Good question, glad you asked. So GDPR is the new “General Data Protection Regulation” and comes into force May 25 th 2018 for us EU residing souls. Although in principle it seems like headache inducing bureaucracy, it is in fact a well needed set of laws that prevent the current systemic interchange and flow of personal data on a massive scale. It’s kind of like someone finally inventing the seat belt for the automobile. It’s not perfect and it’s overly complicated so this is definitely a V1.0 but it will improve over time. Anyway, back to my question – GDPR in a nutshell has beef with any company using data for purposes that aren’t strictly essential to justify their collection – and it’s particularly hormonal towards companies that hoard data about individuals (versus business). For most of us, that’s probably not a major concern, tighten up your policies, document them and you’re good. However, there is a bit of a sticky spot when it comes to the concept of ‘third part