35

The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for the provision of an information society service requested by the subscriber or user". It does not require you to seek consent for the use of any cookie no ...


29

The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient if properly implemented (strong hash function, use of salt, etc). But other methods of securing the password might be sufficient. Encrypting the PW rather ...


26

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.


14

Well, you may be right (probably), yet then again, you may be wrong... As David Siegel mentioned, they may have encrypted the password and have authorized support personal decrypting them up-on support calls for authentication purposes... What you can do is to submit a Data Subject Access Request focused on your Password and HOW they handle it in a secure ...


14

2016/679 ("GDPR") defines the responsibilities of data processors and controllers (subject to the scope of the legislation). An individual can declare whatever they like, but those processors and controllers will still be bound by the legislation. In many cases consent will be irrelevant - it's only one of the lawful bases for processing : (a) ...


11

In short, no. Article 20 of the GDPR covers the “Right to data portability”, which essentially says two main things: The data subject had the right to an exported copy of their personal data in a common format And The data subject has the right to have this data transmitted directly from one controller to another where technically feasible. Neither of ...


10

You can't make a binding declaration If you wish, you can make a public declaration that you grant consent for any and all processing of your data. You would likely have to be more detailed than that (consent needs to be informed and specific) - you'd likely have to exhaustively specify that yes, you know that this includes also this and that specific ...


9

Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: Assuming ...


8

She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or delete it completely. If they don't give a satisfactory response, mention the CPDP. This could lead to the data being removed within a few days, while an ...


6

Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing....


6

How to store consent According to the ICO, you need to store the following: Who consented the name of the individual, or other identifier (eg, online user name, session ID). When they consented a copy of a dated document, or online records that include a timestamp; or, for oral consent, a note of the time and date which was made at the time of the ...


6

The Art. 29 WP has released Opinion 05/2014 on Anonymisation Techniques. There it defines a hash function like this: Hash function: this corresponds to a function which returns a fixed size output from an input of any size (the input may be a single attribute or a set of attributes) and cannot be reversed; this means that the reversal risk seen with ...


6

Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes ...


5

If you are not processing the personal information of EU citizens yourselves then you are unlikely to be classed as data processors under GDPR (check Article 3: Territorial Scope, p.32-33). If you were to operate a Software-as-a-Sevice (SaaS) solution then you would be a data controller/processor (or both) and GDPR would certainly apply if you have EU ...


5

As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (OTP or pad) is correct. That does not mean that there is no way to prove such a decryption accurate to the satisfaction of a court of law. If the storage or ...


5

Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it is better to think of it as spliting in two. If the prosecution finds both pieces and can tie them to you, then they have a good evidence against you. Both parts ...


5

Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this ...


4

Q1. Is there a requirement under GDPR for data processors to disclose sub-processing arrangements and the names of the organisations involved in this? "The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the ...


4

The answer is right there in the quote: any information relating to an identified or identifiable natural person So if the data can in any way be tied to a specific individual then it is personal data. Note that you have to consider the data collection as a whole - even if there are no names in your data, if there is enough info in it that you can work ...


4

Data can only be processed if there is at least one lawful basis to do so. The lawful bases for processing data are: the data subject has given consent to the processing of his or her personal data for one or more specific purposes. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the ...


4

Keeping logs of chats would not necessarily be against the GDPR as you have suggested. For the IRC service provider/operator: these chats/logs would be within scope if EU-based users are involved and this means the data controller/processors would have legal obligations to comply with GDPR. The IRC service provider/operator would be the data controller and ...


4

a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already ...


4

Can you anonymise people It is valid to anonymise the data of people, instead of deleting all of the records. The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional ...


4

It depends on whether you can identify the person to whom a username hash belongs. If you store both username and its hash in the same database row then yes. If it is impracticable for you to identify the person by their hash only, then no. This comes from the definition of personal data — "any information relating to an identified or identifiable natural ...


4

Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual ...


4

Any processing of personal data needs a legal basis, for example necessity for some contract or legitimate interest. If no other legal basis allows the processing, you need to acquire consent. Consent must be freely given. If something is gated behind consent without that consent being really necessary, this might coerce users and they would not be able to ...


4

This is a large question, so I'll only put a spotlight on some misconceptions. Why can't Google use legitimate interest instead of consent to serve ads? A data controller such as Google must choose an appropriate legal basis per Art 6(1). But if the legal basis is consent, and the data subject declines or retracts consent, you can't do the processing ...


3

Legalities What is being proposed is illegal in most jurisdictions and particularly so if any of your users is in the EU or an EU citizen. All jurisdictions I know of have a law that prohibits businesses from engaging in deceptive or misleading conduct; in most cases irrespective of intent. Deliberately setting out to "fool" your customers is a textbook ...


3

The CEO wants to "fool" users You are essentially admitting that the company you are working for is about to deceit its customers and asking whether that is legal. The relevant set of laws is rather sparse and does not give direct answers in regards to oAuth tokens or other details of that level (which is probably making your CEO think he can "handle" the ...


Only top voted, non community-wiki answers of a minimum length are eligible