36

The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for the provision of an information society service requested by the subscriber or user". It does not require you to seek consent for the use of any cookie no ...


29

The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient if properly implemented (strong hash function, use of salt, etc). But other methods of securing the password might be sufficient. Encrypting the PW rather ...


26

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.


14

Well, you may be right (probably), yet then again, you may be wrong... As David Siegel mentioned, they may have encrypted the password and have authorized support personal decrypting them up-on support calls for authentication purposes... What you can do is to submit a Data Subject Access Request focused on your Password and HOW they handle it in a secure ...


14

2016/679 ("GDPR") defines the responsibilities of data processors and controllers (subject to the scope of the legislation). An individual can declare whatever they like, but those processors and controllers will still be bound by the legislation. In many cases consent will be irrelevant - it's only one of the lawful bases for processing : (a) ...


12

In short, no. Article 20 of the GDPR covers the “Right to data portability”, which essentially says two main things: The data subject had the right to an exported copy of their personal data in a common format And The data subject has the right to have this data transmitted directly from one controller to another where technically feasible. Neither of ...


10

Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: Assuming ...


10

You can't make a binding declaration If you wish, you can make a public declaration that you grant consent for any and all processing of your data. You would likely have to be more detailed than that (consent needs to be informed and specific) - you'd likely have to exhaustively specify that yes, you know that this includes also this and that specific ...


10

It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for ...


8

She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or delete it completely. If they don't give a satisfactory response, mention the CPDP. This could lead to the data being removed within a few days, while an ...


8

GDPR defines consent like this in Art 4(11): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; Further conditions on consent are ...


6

Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing....


6

How to store consent According to the ICO, you need to store the following: Who consented the name of the individual, or other identifier (eg, online user name, session ID). When they consented a copy of a dated document, or online records that include a timestamp; or, for oral consent, a note of the time and date which was made at the time of the ...


6

The Art. 29 WP has released Opinion 05/2014 on Anonymisation Techniques. There it defines a hash function like this: Hash function: this corresponds to a function which returns a fixed size output from an input of any size (the input may be a single attribute or a set of attributes) and cannot be reversed; this means that the reversal risk seen with ...


6

Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes ...


6

It seems like some law must have been breached during the sharing of this information? No. A scrutiny of your pseudonymous account would reveal that you used it for advancing your own business interests. That use forfeits the protections for which the GDPR was intended. The Terms of Use very likely contain a provision to the effect of disclosing account ...


5

If you are not processing the personal information of EU citizens yourselves then you are unlikely to be classed as data processors under GDPR (check Article 3: Territorial Scope, p.32-33). If you were to operate a Software-as-a-Sevice (SaaS) solution then you would be a data controller/processor (or both) and GDPR would certainly apply if you have EU ...


5

As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (OTP or pad) is correct. That does not mean that there is no way to prove such a decryption accurate to the satisfaction of a court of law. If the storage or ...


5

Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it is better to think of it as spliting in two. If the prosecution finds both pieces and can tie them to you, then they have a good evidence against you. Both parts ...


5

Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this ...


5

No, a company cannot suspend your GDPR rights – contracts can't override the law. Your rights as a data subject apply as long as your personal data is being processed. However, there is no requirement in the GDPR that they fulfill your data subject rights through a self-service mechanism like a “download my data” button. They can require you to use another ...


4

Q1. Is there a requirement under GDPR for data processors to disclose sub-processing arrangements and the names of the organisations involved in this? "The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the ...


4

The answer is right there in the quote: any information relating to an identified or identifiable natural person So if the data can in any way be tied to a specific individual then it is personal data. Note that you have to consider the data collection as a whole - even if there are no names in your data, if there is enough info in it that you can work ...


4

Data can only be processed if there is at least one lawful basis to do so. The lawful bases for processing data are: the data subject has given consent to the processing of his or her personal data for one or more specific purposes. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the ...


4

Keeping logs of chats would not necessarily be against the GDPR as you have suggested. For the IRC service provider/operator: these chats/logs would be within scope if EU-based users are involved and this means the data controller/processors would have legal obligations to comply with GDPR. The IRC service provider/operator would be the data controller and ...


4

a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already ...


4

Can you anonymise people It is valid to anonymise the data of people, instead of deleting all of the records. The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional ...


4

It depends on whether you can identify the person to whom a username hash belongs. If you store both username and its hash in the same database row then yes. If it is impracticable for you to identify the person by their hash only, then no. This comes from the definition of personal data — "any information relating to an identified or identifiable natural ...


4

Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual ...


Only top voted, non community-wiki answers of a minimum length are eligible