Hot answers tagged

5

No, a company cannot suspend your GDPR rights – contracts can't override the law. Your rights as a data subject apply as long as your personal data is being processed. However, there is no requirement in the GDPR that they fulfill your data subject rights through a self-service mechanism like a “download my data” button. They can require you to use another ...


3

I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if ...


2

Sleep pattern and timezone deduction are arguably not "personal data" within the meaning of the GDPR. Personal data is defined in Article 4 as: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to ...


2

Nicknames, usernames, or gamer tags are definitely personal data under the GDPR. You are operating under a very narrow definition of “identifying”, which is understandable since the definition of personal data in the GDPR isn't overly enlightening at first glance: […] an identifiable natural person is one who can be identified, directly or indirectly, in ...


2

The way you describe this UUID, it is pseudonymous data (see GDPR Art 4(5) and Recitals 28–29). That is, it is not directly identifying, but you have a mapping between pseudonyms and identifiers that can be used to re-identify this data. Effective pseudonymisation requires not only that the data is logically separate, but that there are effective ...


2

Does this mean that both tables fall under GDPR and thus must be placed in EU (or equivalent), or is it sufficient that only the table containing PII is located there? There is no requirement for data falling under GDPR to be physically located in the EU. It can be held in a country deemed to provide the same level of protection as existing EU data laws. ...


2

The rulings you refer to are not primarily about cookies or consent. They are about pages who use Facebook services, and claim that Facebook would be the sole data controller. As the ECJ has ruled, this is not the case: causing or contributing to Facebook's processing of personal data can establish a joint controller role. Thus, the admin of a Facebook page ...


1

The data controller is responsible for GDPR compliance. For embedded content, case law such as the Fashion ID case indicates a joint controllership where both the controller of the embedding page and the controller of the embedded content are controllers. However, one can only be controller for processing activities where one has influence on the means and ...


Only top voted, non community-wiki answers of a minimum length are eligible