Hot answers tagged

15

It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for ...


14

Of course it's legal. Hyperlinking to an unaffiliated website in no way "determine[s] the means and processing of data." The person who makes these determinations is the person running the website. If I link to Microsoft's website, that doesn't give me any control over how Microsoft processes data on the website.


8

GDPR defines consent like this in Art 4(11): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; Further conditions on consent are ...


8

It seems like some law must have been breached during the sharing of this information? No. A scrutiny of your pseudonymous account would reveal that you used it for advancing your own business interests. That use forfeits the protections for which the GDPR was intended. The Terms of Use very likely contain a provision to the effect of disclosing account ...


5

In principle, the data subject's right to access involves a copy of all personal data the controller holds on them. There are no time limits by default. Of course, the controller can ask a data subject to clarify their request, e.g. to focus on a particular time frame. There is an implied time limit though: personal data may only be processed/stored for as ...


5

A data controller is whoever determines the means and purposes of processing. It is possible that multiple controllers jointly determine the means and purposes. However, someone can only be controller over processing activities where they actually have the ability to influence these decisions (see e.g. the Fashion ID case). The provider of an app does not ...


4

If you can’t stand the heat, get out of the kitchen The thrust of this question, as well as many others you have posted, seems to be looking for a way of avoiding your obligations under the GDPR because they are difficult, onerous and/or expensive. Too bad! You don’t have the option of which laws you comply with and which ones you don’t. If I had my choice, ...


4

Your premise is absurd Your example is manifestly absurd. You say, “a user gives and withdraws consent every second” which is clearly stupid because a) a server based solution won’t refresh that quickly, b) your user has nothing better (like sleeping, eating etc.) to do for a year than do this c) who does this? Further, you then apply this to every user. Let’...


4

You are responsible for any processing of data that happens under your control – but are you the data controller in this scenario? Since you have no meaningful influence over whether or not this backup happens on the operating system level, there could be a strong argument that you aren't a data controller for these backups. And if you aren't a data ...


4

Yes, the role of a Representative is largely to serve as a point of contact for supervisory authorities and data subjects. Much of this could be done by a person who just scans and forwards any incoming mail. In practice, the Representative should be a lawyer or at least a compliance professional in order to fulfil their role effectively, in particular when ...


3

A public key is private data - the fact that its a public key is neither here nor there, its data owned by the user and not necessarily in the public domain (I have keypairs for which the public key is only known by myself, for example). For a subject access request, you must give the user all data you hold about them, subject to certain restrictions laid ...


3

A data subject access request can be valid even if it wouldn't disclose new information. The right to access ties in with the GDPR's transparency principle (finding out which data is being processed) and with the right to rectification (are there any mistakes in the data being processed?). For rectification, it's pretty much ideal if you get back exactly the ...


3

This is matter for the contract between the controller and the processor The processor is providing a service for the controller. How much the controller pays for that is a private matter between the two.


3

StackExchange is a processor under GDPR because it processes the data you provide it when you sign up and input personal information. It's determined by an analysis of what function(s) the business is performing. If you are merely processing the data but don't have control over it (e.g. another business is using your software to do something with data that ...


3

If GDPR applies, then trying to skirt your responsibilities with such terms of service would be blatantly illegal. A contract that tries to pass your fines on to users would not hold up in court. See also Dale M's answer. However, GDPR might not apply to you. When we look into Art 3 GDPR (territorial scope), we find this: 2. This Regulation applies to the ...


2

EU Member State Data Protection Authorities ("DPAs") have fined foreign legal entities (pursuant to Articles 58(2)(i) and 83 GDPR and further national provisions), however it is not publicly documented whether the specific situation you described has occured. Even if such situation would arise, I would think that it is unlikely that DPAs imposing ...


2

Your rights are unaffected To be clear, your phone number of itself is personal data as defined in the GDPR. All you require to make a Data Access Request (DAR) is proof that it is your phone number. The recipient of your DAR is required to provide you with the data they have about you and: why they have it the categories of data they have who they’ve ...


2

Personal data is any information relating to an identified or identifiable person (Art 4(1) GDPR). It is not necessary that the personal data is in itself identifying. PII is an US concept that has nothing to do with GDPR. An opinion of a person clearly relates to that person, thus processing someone's opinions is likely to be processing of personal data. ...


2

Interpreting Art. 15 GDPR "Right of access by the data subject" I would think that the company in your scenario has to send all data which they have collected about the user, after the user is identified by e.g. email address. Plus other information like e.g. the purposes of the processing, see all bullet points in the link. If you have user data ...


2

Yes, setting a cookie to remember that cookies were declined is the most appropriate approach. No, you usually shouldn't send this info to your backend. Many cookies require consent because the ePrivacy directive (closely related to the GDPR) says that you can only access information on a user device if (a) that access is strictly necessary for the service ...


1

GDPR (Recital 64 Identity verification) says about this topic: The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. ...


1

GDPR is very specific about who the data controllers and data processes are, in a given process. By simply linking to a site, you do not qualify as either a data controller or data processor. https://www.gdpreu.org/the-regulation/key-concepts/data-controllers-and-processors/ A data controller is a key decision makers. They have the overall say and control ...


1

Complying with a contract can require you to enter another contract For example, when I hire a contractor I can require them to have public and product liability (or any other) insurance - that requires them to enter a contract. Or, I can require my builder to engage a particular plumber as a subcontractor. Or I can require my student to enter a particular ...


1

The freelancer is a data processor under GDPR Data processors have similar but different obligations under GDPR as data controllers. Having a privacy policy is the least of them.


1

Executives who break the law can and do go to jail For example: Russell Waugh Rupert Stadler Carlos Ghosh There are many jurisdictions that impose potential imprisonments on executives for all sorts of offences: corporate governance, work health and safety, environmental damage, financial malfeasance. So why not privacy breaches? So, the answer is simple: ...


1

After having looked at many cookie consent forms, of major companies and organisations, I've noticed an obvious pattern in how the design of the form is used to trick the user. Here's an example of the news website of the Belgian state-sponsored national broadcaster VRT: The list of additional cookies, and whether they are enabled or not is clear enough; ...


1

The data controller is responsible for GDPR compliance. When the controller engages a data processor, the data controller must ensure that the data controller can fulfil their obligations. For example, the data controller should ensure that they can delete personal data processed by the data processor. How the controller and processor sort this out is up to ...


1

In the EU, the rules for selling apps to consumers fall under the "distance selling" rules. That means that consumers have a legal right to get a refund, as you already discovered. As is usual for EU consumer protection, it's not possible to wish this protection away. No amount of words from your side is going to alter the law. "nonrefundable&...


1

If "play store" means the Google play store, take a look at Google's developer distribution agreement. It is a contract between the developer and google, and it answers many of your questions. Here is the UK version. Check section 3.8. If you want to circumvent the agreement, you need more legal advice than some random guys on the web.


1

The consent requirement doesn't come from using cookies, but from the ePrivacy directive's rules on accessing information on the user's device, unless that access is strictly necessary for the service requested by the user. The law is not specific to any technology. Fingerprinting generally accesses information on the user's device, and is therefore ...


Only top voted, non community-wiki answers of a minimum length are eligible