Hot answers tagged

15

Yes, GDPR applies: you are a data controller established/living in the UK or are offering services to people in the UK you fall under the material scope of the GDPR. The Art 2(2)(c) exemption for “purely personal or household activity” does not apply since you're offering the service to the public. You must consider GDPR compliance here. This is especially ...


7

How can I truly say that I 'consent' to data collection and processing when I am coerced, so to speak, by the threat of failing my courses if I do not use this novel software? There is no need for you to "consent". Consent is just one of the reasons that allows a data processor to collect your data. There are other reasons that allows the data processor to ...


7

But that a phone number exists in your collection is interesting information. Since phone numbers are identifying and so short that they are guessable, hashing does not provide anonymization. Hashing could still be an appropriate safety measure or pseudonymization technique. Note that the salt is typically stored as part of the hash value, and should not be ...


5

Article 5(1)(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).


2

GDPR Articles 13–14 assume that the information is provided once. Art 15 has some overlap in the information requirements, but is not identical. The relevant recitals 60–62 offer no further guidance. They state that there's no information obligation where the data subject already posesses the information, but don't account for the case that the information ...


2

The scenario you describe is entirely expected. Leaving contact details on voicemail is one of the chief functions of voicemail, and such data definitely falls under the GDPR. Now, under the GDPR this is not a problem. The customer left that data intentionally for you in order to be contacted. That is sufficient reason for you to have that data. However, ...


1

As the company implemented it that way, it is a bad idea to notify them. First and foremost, you notify the company of a security issue - you give them a reasonable amount of time to resolve it, and then you publish it. The management may know nothing about how the data is handled, and may rush to fix it when notified - you cannot make an assumption that ...


1

I fear that you have 'jumped the gun' - I think you and your colleagues in the legal/compliance department should first meet to discuss your project. You must facilitate their understanding of the project so that you and they can discuss your options and obligations under GDPR and other such rules in your jurisdiction. It may be the case that this project ...


1

This isn’t anonomization under the GDPR The reason IP addresses are personal data is because they are unique to an individual. So are your hashes.


Only top voted, non community-wiki answers of a minimum length are eligible