisation continues to contact that journalist if the request for deletion has been made.


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25