Timeline for Does GDPR apply when PII is already publicly available?
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 24, 2023 at 10:30 | comment | added | Lag | There is a qualified right to erasure aka right to be forgotten. Google v CNIL is an example of a case that seems to match the circumstances described by the question. | |
| Jul 16, 2023 at 5:25 | comment | added | o.m. | (Contd.) Any data you keep under GDPR rules has to come with a description of the purpose of the data processing, and you may use it only for that purpose. Generally speaking, the purposes which allow you to keep data without consent are unlikely to allow the publication of that data. For instance, a company must keep their invoices with the billing address of their customers, even if those customers demand data deletion. But those invoices may only be used for tax and accounting, not for marketing. | |
| Jul 16, 2023 at 4:59 | comment | added | o.m. | @user5623335, not that simple. You will need to prepare formal documents, describing exactly which data you want to retain and on what legal basis, and why you think it applies. With consent, that is relatively easy. "They gave informed consent, so I do it." Still necessary to check that it is appropriate data use, or that the TOM are enough. Without consent, it is harder. You would have to explain why your interests in exploiting their data outweighs their interest in privacy. If this is an idea for a startup company, your business plan needs to include hiring specialist lawyers. | |
| Jul 15, 2023 at 23:53 | comment | added | user5623335 | If I never got consent, and they asked me to take it down, could I refuse by saying I got your name and title which is available for free publicly online? I am also refusing to take it down as I have a good reason - I am getting paid by my users. | |
| Jul 15, 2023 at 11:02 | comment | added | amon | @user5623335 Careful when processing data about trials: Art 10 GDPR forbids processing that relates to criminal convictions, except as explicitly authorized by some other law. | |
| Jul 14, 2023 at 16:45 | vote | accept | user5623335 | ||
| Jul 14, 2023 at 16:30 | comment | added | o.m. | @user5623335, it would make a difference, but how much of a difference depends on countless details, including the country you are operating in/from. Even convicted criminals have some right to privacy. | |
| Jul 14, 2023 at 16:15 | comment | added | user5623335 | Would it make any difference if this was information obtained from court transcripts - once again just focusing on full name, and title of the person? | |
| Jul 14, 2023 at 4:57 | comment | added | o.m. | @amon, the site could probably generate and post bios of sports stars or cabinet officials. But not bios of average guys. | |
| Jul 14, 2023 at 4:42 | comment | added | amon | The typical legal basis in this context would be a "legitimate interest", not consent. But LI requires performing a balancing test that takes into account the data subjects' reasonable expectations. Processing for journalistic purposes may benefit from an Art 85 GDPR exception, but that depends entirely on national laws. | |
| Jul 12, 2023 at 17:27 | history | answered | o.m. | CC BY-SA 4.0 |