Hot answers tagged

6

The GDPR roughly applies in the following scenarios: Art 3(1): you have an establishment in Europe Art 3(2): you do not have an european establishment, but Art 3(2)(a): offer goods or services to persons in Europe Art 3(2)(b): monitor the behaviour of people who are in Europe (where Europe means EU/EEA/UK as appropriate). Art 3(1) does not seem to apply ...


6

Yes, you still need consent (opt-in). Cookies usually require consent, but not always. There are two relevant laws at play here: GDPR makes general rules about the processing of personal data, and ePrivacy has specific rules about cookies and similar technologies, regardless of whether the cookies involve personal data. The ePrivacy directive was implemented ...


5

The California CCPA, Virginia Consumer Data Protection Act (CDPA), and the Colorado Privacy Act (CPA) all use definitions of "personal information" (PI) very similar to that used by the GDPR, and the arguments which have been applied to classify an IP address as Personal Data under the GDPR could logically be used under each of those laws. For ...


4

The GDPR applies to interactions with any users who are currently inside the EU, even if they were not in the EU when the first accessed the service, or indeed the day before. If a person currently in the EU uses the service and personal information (PI) is collected or processed as a result of that interaction, there must be a lawful basis, often user ...


3

The data controller is correct: they can take up to three months (approx. 90 days) to process a request, though this is only allowed in exceptional cases. From Art 12(3) GDPR (emphasis mine): The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month ...


2

It seems that A is the data controller and X is a data processor who processes personal data on behalf of A, and will only use the data as instructed by A. This will be formalized by a contract/data processing agreement per Art 28 GDPR, which is probably meant here by a “order processing contract”. The Art 33 GDPR responsibility to notify the supervisory ...


2

This is most likely OK. Yes, this installation involves the processing of personal data by capturing video feeds. However, this is likely covered by a legitimate interest in doing so. And a real-time video feed is less sensitive than the recording of the installation (such as the video you linked) since the feed is only visible to a small number of people ...


Only top voted, non community-wiki answers of a minimum length are eligible