The complete lack of action and undertsanding from HubSpot on GDPR compliance is absolutley shocking - and the inability of anyone to communicate what their plan is to ensure customers can meet GDPR requirements is extremely concerning - to the point where some people may feel that HubSpot isn't going to be an option for their businesses going into 2018.
The fact that they are asking people for 'specific concerns' is a joke - I mean RTFM!!!
The ICO have extensive guidence on GDPR, and whilst there is still some areas of interpretation, the fact that HubSpot hasn't responded to the key issues of consent for marketing communications is desperately ignorant for an inbound marketing company.
Additionally, since GDPR not only affects EU companies, but ANY company trading with or creating contacts in the EU (i.e) the yanks - you'd have thought they be paying attention to the effects GDPR will have on their users and customers (not simply the high-level areas of safe-harbours).
You want issues, here are a few issues:
Issue #1
When a new contact is created in the CRM, they are automatically opted-in to all marketing communications. This will cause comprehensive failure of consent compliance if contacts view their preferences and see that we've pre-populated consent boxes, this in itself could be a cause of complaint or breach, even if we don't actually send out communications.
Development proposal
- When creating contacts, all email types should be set to opt-out
- Then, one or more email types must have consent applied by one of the following methods:
- Forms (and lead flows) should offer the functionality to apply consent to one or more email types
- Workflows should have the functionality to apply consent to one or more email types (depending on what form was submitted)
Issue #2
If the contact unsubscribes from all emails and then chooses to re-subscribe, the action results in consent for all marketing communications (rather than giving the option to opt-in to selected communications).
This will potentially cause compliance failure on consent and awareness of consent because:
- If we offer different communication types, the contact should be able to opt-in to each individual communication option when re-subscribing
- Because clicking the re-subscribe button launches a confirmation page away from the marketing preferences page, the contact may not be aware that they have been opted-in to all communications.
Development proposal
A completely compliant solution is for HubSpot to change the re-subscribe process so that the contact opts-in to each type they wish to receive and then selects re-subscribe. This process will only re-subscribe them to the selection made.
Issue #3
When a new email type is created, the contact's marketing preferences automatically show the contact as having consented to receive the new email type. This will cause comprehensive failure of consent compliance if contacts view their preferences and see that we've pre-populated consent boxes, this in itself could be a cause of complaint or breach, even if we don't actually send out communications.
Development proposal
New email types must automatically have a default value of 'opt-out'
Issue #4
We are obliged to provide evidence of when and how contacts opted-in. This is contained only in contact histories – and so cannot be exported and cannot be migrated.
Development proposal
We should be able to export ANY data from the CRM in a machine readable format – not simply contact properties, but correspondence and actions as well.
Biggest issue for me right now is the lack of movement from HubSpot.
.png "HubSpot Employee"){kind=icon}
