Hot answers tagged

29 votes

Is there a way to determine if an email address is personal information?

Treat all email addresses as if they are personal data. All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address. If your ...
  • 1,559
27 votes

Do I need to present a GDPR banner to IP addresses outside of GDPR regions?

Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't ...
  • 8,823
15 votes

Is there a way to determine if an email address is personal information?

As quarague correctly points out, you cannot reliably determine whether an email address is personal data. But since nearly all email addresses are personal data, you should treat all addresses in ...
  • 19.3k
14 votes

Do I need to present a GDPR banner to IP addresses outside of GDPR regions?

The answer by user Someone is correct, the GDPR applies to data associated with anyone physically in the EU, UK, or other places with a GDPR law. The comment quoted in the question is incorrect on ...
13 votes
Accepted

Are push tokens considered PII under the GDPR or the CCPA?

Yes, but it doesn't matter. This answer discusses gdpr implications. Personal data is any information that relates to an identifiable person. The GDPR has an extremely broad concept of identifiability,...
  • 19.3k
7 votes

Are push tokens considered PII under the GDPR or the CCPA?

it only identifies a device and not a human being It identifies a device that is associated with an identifiable person. As an IP address is personal data under the GDPR, it's hard to see how a push ...
  • 26.4k
6 votes

Is there a way to determine if an email address is personal information?

Email should be treated as personal data. There is no long or complicated answer here. Even if it has no names or anything, they can sometimes be traced back to a real person so they are personal data....
  • 123
4 votes

Do I need a cookie policy/cookie consent on my website just because I use PayPal buttons?

You need a privacy notice for any website (if you're subject to GDPR). Having a PayPal button alone does not trigger such an requirement, since any website is already processing personal data such as ...
  • 19.3k
4 votes

Is there a way to determine if an email address is personal information?

All email addresses are personal data This is because they can be combined with other information to identify a natural person. For your example of sales@example.com, for a sufficiently small ...
  • 162k
3 votes
Accepted

Where should personal data be stored to comply with GDPR?

According to azure.microsoft.com: All Azure services can be used in compliance with the GDPR. If customers using Azure services choose to transfer content containing personal data across borders, ...
  • 58
3 votes
Accepted

By what mechanism does GDPR jurisdiction bind data controllers that operate outside the EU?

Because most countries enforce foreign judgements You get prosecuted in the EU and have a fine imposed. If you have no assets in that jurisdiction they give the judgement to a court in your ...
  • 162k
3 votes

Is Pushshift.io compliant to GDPR if they refuse to delete collected content?

Maybe, but probably not The geographic location of the organisation is immaterial: under Article 3.2: This Regulation applies to the processing of personal data of data subjects who are in the Union ...
  • 162k
2 votes

Is Pushshift.io compliant to GDPR if they refuse to delete collected content?

It is quite possible that Pushshift is not subject to the GDPR. But it's impossible to know for sure until a court rules on this specific case. As Dale M's answer correctly points out, we have to ...
  • 19.3k
2 votes
Accepted

Understanding the last sentence in Article 25(2) of GDPR

Indeed, this is not drafted very well. But from context, it seems that the “individual” unambiguously refers to the data subject. What this section says is that data controllers such as websites ...
  • 19.3k
2 votes

Do I need to present a GDPR banner to IP addresses outside of GDPR regions?

You said, in a comment, that you may be asking the wrong question. I think a better way to put it would be that your question based on a confusion that is extremely common, so it deserves a clear ...
1 vote

Does the GDPR's "right to be forgotten" extend to Google's search results?

Yes. The GDPR's right to be forgotten is even modeled after case law that was developed around Google search results. Thus, you may have a right – depending on your individual circumstances – to order ...
  • 19.3k
1 vote

Where should personal data be stored to comply with GDPR?

You can always use cloud services if the data is guaranteed to remain in the EU. This is the case for many Azure services. You can also process data in non-EU locations, if this data transfer is ...
  • 19.3k
1 vote
Accepted

What are good tips and tricks to keep in mind when performing a subject access request for a comprehensive record of self-pertinent data from the met?

The Information Commissioner's Office has published a webpage called "Get access to your personal data held by the criminal justice system". This seems to provide comprehensive advice about ...
  • 7,718
1 vote

Can I process personal data without consent if it it helps me serve the user sooner, rather than later?

Yes, you can likely use data in this way without consent, especially if you're just gathering aggregate statistics and are not performing invasive tracking of customers. In a GDPR context, consent is ...
  • 19.3k
1 vote

What exactly triggers the GDPR Article 14?

Simply put, Art 14 GDPR is often ignored. But also, it triggers less often than some might think. While Art 14 applies whenever the data controller processes personal data that weren't obtained (...
  • 19.3k

Only top scored, non community-wiki answers of a minimum length are eligible