New answers tagged gdpr
3
Just because something is personal data doesn't mean you're prohibited from using/sharing/processing that personal data. You just need an Art 6 GDPR legal basis.
Here, the copyright holder is offering you a contract: you're allowed to freely use that image, as long as you attribute them properly. Since this attribution is necessary for fulfilling the license ...
0
If you believe your personal data has been processed incorrectly (e.g. without a suitable legal basis), you can take any of the following steps:
Contact the data controller to raise your complaint. There should be contact details for their data protection officer in the privacy notice.
Sue the data controller for compliance and damages.
Lodge a complaint ...
2
Pactical Law's page on UK GDPR says:
The UK GDPR is the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (EU GDPR) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and ...
1
Under GDPR article 6 paragraph 1 item (c) one lawful basis for processing personal information (PI) is:
processing is necessary for compliance with a legal obligation to which the controller is subject;
The obligation to attribute a reused work under a CC license is such an obligation. Moreover, the licensor has the option under any CC license to specify ...
4
You are only responsible for the data that you collect or process, or data that you direct others to collect or process on your behalf.
You are not responsible for the actions of third parties that may carry out incidental collection or processing that you have no control over - this includes such things as your ISP, backbone providers etc, but if you direct ...
1
Since you are able to encrypt the data, the data is clearly personal data for you. That means you will have to comply with the GDPR regarding how you process and store this data. This involves disclosing recipients of this data per Art 13(1)(e), and only engaging data processors in line with Art 28.
Your storage provider such as Azure and AWS cannot decrypt ...
1
The GDPR is not intended to only regulate commercial processing of personal data, but is aiming for comprehensive data protection. This does also cover non-profit and political activity.
The exception for “purely personal or household activities” has to be interpreted somewhat narrowly. It does not apply to all personal activities, but to purely personal ...
1
If the data is data about you you can sell it, if anyone wants to buy it, or give it away as you might choose.
0
As described, the GDPR would not apply
If what you are planing would be a "published as a static html page with no cookies or logging, and no adverts or donations." then there would be no user personal information collected or processed. Reproducing the public statements of others, particularly of politicians and other public figures, within the ...
1
would the GDPR apply?
Your publication(s) would be GDPR compliant even if done by a company or someone with non-personal interests. That is because:
politicians' status renders their views on various issues a matter of public interest (see articles 6.1.e and 9.2.g);
the circumstances under which politicians state their views oftentimes constitute one or ...
2
Paragraph 1 of GDPR Article 15 says:
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data ...
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom ...
2
By definition, company that owns the number is not private information.
This is not true.
Who owns a telephone number is a matter between the telephone company and the subscriber. If they don’t want their ownership to be public then that’s up to them. Back in the day of landlines and paper telephone directories it was possible to request a “silent number” ...
8
european-union (germany, spain, uk)
The cookie consent law is the ePrivacy directive, which was implemented as national laws by all EU member states (including, at the time, the UK). Later, GDPR changed the applicable definition of consent so that implicit consent is no longer allowed. A notice in fine print as in the given example is not sufficient to meet ...
5
gdpreuropean-union
Bob could be fined (not sued) by supervising authorities (not users).
Those fines can be hefty if the cookies contained PII (€20M or 4% of global revenue, whichever is higher), less so if they don't. The likelihood of being fined, and the amount, depend on coming to the attention of the authorities and the severity of the breach. So far ...
3
The ePrivacy directive (“cookie law”) requires consent when accessing or storing information on a user's device, unless that access is strictly necessary for a service explicitly requested by the user. This means you can use purely functional cookies, but otherwise need consent. The ePrivacy directive applies regardless of whether the cookies contain ...
2
To understand what is happening, keep in mind that there is no cloud, there is only other people's computers.
Alice wants to provide data processing to her customers. She designs a system to do that. She registers www.alice.sampledomain for her company.
Alice does not own any servers herself, so she signs a contract with Bob to do the actual work on Bob's ...
2
Under GDPR article 4 Personal information is:
any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly ...
If the subject's name IP address, and other identifying information has been deleted, and there is no way to connect or re-connect ...
3
The GDPR has a fairly broad concept of personal data: any information that relates to an identifiable person. This is far more than directly identifiable information! The concept of identifiability is further explained in Recital 26:
To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, ...
1
The first place to start is reading this page, Legal Issues in Web Archiving (written by the web archivist at the Library of Congress). The main problem is that you cannot copy a web page without permission, except under narrow circumstances as allowed by law. What you describe is probably prohibited by law, unless you left out important facts. The library/...
2
The GDPR does not allow or forbid scraping of personal data. That's processing of personal data just like other processing activities, and requires that the data controller has a suitable legal basis for this processing. It doesn't matter if the personal data was made public, though that might influence a balancing test if the legal basis is a legitimate ...
1
Just as legal as if you were to access his page and copy+paste his number into a file. Scraping is an automatation of web interaction and usuallly used to get a lot of information from a webpage in a short amount of time. In the U.S., generally the release of personally identifiable information laws only punish the people who release or collects someone ...
1
Yes.
However, under Article 12
[...]
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
charge a ...
2
Article 12(5) of the GDPR allows a refusal or the demand of a fee for requests which are "excessive, in particular because of their repetitive character".
I would suggest that before you demand such a fee, you should consult a lawyer in your jurisdiction about the details. How many requests are repetitive?
Also note that the GDPR usually does not ...
2
The cookie consent requirement comes from the ePrivacy Directive, not from the GDPR. While the GDPR defines consent, cookie consent is required regardless of whether the cookie actually contains personal data. Instead, it says we can access information stored on an end users device under the following circumstances.
Technical access to the information is ...
4
For as long as they might be required:
Company law requires 3 or 6 years for private and public companies respectively.
Tax law allows audits for up to 6 years.
Civil claims (e.g. for wage underpayment) can be brought for up to 6 years.
Workers compensation is practically indefinitely. There is a limit of 3 years, but that runs from the discovery of the ...
6
The retention periods depend on the exact legal basis for keeping such records. For example, accounting records might reasonably involve at least your bank account number, sort code, full name, and address. Under Section 388 of the Companies Act 2006, accounting records must be kept for three to six years, depending on the type of company (private or public)....
0
Only if they posted audio
Recording law in England does not require consent for video or still photography in public places. Consent is required for audio recording if it is going to be distributed.
It appears you gave conditional consent - if your face was blurred. By it blurring your face they operated outside the consent given.
If you do sue, they can ...
1
When you collect or process personal data, you must provide information to data subjects. The required information is listed in Art 13 GDPR, though most privacy notice also include the items from Art 14 GDPR (if there are third party data sources) and Art 15 GDPR (which simplifies responses to data subject access requests). The ICO has provided detailed ...
3
There are multiple issues with what you are trying to do, including issues with copyright, personality rights, and data protection. You are trying to use other people's content and likeness for your advertisement. Unless you are certain that you can do this in your relevant jurisdictions, without their consent, this sounds like a very bad idea.
At least ...
4
When integrating third party plugins, it is important to determine whether that third party is your data processor or another controller.
When they are your processor, you need a legal basis for the processing purpose and need to have a suitable contract with your processor.
When they are a data controller, you need a legal basis for the processing purposes ...
2
Meh, that's not very good but also not clearly non-compliant.
a bundled consent practice which seems to violate Art.7(4)
Only if they are actually asking for consent on that screen, which does not seem to be the case. Agreement with a privacy policy does not fulfil the conditions for consent, where consent is to be used as a legal basis.
Since such privacy ...
Top 50 recent answers are included
