Hot answers tagged

26

The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in which member state data is stored or processed. Member states cannot generally limit this single market via national laws. Furthermore, secure processing may be ...


6

Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes ...


4

Basically how reducible is personal information until it's no longer personal information? When it can no longer be used, alone or combined with other data, to identify a person (or small number of people). Context matters, if you have data on the people in say New York City, (pop. 8 million+) there are only 676 2 letter initials which averages out to about ...


3

There are two "cancellations" here. There is a contract between the customer and the company. This contract was ended. Also, as part of GDPR obligations, the data of the former customer was removed. Now the "credit" part suggests a pre-paid phone, which are often described as "no contract". Legally this is incorrect. There is a ...


3

This is less of a compliance question, and more of an infosec question. On one hand, you want to be able to restore access to an account to users who have lost their access. On the other hand, you must prevent unauthorized access e.g. from hackers. These factors must be balanced. Whether you'll fulfil a data subject access request will generally follow the ...


3

There are two relevant bodies of EU law to consider here. The GDPR covers processing of personal data. Personal data is any data where the data subject can be identified directly or indirectly. The ePrivacy directive is also relevant, and covers how you may access and store information on the user's device. Directives are not directly applicable law. ...


3

Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined? No, the GDPR is based on "general principles" and does not concern itself with implementation details for such matters. It's possible there's EU case law on this, but I can't find any. Am I within my ...


3

Copyright protects literary and artistic expression, not facts. So, in a database, the structure of the tables, the construction of the queries and the presentation of the user interface are all subject to copyright. The data stored in each record is not subject to copyright if it is a fact but is subject if it is a literary or artistic work. For example, ...


2

Sleep pattern and timezone deduction are arguably not "personal data" within the meaning of the GDPR. Personal data is defined in Article 4 as: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to ...


2

The GDPR Art 20 right to data portability is distinct from the Art 15 right to access, although there is some overlap. The right to data portability likely applies here because processing is performed using automated means, but you're only entitled to a machine-readable copy of data that you provided. For example, this would require a social media service to ...


2

Art. 2(2)(c) GDPR does include a personal use exception: This Regulation does not apply to the processing of personal data: (c) by a natural person in the course of a purely personal or household activity; As Free Radical noticed, this is clarified in Case-law (which refers to the identically worded exemption in Directive 95/46/EC). C-101/01 ...


2

are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU? Absolutely. The territorial scope of the GDPR is specified at Article 3: Article 3 Territorial scope This Regulation applies to the processing of personal data in the context of the activities of an ...


2

You want to sell or distribute Intellectual Property owned by other entities? Depending on the jurisdiction it's likely that you will need permission from the IP owner.


2

That is an interesting question that I don't think has been tested in an highly analogous case. There are a number of sci-fi works that posit elaborate systems of made-up facts about Dragon's Egg and Rocheworld. "20 km in diameter" by itself is not a expression protected by copyright, but as part of a highly creative system, it is protected. If these "data" ...


2

...do I own the data on a website that I created an account? Maybe not. Read the Terms of Service for the site; it is a legally binding contract. The TOS will outline what you agree to when opening an account and using the site. When signing up for the free plan, you agreed to the TOS, and you probably agreed to a stipulation that the site owners are only ...


2

You appear to be outraged and offended at the terribly dangerous technology in use, but the database is filled with publicly-available data scraped from sites like Facebook, Twitter, etc. Publicly available data. You - and all of those other billion users - agreed to allow those platforms to publicly share your data with other platforms or scrapers ...


2

You should make sure that the person making the request is actually the data subject. However, you have a lot of flexibility to create an approach that is appropriate for your specific circumstances. Per Art 12(6), where you have reasonable doubts about the identity of the person making the request, you may request additional information to confirm the ...


2

You know you have legal recourse - your lawyers have advised you to budget £20,000 for it. You know the person you are targeting has no resources with which to reimburse you. You know enforcement will be problematic and likely ineffective due to the cross-national jurisdictions. Extradition is not relevant because this is s civil, not criminal matter. You ...


2

You are not describing anonymization, you are describing pseudonymization. Recital 26: (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information ...


2

This seems as some potentially misleading advertising from your competitor. If the reviewer tested Winamp, then Microsoft bought the brand and rebranded Windows Media Player as Winamp 6, those prior reviews would face no value to new customers, since they are about a different product. A review may be useful because it tells you something about the product ...


1

It looks like copyright infringement, unless you can defend your use as fair use. But you would have to defend such usage in court, therefore you should hire an attorney specializing in copyright litigation to get a more detailed analysis. The nuisance value of getting sued might dissuade you; but who would sue you? Probably the photographer(s) / artists: it'...


1

Revealing whether an EU citizen used a service could certainly be considered a data breach under the terms of GDPR, but that's not what's happening here. The service provider would be checking whether a particular string of characters had appeared before as an account name. This wouldn't have to be a name, an e-mail address, or anything else directly ...


1

he can fill out [...] his company name and location. You only talk about data which identifies a company. Article 2 GDPR contains: This Regulation applies to the processing of personal data [...] Article 4 GDPR contains: (1) ‘personal data’ means any information relating to an identified or identifiable natural person [...] So the GDPR ...


Only top voted, non community-wiki answers of a minimum length are eligible