We're excited to share the tweaks and improvements to our dashboard and end-user flows, as well as announce that we now support 7,000+ government-issued IDs. Here's a full overview of what's changed since the start of the year.

Through rigorous testing, our product teams are able to identify small ways to improve our end-user flows that ultimately make a significant impact for our clients. While tweaks change from client to client and from web integrations to SDKs, here are the universal updates made last month.

Users that go through our web verification flows will now see a waiting screen after the flow is complete. This screen gives them more visibility into what is happening behind the scenes. They are also able to wait until a final decision is made and see the results immediately on the screen.

Other changes include additional photo prevalidation checks during the flow, giving users more concrete feedback. Our resubmission screens now include more information for users on how to improve their photos, providing detailed examples that will boost pass rates. 

The additional photo prevalidation checks are also available in our Android SDKs. We also tested product copy and adjusted it to give users more clarity on how to capture their selected identity documents.  

These updates come in addition to our routine bug fixes and updates, which are aimed to bump up quality and reliability.

After releasing Veriff Station in November 2019, we received plenty of actionable feedback from users like yourself. This month, our team made it possible for users in the Support role to create live sessions. 

Managing Countries and Documents under the integrations Integrations tab was also made more user-friendly. We added the functionality to bulk select per request from several clients. 

While product teams are busy with fine-tuning our dashboard and end-user flows, our verification department works around the clock to add more and more specimens to our database of supported government-issued IDs. This month we passed the 7,000 mark, and look forward to continuing to pump up those numbers throughout 2020.

Be sure to update your SDKs and web flows to make the most of these new features. Don't hesitate to share your feedback with us on Facebook, Instagram, LinkedIn, or Twitter and happy Veriffing!

With the longest month of the year behind us, here is what our product teams have been working on in January 2020.

What’s New in January 2020: Veriff Product Update

In June 2018, California passed the California Consumer Privacy Act (CCPA). The CCPA demands that companies to show all the data they have about consumers residing in California, including a complete list of all third parties who have access to that data. This resulted in companies being forced to overhaul their data collection methods and caused turmoil for many.

Businesses that are inside or outside the state of California must be CCPA compliant now that the deadline, January 1, 2020, has passed. This is a positive move towards consumer rights, and one of the key features of these new regulations is that companies must notify consumers of the attempt to generate profits with their data, and also grant them a means to not participate in that monetization.

Despite having close to two years to prepare, many companies still struggle to comply. To give you a thorough understanding of what is expected and how to go about being compliant, the following guide covers:

How outsourcing identity verification can help

The CCPA applies to any business that generates profits by selling, sharing, or collecting personal data from California residents. While this sounds a little vague, the CCPA does list criteria for companies that need to comply, including:

They store personal data from 50,0000+ consumers, devices, or households

Over 50% of its annual revenue comes from the sale of personal data

Its annual gross revenues exceed $25 million

Before diving into how being compliant works, it is important to understand how the CCPA defines personal data. Below is the definition included in the act:

“Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

While this seems like an alarmingly vague way to define personal data, the CCPA elaborates on the definition. Below are the different categories of personal data as well as concrete examples of each:

Identifiers: real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers

Characteristics of protected classifications under California or federal law: age, gender expression, sexual orientation, race, religion, gender identity.

Commercial information: records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Personal data from California consumers that businesses collect: address, number of kids, how fast a consumer drives, consumer’s personality, sleep habits, biometric and health information, financial information, geolocation information, social network, etc.

Biometric information: fingerprint, height, facial recognition, voice, hair color, etc.

Internet or other electronic network activity information: browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement

Audio, electronic, visual, thermal, olfactory, or similar information.

Professional or employment-related information

Interferences: information identified to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

Having all personal data well organized and handy is essential to being CCPA compliant. This is because consumers have the right to request all data a company has about them twice a year free of charge. This is just one of many consumer rights under the CCPA, others include:

The right to say no to the sale of your personal data

Right to sue companies who collected your data when a breach occurs

The right to request the deletion of your personal data

The right to know the purpose of collecting an individual’s personal data

The right to know the sources of information where consumer personal data was acquired

The third parties with whom personal data is shared

These are the most important rights in terms of how they can impact your business. You can view the full list of consumer rights under the CCPA here.

Having access to all this information in a way that makes it possible for customers to exercise their rights can be challenging. To help you adapt to the new changes that CCPA brings, we put together a quick checklist of activities.

Have a registry of the personal data you collected about each customer over the past 12 months. When customers approach you with a request for their data, make sure the consultations are free of charge.

If one of your consumers asks you to disclose or delete personal data about them, be sure to respond within the first ten days to the request. The term can be extended to 45 days if necessary.

Provide your consumers with the option to decide what personal data you can store. This includes giving your consumers the right to use their right to opt-out of the sale of their data. In case they do decide to opt-out, refrain from discriminating against it. This includes providing equal benefits and service quality regardless of whether they opt-in or out.

If one of your consumers is between 13 and 16 years old, remember to get their consent before selling their personal data. In the case of children under 13, you must obtain consent from their parents.

Remember to update your privacy policy and include all the modifications that the CCPA demands.

One of the most important differences between CCPA and GDPR is that CCPA explicitly grants consumers the right to sue companies if unauthorized personnel have access to their personal data. 

While the range of fines is from $100 and $750 for each event, consumers can claim much more depending on the damage done. In the exact terms the CCPA uses, consumers can:

“Recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater.”

Civil penalties should also be considered. The Attorney General can also prosecute a business for general violations of the CCPA, even if there has been no breach under CCPA. The maximum fine is $7,500 for unintentional violations and $2,500 when breaches are accidental.

If you are already familiar with the European Union’s General Data Protection Regulation (GDPR), you may have already noticed some similarities.

Both the CCPA and GDPR were created to give data subjects certain rights with respect to their personal data, including:

Both laws also contemplate the scope of extraterritoriality. This means that the regulations will affect any business in the world as long as certain requirements are met. For the CCPA, any company that trades with consumer data of over 50,000 California residents must comply. In the case of GDPR, it doesn’t matter where the company is as long as it offers services to individuals within the EU. 

While there are many similarities in the objectives of both reforms, there is a big difference in fines. CCPA fines are imposed by the California General Attorney, ranging from $2,500 to $7,500 per violation. On the other hand, GDPR fines are imposed by the Data Protection Authority of EU member states, and range from 4% of a company’s global annual turnover up to €20 million.

7. How an identity verification partner can help

When comparing CCPA and GDPR, both aim to improve transparency between consumers and businesses with regards to personal data use. For global companies in regulated industries where knowing your customer is required being compliant on both fronts is critical.

Using an identity verification partner can help you manage personal data in a way that is both secure and compliant with regulations like GDPR and the CCPA. Veriff helps international companies like Turo, Blockchain, and more verify users and meet regulatory demands. Learn more about how we can help by scheduling a demo with one of our product specialists.

The deadline for complying with the California Consumer Privacy Act (CCPA) has passed. Here’s everything you need to know about how to stay compliant with these new regulations.

Your Guide to Complying with the California Consumer Privacy Act (CCPA)

If you offer services in the digital space, user verification is essential regardless of whether you are required to do it by law. Identity verification is about more than legal compliance. It’s about making sure your customers are who they say they are and building relationships. 

Veriff’s data, gathered from millions of verifications a year, detect that as much as 5% of all attempted verifications are fraudulent, with some industries like cryptocurrency and block-tech seeing rates as high 24.6%. This and the hefty fines that come with non-compliance are just a couple of reasons why companies beyond financial sectors are looking to expert solutions for help.

When looking for a first-time provider to comply with industry regulations, what you need will differ from someone looking to switch. You likely aren’t sure about your exact needs, and do not have the experience to know what works and doesn’t work for you.

It helps to get an idea of the level of risk you are working with. Certain industries come with higher risk appetites. For example, the fintech sector is highly regulated whereas marketplaces deal with differing compliance laws. 

In addition to your compliance needs, it is also important to note the extent to which you are willing to sacrifice speed for security. More security checks and steps reduce the risks of fraud, but also add steps to your conversion funnel, and some tools are able to optimize this better than others. 

You already have a provider, but you’re not happy

Let’s say your current provider ghosted you after the sale was complete, leaving you with a stiff, inflexible solution that no longer meets your needs. To keep up with the shifting priorities and needs in a dynamic regulatory environment, you need a partner that is able and willing to adapt their product to suit your needs.

Ultimately, you need to know what is on the market. Below are the features and specs that will help you find a partner that is willing to grow with you.

There are plenty of terms and phrases in the IDV industry. Before diving into the specific features of an IDV service and explaining the benefits, it is important to understand how the degree of automation impacts IDV service speed, quality, and your conversions.

Simply put, an automated IDV service relies solely on machine learning technology to make decisions. Decisions basically mean if a person is verified as the person they claim to be or not. 

Automated decisions are much quicker when everything goes right, and do not place your customers in queues to be manually reviewed. While this sounds great, they are also easier to deceive and therefore increase the risk for fraud or non-compliance. And if something goes wrong, troubleshooting is much more time-consuming than when manual review is an inherent part of the process.

On the other end of the spectrum, fully manual services solve the problem of accuracy but tend to come with high costs. Providing this kind of service requires a large team of outsourced in-house specialists, and this will be reflected on your bill.

It’s hard prioritizing one over the other and unnecessary as a third option exists. Veriff is an example of a service that uses both machine learning and manual reviews for challenging sessions to leverage the benefits of both. 

Now that you have a better understanding of the level of automation you’d like in the service, there are other features and factors that influence conversions. After all, it’s all about welcoming customers first, staying compliant second.

One of the best ways to improve conversion rates during verification is to give users real-time feedback while they complete each step. Veriff is one provider that offers this feature, helping clients like Mintos deliver pass rates as high as 95%.

To give this feedback, Veriff uses machine learning to detect flaws in photos such as poor lighting or unreadable ID text, then customers are automatically instructed to fix it. 

Another way to boost conversions and prepare your users for the additional steps that identity verification adds is to provide supporting material. A great example is our client Mintos, who use a number of techniques to educate their users about Veriff and maximize conversions. Having a helpful IDV partner will make this process a breeze.

Moving beyond the topic of conversions, it’s important to look into market and ID coverage. Some providers offer a more diverse range of locaĺizations than others, with Veriff leading the industry (35 languages and open to more depending on client needs). 

If you’re in the digital or online world, then the idea is to be global. Make sure that the IDV provider you choose covers all of your markets. The number of supported countries among industry-leading IDV providers varies, with some providers covering around 100 and others over 190. 

But market coverage is not the same as ID coverage. 

An IDV software provider might offer wider country coverage but support fewer identity documents. Ideally, you want to maximize the number of IDs your clients can choose from to verify themselves. That is why Veriff supports 6,500+ government-issued IDs from 190+ countries.

Checking a user’s identity varies from a basic ID authenticity check to full-on biometric analysis, session tracking, and live recording the entire verification process. There is also a wide range of pricing models, integration options, and degrees of after-sale support depending on your provider.

When it comes to identity verification, a one-size-fits-all solution does not work.

Being able to select the thoroughness of an identity verification session has a huge impact on results. For every step in your customer journey you will experience drop offs, and by configuring the verification tools you use to include only the checks you need, you will be able to tick both boxes: conversions and compliance.

To give clients this level of flexibility, Veriff configures the decision-making technology behind our verification software for each client, enabling only the checks necessary to match their risk appetite. These “decision profiles” determine which data inputs to gather, what checks to conduct, what outputs to send to the client, as well as the extent to which we automate our IDV service.

Scalable pricing and free trials are a plus

Let’s say you already found several suitable providers, and all the information is ready to present to your team. The only missing piece, much to your CFO’s dismay, are the pricing details.

It’s hard to make a decision without knowing the costs and contract terms. Most IDV providers give out this information is only disclosed only after a sales call or even as late as after signing a non-disclosure agreement. Also, many IDV providers go with a minimum commitment contract that you won’t be able to get out of.  

Veriff aims for transparency as well as scalability, and you can have a look at our pricing plans here, which you can upgrade or cancel anytime. You can also try our service for 30-days free. No sales call needed, just sign up on our website and see how it works.

Integration options should cover mobile and web

Customizability in terms of integration options will make sure you are able to integrate an IDV provider with all the interfaces and platforms you use. Mobile SDKs for iOS and Android, API, and web integration options (including mobile) are standard but not guaranteed, so make sure you know what you need in advance.

While there are a lot of things to consider when looking for an IDV provider, the number one factor that will determine a positive or negative outcome is how willing your provider-to-be is to support you. 

Veriff goes beyond bug fixes and integration support. With the help of a dedicated account manager for all plans, we help you implement Veriff in a way that gives you the best possible results. Learn more about our product and pricing here.

Finding ID verification software (IDV) suitable for your company’s needs can be challenging. With the right approach, you can easily navigate the competitive IDV marketplace and find a tool that best matches your needs. Here's how. 

How to Choose the Right Identity Verification Software

When running a startup, growing your product and recruiting new customers can take all of your focus and time. Becoming a sustainable company might not be your top priority. 

Parallel to that, there is a false assumption that it's expensive to become an eco-friendly brand. Yet going green can help cultivate a better brand image, gain more customers, and save money.

Committing to becoming environmentally friendly shows your customers you are here to make an impact as well as profit. Going green demonstrates that your values extend to taking care of the environment you are a part of. 

There is a reason why 88% of business school students think that learning about social and environmental issues in business is a priority. Taking action towards becoming a sustainable company not only will help with the increasing ecological crisis but also with growing your business as well. 

According to a survey conducted by Futerra, nearly 90% of respondents said they prefer to invest in brands to help them make a difference. 

However, 43% of respondents in the same study claimed that companies make it difficult for them to make eco-friendly decisions. When choosing between using a service from two similar companies, with the only difference one of them being a sustainable business and the other not, they would most likely choose the business that helps them reduce their environmental and social footprint.

Companies that care about the environment are the future. People want to invest and be a part of sustainable companies, so why not do it.

Becoming an eco-friendly company is easier then you might think, here are some simple ways to do it and boost your brand as an eco-startup.

Nowadays, everything is becoming more and more digitized, and paperless age might not be far ahead. Going digital is progressively simpler every day, with more and more applications designed to replace the regular need for paper. 

Stickies on your MacBook are a great way to use as visual reminders, keep track of your tasks, and place for random ideas. Using task organizing platforms like Jira and Trello enables you to have an online Kanban board with the possibility to share it with your employees, enabling better communication and an easy way to adjust the tasks. 

The magic of digital signatures and cloud-based tools

Use tools like Google Docs for collaborating in real-time, sharing meeting notes, and giving feedback on projects the same way you would on paper. 

When running a business, you will always have to deal with a large number of documents, like invoices and contracts. A great way to save paper is to create digital documents instead of printing, using e-signatures to finalize contracts, and cloud storage and hard drives to manage paperwork.

Using cloud services instead of paper saves you office space and money, and fewer cities do this better than Dubai. As many as six separate Dubai government sectors have cooperated and managed to cut down on 27 million sheets of paper a day. All it took was moving their operations to a digital space. 

2. Say goodbye to plastic (#GoodbyeBadBag)

One of the most pressing environmental issues of today is plastic pollution.

The production of disposable plastic products is increasing, while we still don't have a clear solution on how to deal with this waste. Every year, about 8 million tons of plastic waste escapes into the oceans from coastal nations. At the same time, our landfills are getting bigger and bigger, storing all the waste and polluting the soil around it. 

The production of plastic increased from 2.3m tons in 1950 to 448m tons by 2015 and is expected to double by 2050. Thankfully, there are several alternatives that you can implement in your office, for example:

Switch to biodegradable trash bags. Instead of commonly used petroleum-based bin bags, Veriff uses 100% biodegradable corn-based plastic.

 Talk to your office snack supplier about alternative package delivery methods. For example, instead of having Veriff's fruits delivered to our office in grocery bags, we asked our suppliers to use cardboard banana boxes. 

Step up your recycling game. It's not only about paper and glass or plastic bottles. The environmental benefits of recycling are immense. As Annie Leonard, the head of Greenpeace USA, says in her film, "Story of Stuff":

"Everyone knows the environmental benefits of recycling: it conserves resources by putting them back to productive use and, even more importantly, it avoids the pollution caused by having to extract, mine and process new resources,"

Recently our office went through several changes in this department. We reduced the number of trash baskets lying around the office and made them paper only. Veriff encourages employees to take frequent breaks and exercise. Meanwhile, introducing additional recycling bins for packaging and organic waste in our kitchen, with an informational poster on how to recycle correctly. 

It is not only about CO2 and other gas emissions that are causing global warming. The constant engine noise is causing noise pollution in the bigger cities and harming human health. 

Noise pollution is responsible for a range of health effects, from sleep disturbance to hearing impairment. 

About 40% of the EU population is exposed to road traffic noise exceeding 55 dB(A). Considering that the healthy level of noise is 30 dB(A), that number isn't looking too good.

Understandably, leaving your car at home might not work for everyone. Nevertheless, It's worth researching other alternatives you might have in your living area. 

While using public transport is the most common eco-friendly commuting solution, it isn't the only one. When there's no snow, and the weather is still mild, see if your company can provide some parking spaces for bicycles. 

A great way to commute, get to know your coworkers, and save money is carpooling. Find out if any of your colleges live nearby and invite them to share a ride to the office. Veriffians have a channel on Slack to find people to share taxi rides home with, and we can't recommend it enough.  

This might be one of the easiest things in the list to adapt to. All you need to do is pick up some new habits and go lightbulb shopping. 

It might be worth remembering that many modern electronic devices still use energy when they are plugged in. In a study done by the Australian Greenhouse academy, microwave ovens were found to consume as much as 40% of the energy they use while just by being connected to a socket. 

As for the light bulbs, switching from traditional incandescent bulbs to LEDs, which are much more energy-efficient, can decrease your electricity bill. LEDs use up to 85% less energy and last nearly ten-times longer.

One of the ways our employees have been dealing with remembering to follow this has been by leaving funny sticky note reminders in some meeting rooms. 

It might not seem like a lot, but all things summed can significantly influence your electricity bills over time.

All in all, joining the ranks of eco-friendly companies can make your customers feel good while also positively contributing to the environment.

That is why in September 2019, Veriff joined forces with 33 big names in the Estonian tech scene, including Bolt and Transferwise, by signing a Tech Green Pledge to be carbon neutral by 2030. Together with other Tech Green pledge members, Veriff pursues these goals by making its office spaces, business processes, and day-to-day activities greener. 

The Tech Green Pledge is open to accepting more members, both local and international, so join us and let's make a positive environmental impact together! 

The state of our environment is worsening, and unsustainable businesses are becoming the ghosts of pasts. If you’re looking for ways to be more eco- friendly in 2020 here are some of our favorites.

The state of our environment is worsening, and unsustainable businesses are becoming the ghosts of pasts. If you’re looking for ways to be more eco-friendly in 2020 here are some of our favorites.

5 Ways Startups Can Make a Positive Environmental Impact

In today's digital society, the way companies handle data is under scrutiny. Privacy feels more like a luxury rather than a right, where data breaches frequently expose the personal data of millions of people, and companies sell it to the highest bidder.

At best such breaches result in unwanted advertising. At worst, people's private information is sold on the dark web. Either way, it is an unsettling thought, and to address the growing concerns over its citizens' data, the European Union introduced the General Data Protection Regulation (GDPR). 

This regulation addresses how companies should handle their customers' data, as well as the rights data subjects have over the way it is used. The consequences for not complying with the new regulation are, understandably, quite strict. To help you navigate through GDPR and to avoid millions in fines, the following guide will cover the following chapters:

Beware of fines in GDPR for non-compliance

The European Commission sought to define new and more effective objectives for data protection in Europe, and GDPR was a way to adapt and transform existing laws to address emerging issues in an increasingly digital world. 

The laws are designed to give EU residents control over their personal information and create a regulatory environment for businesses and residents in which there is a clear framework of rules regarding the handling of personal data. 

By setting a new standard for personal data handling, the companies that handle the data were faced with the challenge of aligning their systems and processes with the new laws.

Personal data is the core subject of GDPR. While there is no definitive list of what is or what is not considered personal information, Article 4(1) of the GDPR defines it as  “any information relating to an identified or identifiable natural person (data subject).”

“An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

What the GDPR addresses, in this case, is any information that makes it possible to identify an individual. There are, however, disputes over what information can be used to identify a person. 

For example, political opinions or an IP address could be considered as personal information, but this is also a matter of perspective. Defining what information can be classified as personal data is essential to staying compliant.

When it comes to the protection of consumers' data, the GDPR sees companies and organizations as responsible. 

The GDPR  applies to all businesses and organizations established in the European Union, regardless of whether personal data is processed in the European Union or not. The essence of this regulation is to give the power over personal data back to the people, and to make data processing much more transparent and lawful.

One of the many requirements under GDPR is that all companies and businesses must keep a record (e.g. in form of registry) of their personal data processing activities.

The idea behind the requirements set in GDPR is to get companies to think about privacy and data security questions when providing the service or developing products. So,  privacy would become an integral part of the service or goods offered.

GDPR demands changes in company paradigms and continues to urge companies to prioritize the protection of personal data. Below are the first steps to doing so:

4.1. Hire a DPO (or someone with good knowledge of data protection)

The first step to fully complying with GDPR legislation is understanding the legal requirements of the GDPR. For starters, it is recommended that a compliance audit be done to test whether a business is fully compliant with GDPR or not.

The main thing is to have well-trained and informed employees, as well as a person who will be responsible for data protection questions. This individual could be a Data Protection Officer (some companies are obliged to appoint a DPO), whose task would be to explain the regulation and help to apply it to business processes.

All European countries have a Data Protection Authority. This is the body responsible for supervising the enforcement of GDPR regulation. One tool to help companies to demonstrate their compliance with Data Protection Authorities and keep track of processing in general is Data Processing Registry. Each company or organization needs to create a Data Processing Register to keep a record of all processing activities concerning personal data. This record (e.g. registry) is obligatory under GDPR.

The classification and evaluation of customer data are of vital importance. This means knowing who processes and controls information, what types of data are processed, how long it is retained etc. as well as assessing how this information is protected. 

Applying security policies and evaluating data life cycles, from when it is collected until its destruction, is just a part of this critical step. It might also be necessary to complete a Data Protection Impact Assessment, Legitimate Interest Assessments, etc.

Understanding how to stay compliant as a business will be essential in 2020, and failure to do so comes with substantial consequences. Non-compliance can result in penalties up to €20 million or up to 4% of a company's annual turnover.

The consequences of not being GDPR compliant can be fines but also loss of trust.

Fines are calculated based on the severity of the breach. The most extreme cases involve infringement of a person’s data rights, where there has been an exchange of personal information without the authorization of the affected subject, or when the companies and organizations have not put the appropriate procedures to ensure the security of that personal information.

While monetary fines are measurable, trustworthiness is not. Today the trust that consumers place in companies is incalculable, and it can define the value of your business relationships. A breach could mean the loss of clients and partners, so securing their trust is invaluable for businesses. 

Below are a few landmark examples of GDPR non-compliance fines in recent years.

British Airways paid one of the highest GDPR fines in 2018. The company faced a fine of £183 million for a data breach, during which British Airways web users were redirected from the official website to a phishing site. 

As a result, personal data from over 500,000 people was compromised. The Information Commissioner's Office (ICO), the data protection authority of the UK, imposed a fine equivalent to 1.5% of the worldwide earnings of the company.

Like British Airways, the Mariott hotel chain suffered a data breach that landed them a steep GDPR fine of €110m. Their security breach resulted in over 380 million customers' data being leaked, including names, emails, phone numbers, passport details, and bank account information.

The French Data Protection Authority (CNIL) found Google guilty of breaching GDPR guidelines, resulting in a fine of €50m. The CNIL reported Google's "lack of transparency, inadequate information, and lack of valid consent regarding ad personalization" as the reason for the charges. Google decided to appeal the decision, but there is still no decision about it.

Naturally, no company wants to pay minor, let alone severe, non-compliance fines. And while all GDPR guidelines are available online, navigating through and correctly implementing this regulation can be tricky.

To help you align your activities with the primary objective of the General Data Protection Regulation, which is to give the public more control over the information that companies have about them, here are some ways to ensure that data subject’s rights are considered.

6.1. Make sure you have a valid legal basis for data processing

Companies must obtain a valid legal basis for personal data processing. For example, permission (consent) from the customer can be used. In case consent is used,  it is best to make the asking of the consent as clear and explicit as possible and to communicate why the data is gathered and how it  will be used. 

6.2. Give your customers the right to access their personal data

The right to access data means that your customers have the right to know what data you have about them as well as how you are using it. For example, this also includes records of how and when they have given consent for personal data use, so it's best to keep this information handy.

6.3. Allow your customers to adjust information regarding their data

In addition to the right to access their data, GDPR grants data subjects the right to rectify their data if it is inaccurate or incomplete. Businesses have a month to respond to these requests, but in some cases they may refuse the request for rectification.

6.4. Make it possible for customers to eliminate their data

According to GDPR guidelines, individuals can also exercise their right to have their personal data deleted. This right is also known as the “right to be forgotten”, but it is necessary to point out that this right is not absolute and can only be exercised under certain circumstances. 

For example, data subjects have the right to exercise their right to be forgotten when their personal data is no longer necessary for the purpose that was originally processed. Alternatively, they can exercise this right when a company is processing personal data for the purpose of direct marketing and the data subject opposes such processing.

6.5. Apply personal data processing restrictions

The GDPR grants subjects the right to restrict the processing of personal data. This is a right that can be exercised as an alternative to the right to be forgotten and is used in certain circumstances.

For example, if an individual objects to the accuracy of their personal data the company is in the process of verifying the claim, individuals can exercise their right to restrict their personal data processing until correctness is ensured. Another example is if a company no longer needs the personal data of an individual, but the individual exercises his right to keep this personal data in order to exercise or defend against a legal claim.

GDPR gives individuals the possibility to exercise their right to data portability, this means that data subjects have the right to receive their personal data that they have given to a certain company in a way that is organized, structured, and machine-readable. For example, social networks are obliged to offer the possibility to the data subject to download their information in machine-readable format to be used with another social platform.

It is also possible that data subjects will ask the controllers of their personal data to send their personal data directly to another company.

The regulation allows data subjects to object to the processing of their personal data at any time. Specifically, it is possible to object to certain types of personal data processing, such as direct marketing.

6.8. Automate individual decision-making, including profiling

Automated decision-making is an automated form of decision-making that uses profiling to exclude human participation. One example of this is profiling, an activity dedicated to analyzing the fundamental aspects of an individual's personality, behaviors, interests and daily habits to make predictions or decisions based on them.

“Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements”

Some organizations obtain personal information about people from cell phone behavior, social networks, internet searches, shopping behavior, and other sources. They analyze this information and use it to classify people into different groups. By analyzing these groups, companies find patterns in the behavior and personal characteristics of subjects. 

In addition to acquiring consent for profiling activities, Article 22 of the GDPR has additional rules to protect data subjects. If one of your processing activities falls under Article 22 of GDPR, you should follow this:

You must ensure that the data subjects receive the necessary information about the processing; 

There are simple ways for the data subject to request human intervention in the decision or to contravene the decision; 

Perform routine procedures to ensure that your system is functioning as intended.

These are just some of the measures or guidelines that companies and organizations must take into account to comply with the rules that GDPR imposes. To obtain more information about GDPR and ensure compliance it is advisable to hire a DPO.

7. Stay GDPR compliant while fighting fraud

With great data comes great responsibility. 

In addition to accommodating the rights of data subjects’ when it comes to how their data is used, companies are also responsible for protecting this data against security breaches and fraud. One way to do this is by working with digital security and fraud prevention experts like Veriff.

With great data comes great responsibility. To help you stay ahead of the shifting GDPR guidelines, we put together a guide to staying compliant in 2020. 

Despite the busy holiday season, we’re excited to share some great updates made to our mobile SDKs, web flows, and verification platform, Veriff Station. Take a look at what our product teams released before the new year.

Mobile and web tweaks just in time for 2020

Easy integration is more than half the work. Our team added another Veriff installation option for our iOS end-user flows. You can now use Carthage in addition to CocoaPods to add Veriff to your iOS app.  

In addition to this new iOS installation method, our team focused on increasing stability and reliability across our Android and iOS SDKs as well as our web flows. We also treated our web flows to some additional improvements, including a limited support option for browsers that do not support WebRTC technology.

This means that Veriff web flows support verifications on iOS platforms from selected browsers other than Safari. 

New customizable installation in Veriff Station

The Veriff Story

The journey towards a single digital identity

It began with a blue string

Meet the team

Join our cause

Want to learn more?

What’s New in January 2020: Veriff Product Update

Your Guide to Complying with the California Consumer Privacy Act (CCPA)

How to Choose the Right Identity Verification Software