Making Your Website and Social Media Page GDPR Compliant

Making your website compliant

• Fleet (Prater Raines)
• ALDC MyCouncillor
• Wordpress
• Webhost
• Wordpress Software
• Privacy Policy
• Fair Processing Notices

Making your social media account compliant

• Facebook
• Facebook pages
• Facebook groups
• Twitter, Instragram, Snapchat, other
• Collecting consent on social media
• Interacting with userse on social media

Making your Website Compliant

Fleet (Prater Raines)

If you are using Fleet, most of the work to be UK GDPR compliant has already been done for you. There is already a link to the correct version of the Privacy Policy from your home page and the correct Fair Processing Notice is included in the footer of every page.

If you ever create a new page that collects data, ensure that the Fair Processing Notice and appropriate consent wording are included in the appropriate place. These should have been set-up already. If there are any issues, please contact Prater Raines support at info@praterraines.co.uk.

ALDC MyCouncillor

If you are using an ALDC MyCouncillor page, it should not be collecting any data on the website, although people may be able to contact you. The changes have already been made for you and the correct Fair Processing Notice is included in the footer of every page. If you add any contact page, ensure that the Fair Processing Notice is included in the appropriate place.

Wordpress

If you have a Wordpress Website, there are several things you MUST do to ensure that your website is compliant with uk GDPR. Prater Raines offers Wordpress hosting with these changes already made. The Liberal Democrats cannot provide support for Wordpress Sites. If you do not have the technical expertise to make these changes, you will need to consider whether to migrate to Fleet or ask Prater Raines to host your Wordpress website and make the necessary changes on your behalf.

Webhost

Your website will be hosted by a hosting provider.

• Check that your hosting provider is EU based and your website and Wordpress database are hosted in an EU based data centre
• If they are EU based, then follow these instructions to get them on to the new approved supplier list
• If they are NOT EU based, then you MUST migrate your website to an approved web hosting service in the Approved Supplier List
• Alternatively, consider migrating your website to Fleet.

Wordpress Software

• Your Wordpress Software MUST be upgraded to the latest version
• Your Wordpress instance MUST be set to auto-upgrade
• Check whether Wordpress Plugins store data in your Wordpress Database or in an External Database.
• If Wordpress Plugins store data outside your Wordpress Database or you cannot confirm where they store data, they MUST be removed
• You must update your Wordpress Plugins regularly, at least monthly

Privacy Policy

• Update or Create a Privacy Policy page – use can copy the wording from here
• In the Privacy Policy Page, ensure that you have a link to the page on "Who we share data with" 
• In the "Additional details about cookies and technical information" section, you must provide a link to the Cookies on your website
  • You CANNOT use the link in the Lib Dem Privacy Policy as this is only valid for Fleet sites
  • You need to identify ALL the Cookies on your website
  • Create a page with categories that cover all of your cookies and an explanation of what they do
  • You then need to replace the link in the Cookies section of Privacy Policy with a link to your page
•  You need to ensure your website includes a Cookie Consent pop-up

Fair Processing Notices

• Ensure that the correct Fair Processing Notice is included in the footer of every page
• Ensure that the Fair Processing Notice and appropriate consent wording are included on any page that collects data
• Any consent you collect must be stored in Connect following the guidance on Data Gathering and Consent

Making Your Social Media Account Compliant

This section covers our social media presence in the form of pages and groups. We do NOT cover advertising in this section.
The way that Lib Dem groups are run is changing. 
The ICO have made it clear that collecting data from social media platforms without consent is not appropriate. In addition, an EU Ruling means that the Party is considered to be a joint data controller of Facebook Groups and Pages that we manage.

Administrators of relevant social media accounts, including Pages and Groups, should be members of the Liberal Democrats and follow these guidelines.

Facebook

When using Facebook, you must always abide by Facebook's Terms and Conditions, User Agreement and note their Privacy Policy. Always consider all posts you make on Liberal Democrat Facebook pages and groups to be public, irrespective of the visibility and status of the group. Liberal Democrat pages and groups are there to promote the party and should not be used in any way that can bring the party into disrepute.

Facebook Pages

Facebook Pages are always public and all posts should be treated as such. You must not collect any data posted on any Facebook pages without consent and only ask for consent where the Facebook Page is managed by the Liberal Democrats.

We must make it clear that the page is administered by the Liberal Democrats. Therefore please add the Fair Processing Notice to your Facebook Page using the following instructions:

• Go to your Facebook Page and click on About on the menu at the lefthand side
• Click on "Our Story" on the righthand side
• Click on the Edit button at the bottom
• Change the title to "Our Story & Data Protection"
• Add the following Fair Processing Text to the Story: " This Facebook Page is managed by the Liberal Democrats and we are joint Data Controllers along with Facebook. We will not collect or process any data from this page without your consent. Further details are in our Privacy Policy 
• Click Publish

Facebook Groups

Facebook Groups have a range of options, they can be public, hidden, secret and require questions for membership. Whatever the status we recommend you treat the information you publish there as being public, as we have no control over that data being shared outside of the group. You must not collect any data posted on any Facebook groups without consent and only ask for Consent where the Facebook Group is managed by the Liberal Democrats.

We must make it clear that the Group is administered by the Liberal Democrats. Therefore please add the Fair Processing Notice to your Facebook Page using the following instructions:

• Create a new post with the content: “This Facebook Group is administered by the Liberal Democrats and we are joint Data Controllers along with Facebook. We may process information you provide when applying to join the group to confirm your eligibility. We will not collect or process any further data from this group without your consent. Further details are in our Privacy Policy 
• Click Post
• Click on the "..." in the top right-hand corner of the published post
• Select "Mark as announcement"

If the option to ‘mark as announcement’ is not available on your group, please add the Privacy Notice into the Group's Description instead.

Twitter, Instagram, Snapchat, Other

When using Twitter, Instagram, Snapchat or other social media platforms, you must always abide by their Terms and Conditions, User Agreement and note their Privacy Policy. Always consider all posts to Liberal Democrat social media accounts to be public, irrespective of the visibility of the account. Liberal Democrat social media accounts are there to promote the party and should not be used in any way that can bring the party into disrepute.

You must not collect any data posted on Twitter, Instagram, Snapchat or any other Social Media platforms without Consent. Data should never be collected, nor consent sought from social media where there is no direct interaction with a Liberal Democrat social media account, page or group.

• Edit the bio of your account and add the link to our Privacy Policy

Collecting Consent on Social Media

Consent should only be sought when comments, posts, or replies are posted to one of the social media accounts we manage. Data should never be collected, nor consent sought from social media where there is no direct interaction with a Liberal Democrat social media account, page or group.

To collect consent, reply to the comment, post or reply, with the following wording:

Facebook Pages and Groups we manage where the Fair Processing is displayed

"Thank you for expressing your opinion. We would like to record this opinion / keep you up to date with our work*. If you are happy for us to do so, please send me your name, postcode and email address* by Direct / Private Message”

* Delete as appropriate

Other Social Media where the FPN is not displayed

"Thank you for expressing your opinion. We would like to record this opinion / keep you up to date with our work*. If you are happy for us to do so, please send me your name, postcode and email address* by Direct / Private Message. This will be processed in accordance with our Privacy Policy 

* Delete as appropriate

Interacting with users on Social Media

When messaging users on any social media on behalf of the Liberal Democrats, you should follow the Liberal Democrat’s Privacy Policy. As such, you should:

• Be sure not to encourage users to post personal data on any page or group operated by the Liberal Democrats. Personal data should only be requested in accordance with the section of Collecting Consent on Social Media above.
• Be sure not to disclose personal data in conversations with social media users, including on pages and groups operated by the Liberal Democrats, other than linking to a relevant contact person or email address at the Liberal Democrats that users may contact for more information or to sign-up. Users should be encouraged to contact the Liberal Democrats via email for any discussions about campaigning, products or activities that may involve the disclosure of personal data.
• Do not carry out marketing (including promoting the Liberal Democrats and campaigns, products or activities associated with the Liberal Democrats) via private messages on social media unless users have signed up to a specific Liberal Democrat page or group, such as a Facebook Page or Facebook Group

For any queries related to website and social media compliance please email digital@libdems.org.uk.