Hot answers tagged

14

It is not an either–or. You may have certain rights under both CCPA and GDPR, but they have rather different mechanisms for determining their scope. When does the CCPA apply? CCPA applies to certain businesses and consumers. It covers any business (regardless of legal structure) that that does business in the State of California and has a certain scale. A ...


6

GDPR recital 64 says: The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. The GDPR does not specify exactly what ...


5

When personal data is transferred between the EU and UK, this is an “international transfer” (also called “restricted transfer” in ICO guidance). Transfers of personal data from the UK to the EU/EEA are easy since the UK has granted an adequacy decision to the EU (see Art 45 GDPR). Nevertheless, this must be disclosed to data subjects per Art 13(1)(f) GDPR. ...


4

GDPR Article 4 paragraph 1 says: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to ...


3

The Facebook Pixel analytics solution does not seem to support access or erasure for data subjects. While there are some GDPR compliance features, these focus on collecting consent prior to collecting data. The relationship between the pixel user and Facebook is also murky. For certain kinds of data, Facebook acts as the data processor only, and the user has ...


2

This kind of hashing is not anonymization, so your hashed IP addresses do likely count as personal data. It is good that you're using hashing as an added safety measure, but it's still personal data and as thus subject to the GDPR. Why is it personal data? By definition, you are using these hashes in order to re-identify visitors. For this purpose, hashing ...


1

Both of the pages linked in the question are from the ICO. The other exemptions listed on the first page linked but not on the second, seem to be handled on other pages of the self-assessment tool. I have not tried to verify that every exemption listed on the fist page is properly handled, but that seems to be the case. Which exemption do you think is ...


Only top voted, non community-wiki answers of a minimum length are eligible