Blockmetry features for regulatory compliance

Blockmetry has several product features that help our customers with General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and ePrivacy Directive compliance, and be ready for the ePrivacy Regulations under discussion.

Using legitimate interest instead of consent

The Blockmetry product is designed to minimize the privacy implications of web analytics on website visitors (the data subjects) such that our customers (the data controllers) can use the GDPR’s legitimate interest, instead of consent, as the legal basis for processing of personal data; Blockmetry acts as the data processor working under your instructions.

To be able to use legitimate interest, the data controller must produce a data protection impact assessment (DPIA), justifying the balance of the controller’s needs and the data subjects’ rights and freedoms. We will work with you to produce a DPIA for the data Blockmetry produces on your behalf.

Further, because Blockmetry does not use cookies (or anything stored on visitors’ devices), it is easier to comply with the requirements under the current EU ePrivacy Directive.

Privacy by design and default

The GDPR espouses the principles of privacy by default and design, data minimization, and other principles about good data processing and governance. Any data Blockmetry collects needs to be for a specific purpose that is easily explained, and the data actually collected needs to be proportionate for that purpose.

The purpose is simple: Understand the impact of content and marketing activities.

In more detail: All data we collect is documented and auditable, and we aim to collect as little data as possible, justifying each. Three aspects of how the product works are particularly relevant:

  1. All collected data is anonymized as necessary. Blockmetry has robust anonymization techniques that are applied to all customers, and each customer can configure further anonymization specific to their website (see next section).
  2. Data is minimized. In addition to not collecting data unnecessarily, the data we do collect is minimized and stored in a canonicalized format. This counteracts device fingerprinting.
  3. Blockmetry does not store the analytics records it produces, and it cannot read the data once it reaches the customers data stores. This means that it is impossible for Blockmetry to measure cross-site activity.

Tailoring anonymization to your website

In addition to the baseline anonymization part of Blockmetry’s processing, we will work with you to anonymize the measurements data if your website requires.

Example: Some URLs may contain a user ID or username and also be only be accessible if the user is logged into the site. This means that successful requests to these URLs identify the logged-in user in web analytics records. We will work with you and request specific instructions on how to anonymize such URLs.

Honoring browser privacy settings

Although Blockmetry does not track individuals, the product still tries to honor user-provided privacy signals like DNT where relevant. For example, see the help article about how Blockmetry processes IP addresses.

EU-based processing, export to third countries

Unless you instruct us otherwise, Blockmetry will process all web analytics data measurements using EU-based datacenters.

Further, as part of signing up to Blockmetry, you will be asked to instruct us where to store the web analytics data Blockmetry produces (in data stores you own - see the data integration help article). As you fully choose where to store the data, your instructions could implement export of the web analytics records outside of the EU or keep it within the EU.

Data security

Security is part of privacy by design, as well as being important for building trust between end-users (the data subjects), the website they’re visiting (our customers, the data controllers), and Blockmetry (the data processor).

For data in transit, Blockmetry uses HTTPS only and nothing else. Measurements are sent on HTTPS URLs, origins are accessed over HTTPS, and all internal APIs are called using HTTPS URLs. Where possible, we go a step further and block access to calling a resource over HTTP.

We work with the customer to get write-only access to their storage, and the customer is responsible for data security once Blockmetry saves the analytics records in their data store. See the data integration help article for details.

Transparency about subprocessors

We use Amazon Web Services (AWS) for Blockmetry’s technical infrastructure. AWS has datacenters worldwide, and we currently use the Dublin, Ireland, datacenter (i.e. within the EU). We plan to operate in more EU datacenters in the near future. AWS has good GDPR compliance documentation.