Hot answers tagged

28

The point of privacy laws is to set basic standards that apply to everyone, whether or not they have a privacy policy. A privacy policy that is inconsistent with privacy laws cannot be enforced. Breaches of privacy law can be punished even if the conduct is permitted by a privacy policy. Article 7 of the GDPR illustrates this by making special provision for ...


17

GDPR doesn't generally expect “agreement”, so it's not necessary to prevent access by people who don't “agree”. A privacy policy is not a contract, but an unilateral notice about how personal data will be processed. This processing is either legal, or it is not. The GDPR contains various conditions and parameters that determine what is legal. In particular, ...


15

By itself, a chess position is not personal data. Personal data is “any information relating to an … identifiable natural person”. Since the file in question includes the name of the opponent, it is clearly personal data about the opponent. If the files are used for “purely personal or household purposes”, the GDPR won't apply per Art 2(2)(c). If the files ...


8

It is absolutely not the case that Providers are not allowed to keep PII without consent. Article 6 of the GDPR identifies six possible lawful bases for processing personal information. These are: (a) the data subject has given consent ... (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take ...


5

Yes, you can use such eye tracking if you obtain consent in a suitable manner. But obtaining consent is going to be very difficult for you. The processing activity in question occurs within the context of an EU establishment of the data controller. Thus, GDPR applies regardless of where the data subjects are located. Under GDPR, any processing activity needs ...


4

The GDPR will probably not allow a successful demand for erasure in these circumstances. The company does not need to argue "that they can't delete user information for fear of be liable for.something" because GDPR art 17 1(c), 3(b), and 3(e) already make that case for the company. Lets look at the relevant law. GDPR Article 17 reads in relevant ...


4

Consent is only one of the 6 GDPR grounds. Necessity is another. Since a provider provides an on-going service, it needs a contract, and the contract by necessity needs to name the parties of the contract.


3

The GDPR has a fairly broad concept of what it means for a data subject to be identifiable. The details are given in Recital 26: To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person ...


2

A privacy policy is generally not an agreement or a contract, it is a statement of the provider's actions in connection with the acquisition and retention of personal information (PI) and other privacy issues. Various laws may require a provider to hae a current and accurate privacy policy displayed, including the GDPR, the CCPA, HIPPA, and various industry-...


1

A piece of data that cannot be used to identify a natural person, and is not linked to a specific natural person is not PI under the GDPR or most other data protection laws (such as the CCPA). Therefore, such a datum does not need a lawful basis for processing, need not be included in notices of data collection provided to the user, is not subject to erasure ...


1

I would expect that this depends on the purpose for which push notifications are used. There will be absolutely no problem where the push notification is strictly necessary to provide a service explicitly requested by the user. In case the push notifications are used for marketing purposes, I would be inclined to consider push notifications to be ...


1

couldn't any company argue that they can't delete user information for fear of be liable for.something? In most contexts, yes. The merit of that argument is premised on article 17(3)(b), (e) of the GDPR for as long as the potential claims have not prescribed. In the context you outline, the exchange has to comply with regulations for purposes including, but ...


1

By using their service, you have to agree to their conditions. So yes, if you don't agree, you can't use their services. There are alternatives, although of course they may have limitations in functionality or reach (there's a reason many people think google is the best search engine). If you think they do more with your data than what you agreed to, you may ...


1

The GDPR does apply to government as well, but that doesn't mean you automatically get a right to opt out. Under GDPR, every collection or further processing of personal data needs a legal basis. Well-known legal bases are “consent” or “legitimate interest”. But instead, your country's registry will likely operate for “a task carried out in the public ...


1

does the law have provisions for 'well known service providers' when it comes to privacy terms? No, the law (generally) doesn't make a provider's rights worse when it crosses a certain size threshold. And even where those restrictions exist, they can be gamed around. Suppose you "break up AT&T" as it were. Four brothers form corporations: ...


Only top voted, non community-wiki answers of a minimum length are eligible