Hot answers tagged

11

The data processor is not responsible for complying with the GDPR. You are ultimately responsible, since you are the data controller. The data processor is merely required to assist you, but it's unclear what that means in the presented scenario. Per Art 28(3)(e) GDPR, the DPA must require the data processor to provide reasonable assistance: That contract ...


10

The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “[t]aking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of ...


6

No, you're not required to sign any contracts. But since you're offering a service, you do have to manage some compliance tasks. You are a data controller under the UK GDPR, regardless of whether you have a company. This brings with it various compliance requirements. For example, you MUST post a privacy notice in accordance with Art 13 GDPR that explains ...


6

That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in germany for example don't care about the GDPR: Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen ...


4

You are only responsible for the data that you collect or process, or data that you direct others to collect or process on your behalf. You are not responsible for the actions of third parties that may carry out incidental collection or processing that you have no control over - this includes such things as your ISP, backbone providers etc, but if you direct ...


3

Just because something is personal data doesn't mean you're prohibited from using/sharing/processing that personal data. You just need an Art 6 GDPR legal basis. Here, the copyright holder is offering you a contract: you're allowed to freely use that image, as long as you attribute them properly. Since this attribution is necessary for fulfilling the license ...


2

You are trying to invoke your Art 17 GDPR right to erasure. However, this right has many limitations. As a rule of thumb, your GDPR rights might not apply if their exercise would negatively impact other people. In this scenario, you're seeking to delete images from other people's private chats. Requiring Facebook to search their chat messages according to ...


2

Trish's answer is by and large correct for the German law for the German market. But it does not address the real question: In which cases is German competition law and the GDPR applicable? § 7 II Nr. 3 UWG In the German legal system the prohibitions of the competition law (UWG, Gesetz gegen den unlauteren Wettbewerb) is a type of tort/non-contractual ...


2

The GDPR is not intended to only regulate commercial processing of personal data, but is aiming for comprehensive data protection. This does also cover non-profit and political activity. The exception for “purely personal or household activities” has to be interpreted somewhat narrowly. It does not apply to all personal activities, but to purely personal ...


2

Under GDPR article 6 paragraph 1 item (c) one lawful basis for processing personal information (PI) is: processing is necessary for compliance with a legal obligation to which the controller is subject; The obligation to attribute a reused work under a CC license is such an obligation. Moreover, the licensor has the option under any CC license to specify ...


2

Pactical Law's page on UK GDPR says: The UK GDPR is the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (EU GDPR) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and ...


2

Paragraph 1 of GDPR Article 15 says: The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data ... (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom ...


2

GDPR regulations on the whole do not actually mention passwords (source: Information Commissioner's Office UK, this may vary in other country's implementation of GDPR) and providing that the data is only accessible by authorised parties within the organisation within the parameters set out in user agreements and/or privacy policies, then the law isn't broken....


2

This is not a completely settled matter, but we can discuss some consequences and limitations. I will discuss legitimate interest, consent walls, and the special case of cookies. When legitimate interest is OK A legitimate interest is a great and very flexible legal basis. However, not every interest is a legitimate interest. Before this legal basis can be ...


2

As so often here, my advice is "get a specialist lawyer in your jurisdiction." That being said, GDPR requires free and informed consent to data handling. The concept you should be looking at is informally called coupling, formally defined in Article 7(4), and it is broadly speaking forbidden -- you may not make features conditional on consent if ...


1

Is there any repository (online database) that would tell me is a given email address is owned by person who is in a country that is controlled by GDPR? It seems to me that there should be. I don't think there is one either and I suspect such a repository could, in itself, be somewhat questionable under the GDPR. The safest way not to violate the GDPR is to ...


1

The GDPR is not as specific as you might like. I doubt that your strategy would work. The GDPR does not explicitly allow you to choose in which format your requests will be answered. If the data controller chooses a different format or medium, I would assume they are compliant. All the GDPR says is this (Art 12(1)): The information shall be provided in ...


1

If you believe your personal data has been processed incorrectly (e.g. without a suitable legal basis), you can take any of the following steps: Contact the data controller to raise your complaint. There should be contact details for their data protection officer in the privacy notice. Sue the data controller for compliance and damages. Lodge a complaint ...


1

Since you are able to encrypt the data, the data is clearly personal data for you. That means you will have to comply with the GDPR regarding how you process and store this data. This involves disclosing recipients of this data per Art 13(1)(e), and only engaging data processors in line with Art 28. Your storage provider such as Azure and AWS cannot decrypt ...


1

If the data is data about you you can sell it, if anyone wants to buy it, or give it away as you might choose.


1

would the GDPR apply? Your publication(s) would be GDPR compliant even if done by a company or someone with non-personal interests. That is because: politicians' status renders their views on various issues a matter of public interest (see articles 6.1.e and 9.2.g); the circumstances under which politicians state their views oftentimes constitute one or ...


Only top voted, non community-wiki answers of a minimum length are eligible