It’s not just GDPR—new laws are cropping up in states throughout the U.S. Read up on tips to manage attendee data thoughtfully.

By Ernie Smith

There was once a time when the event industry might have played a little fast and loose with the data they were bringing in. There was a time when everything at an event was opt-out, rather than opt-in, and attendee email addresses might have been shared a bit too easily with sponsors.

But it’s long past time to stay on your P’s and Q’s.

In recent years, Europe’s General Data Protection Regulation (GDPR) has helped put fresh attention on the importance of effective data management. (You might recognize its handiwork from those preferences pop-ups you see on every news website.) But they’re not alone on these fronts—though some are further along than others.

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), for example, is perceived as a close equivalent to GDPR. And in the U.S., some state-level regulations, such as the California Consumer Privacy Act (CCPA), have tightened up data privacy rules.

But the regulations vary wildly from state to state—and are still actively changing, with eight such laws taking effect just this year. While some states are working together to coordinate their data privacy efforts in the absence of a federal law, confusion still leads the day.

What’s an event planner to do with this patchwork of regulations? According to Brian Scott, an IT consultant with Cleartone Consulting, one important thing to keep in mind is that finding a strong baseline will mostly keep you in the clear. While the details are likely enough to get a lawyer involved, GDPR, he says, offers a great starting point.

“If you just kind of follow those practices, you’re going to be good,” he says. “There’s not going to be a U.S. state that has a law that’s more stringent than that, right?”

Joseph Colangelo, the founder of the event intelligence firm Bear Analytics, has seen some dramatic shifts in the ways event planners perceive data. One came from the pandemic, which expanded the types of data event pros gathered. The other was GDPR, which he says was “kind of like a Y2K moment on the data side of things.”

“Our positioning at the time kind of was and still is this is a net good thing because all of a sudden it raises the heightened awareness for everyone that’s collecting any type of, personally identifiable information,” he says.

It creates a more restrictive environment around data—one where consumers have the ability to request data removals, where opting in is the norm, rather than opting out. But even if it makes life harder for marketers, event organizers big and small might still come out ahead—by building a reputation around respecting attendee data.

“Everyone agrees that data is valuable,” he says. “And yet they don’t really treat it like it’s valuable.”

More thoughts on event data management from Scott and Colangelo:

Leverage existing legwork: The event industry isn’t the only sector that has seen a dramatic rise in the use of data—and often, sectors like healthcare have much more sensitive rules around data. Cloud platforms like Microsoft Azure and Amazon Web Services are already built to meet strict regulatory needs, which can make it easier to navigate data privacy concerns. “They make it really easy for small to medium-sized businesses to have large or extremely-large business security and privacy policies,” Colangelo says.

Careful with those spreadsheets: Scott says that many organizations are aware of the need for responsible data handling, but that need frequently gets pushed to the side in the name of convenience. “Sending spreadsheets through email is kind of the way we’ve done business for years, and we still do it,” he says. “And it’s probably one of the biggest data-leaking risks out there.” Barring a comprehensive data management program, Scott suggests having data live in one place, such as a cloud-storage platform—and if that’s not possible, share that data in an encrypted format.

Set an example at the top: With data privacy practices, it’s easy to fall into line with the message that organizational leadership is sending. But if leadership isn’t taking data privacy seriously, there’s a real risk of a complacent mindset taking hold—which can create problems if past attendees request data removals, for example. “All of those cultures mirror and come down from, usually, the leader at the very top, in conjunction with the leadership team,” Scott says. “The leader really sets the tone.”

Consider your vendors: Given that much of the data you’ll be collecting about attendees may end up in external hands, it’s important to keep vendors to high standards and understand the data they have access to. “Data mapping is a really basic rudimentary skill to know what your environment is,” says Scott. Colangelo, meanwhile, recommends working with vendors that minimize their ownership of event data. “We don’t own any of the raw data that comes into the platform,” he says of Bear. “We own how we calculate stuff. We own the things that are proprietary to how we do what we do.”