Hot answers tagged

26

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.


14

2016/679 ("GDPR") defines the responsibilities of data processors and controllers (subject to the scope of the legislation). An individual can declare whatever they like, but those processors and controllers will still be bound by the legislation. In many cases consent will be irrelevant - it's only one of the lawful bases for processing : (a) ...


10

You can't make a binding declaration If you wish, you can make a public declaration that you grant consent for any and all processing of your data. You would likely have to be more detailed than that (consent needs to be informed and specific) - you'd likely have to exhaustively specify that yes, you know that this includes also this and that specific ...


5

Your analysis so far seems correct. You must comply with all applicable laws. The GDPR's Art 6(1)(c) legal basis clarifies that having to provide personal data is no excuse: that legal obligation is all the legal basis you need for sharing the personal data in accordance with your obligations. However, that legal basis doesn't generally excuse you from your ...


4

According to 10 rules for getting email unsubscribes right on Econsultancy, the GDPR says of unsubscribing (my emphasis): There is no specific rule about how companies should allow unsubscribing from email, but the General Data Protection Regulation (GDPR) does state that removing consent should be as easy as giving it. This means that if businesses try ...


4

The GDPR has an exemption for purely personal or household activity. Creating a family tree seems purely personal as long as you don't publish it. You're also allowed to freely share the tree as long as it stays within that purely personal scope. Your proposed restriction of only showing data of blood relatives seems excessively strict. But assuming that ...


3

Under the GDPR, consent is not the only legal basis that allows processing of your personal data. Other legal bases such as legitimate interest exist as well. So the question is: does the company have a legitimate interest to send you these emails? The answer is that this case is more about direct marketing, less about personal data. The circumstances under ...


3

The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data. GDPR does even apply to anything offline and on paper. Basically it means you ...


3

As others have pointed out, the problem is that the information holders need to know that you've given this universal consent. Theoretically, some organization could manage a central database, where anyone who wants to make such a declaration is recorded, and information holders could check this before asking you for constent explicitly. But this would then ...


2

The GDPR requires that Data Controllers can't share data with third parties unless they have a valid purpose and a legal basis for the sharing. The legal basis might be consent by the affected data subject, but other alternatives exist. However, the GDPR exempts purely personal or household use from its requirements. You are not required to obtain consent ...


2

Yes; take it up with your national GDPR agency. Every EU member has one (see this list of DPAs on Wikipedia). In some countries such as Germany, you need to contact agency in your state. If a company is getting complaints from multiple countries, the GDPR agencies will among themselves appoint a lead investigator, but you don't need to care about that.


2

In the GDPR, international data transfers occur when the target/recipient of the transfer is or is in: a third country, i.e. not an EU member state; or an international organization, i.e. not subject to the laws of any country. Transfers into an EU member state are not international transfers in this sense. Therefore, a post-Brexit UK data controller ...


2

That is not a best practice, but some sites do this, particularly US or other non-European sites which are not attempting to comply with the GDPR. If the site is required to comply with the GDPR (because it is in Europe or has users who are in Europe), it depeends what lawful basis it is relying on. If the basis is consent, then consent must be freely ...


2

Per Art 12(6), they are allowed to ask for additional identify verification: where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. Additionally, ...


2

The first thing to notice is that the £100 offer appears to be a legit offer. That is to say, accepting it will create a binding agreement between you and the company. There is no reason yet for the company to believe that you have suffered more damages, and you do have reasonable options to prevent them (ask bank for a new card - that's not going to cost ...


1

Non-essential cookies require consent because the EU's ePrivacy directive says so, which in turn is implemented by the laws in each EU member state. While the applicable definition for “consent” is given in the GDPR, this is not directly a GDPR question. Where does ePrivacy apply? Unlike the GDPR, the ePrivacy directive doesn't have a clear geographic ...


1

The GDPR does not tell you whether some technical approach is compliant or not. Instead, it requires you, the data controller, to analyze the possible risks to the data subjects (compare Arts 24/25). Where you identify risks, such a use may become compliant if you implement appropriate measures to mitigate the risks. In some cases, you may be required to ...


1

he can fill out [...] his company name and location. You only talk about data which identifies a company. Article 2 GDPR contains: This Regulation applies to the processing of personal data [...] Article 4 GDPR contains: (1) ‘personal data’ means any information relating to an identified or identifiable natural person [...] So the GDPR ...


1

It is perfectly fine to exercise your rights under the GDPR, and to encourage others to do so. However, a Data Controller may not have to comply with such requests: Art 12(3): If a Data Controller gets many requests, their deadline for compliance might extend from the usual month to up to three months total. Art 12(5): Where requests are “ manifestly ...


1

The GDPR has no hard limits on cookie duration. In fact, the GDPR does not mention cookies or similar technologies at all, aside from listing cookie identifiers as an example for “online identifiers” which is one kind of identifying data. Per the GDPR, you (the Controller) must limit the collection of personal data to the minimum that is necessary to ...


1

The GDPR requires the Data Controller (i.e. your company) to put in place appropriate measures for accountability. These will include appointing a Data Protection Officer (DPO) and implementing polices around the processing of personal data. So you should be able to go to your DPO and ask to see the policies which describe the safeguards for emailing such ...


Only top voted, non community-wiki answers of a minimum length are eligible