This week has been marked by the entry into force of the new General Data Protection Regulation (GDPR), which will be mandatory from next Friday, May 25.
This new regulation is European-wide, and the two-year period for adaptation is now ending for all companies and websites that process personal data of European Union citizens.
As usual, most of us are doing it at the last minute.
This is the most important law on this matter since 1999 and it unifies all national legislations to create a single framework across Europe. With the GDPR, the criteria for what constitutes personal data and how it should be protected are unified.
If you want to know more about the new law, you can check this link or do a simple Google search; there are many publications on the subject, and it’s constantly being discussed these days.
Although I’ve known about this law for some time, I haven’t been fully aware of its importance and the paradigm shift it entails until recently, so I’ve been working hard these days to update the website and ensure everything is ready to continue sending my weekly emails and sharing downloadable content from May 25.
I have changed the privacy policy and adapted the subscription forms. You will now see a new checkbox and a brief legal text to subscribe to the blog.
The new General Data Protection Regulation and festival distribution
There are many changes in this new regulation that I advise you to review, especially if you are organizing festivals. In fact, these days you will be receiving emails from many platforms and websites asking you to accept the new privacy policies.
All of us who process data are obliged to obtain new consent, this time explicit and not tacit, as it has been until now.
This is one of the changes that affects us most: the way consent is obtained changes radically. Previously, it was enough to put something like this on forms: By clicking the button, you accept our terms and conditions.
But now consent cannot be inferred from silence or inaction by users. When requesting authorization to process personal data, it must be specified what use will be made of this data and include the contact information of the company processing it.
The user must take positive action to demonstrate knowledge of the privacy policy, and as managers, we must demonstrate that we have provided the opportunity to do so. Therefore, a checkbox should be added to forms, and it should not be pre-checked.
Despite the importance of these changes, I have seen very little movement in our sector. It seems that very few are aware of the new legislative framework. There are very few registration platforms, online databases, or festival forms that have adapted or will do so soon, and it should be noted that there are only two days left.
I believe that sometimes we forget that festival distribution is essentially a sector that operates online and manages thousands of filmmakers’ data using different tools and forms. Respect for data and its legislative adaptation should be a priority.
This new law also affects companies that process personal data of European Union users, regardless of the country they are located in. Therefore, platforms like Withoutabox and Filmfreeway should adapt their forms and privacy policies, as should the websites of film festivals outside the European Union that accept submissions from around the world.
To fully understand this change, let’s look at the Filmfreeway form:
As it stands now, it does not allow explicit consent; this type of form will cease to be legal from Friday.
Therefore, if this platform does not adapt them to the new law and continues to operate with data from European Union citizens, it faces fines that can amount to 4% of its turnover.
This is one of the most important new developments: the fines are substantial and can affect all companies and institutions that do not comply with the regulation from May 25.
Furthermore, an email should be sent to adapt the consent that these platforms or festivals already have to the new regulation; previous consent is not valid.
Now, control over data processing passes into the hands of users. The law we had until now was from 1999 and was not prepared for all the changes we have experienced in personal data processing.
To date, I have not yet received any emails from platforms or festivals to update this consent. However, I am receiving them from other platforms not related to festivals, such as online applications, social networks, and all kinds of blogs.
It’s a complicated situation; I myself have been working very intensely for several days on everything this law entails for the website.
As a festival manager, I hope this post helps you become aware of these changes and start working on adaptation as soon as possible. As a user, it is also necessary for you to know your rights.