New answers tagged gdpr
1
If an US data controller only targets people in the US with their services, the GDPR does not apply at all. Only those processing activities of a non-EU controller fall onder the GDPR where those activities are related to (Art 3(2)):
(a) the offering of goods or services to people in the EU, regardless of payment; or
(b) the monitoring of behaviour of data ...
-2
I am surprised by the number of answers suggesting that meter readings are not personal data by virtue of the fact that they "belong to meters" and do not "belong to people".
The GDPR was not drafted in such a narrow way. To determine whether an item of data is personal data, you do not look at that item in complete isolation. Instead, the analysis should ...
2
Unless there's a data processing agreement between the hotel and the third party, both would likely be joint controllers. I.e. the hotel is fully co-responsible for any data processing that happens due to any embeds. If there were an Art 28 data processing agreement, the hotel would be fully responsible as well, but would have the primary responsibility for ...
3
I think you might be missing the point of accurate or corrected information.
Your data is accurate. Your bill will state which meter reads are estimated, therefore this is accurate.
Your utility supplier will also have a record of you providing your meter reading outside of the billing window and therefore could not use it/them on your first bill. This is ...
6
While the other current answers both provide valuable insight they don't actually discuss whether the GDPR applies one dismissing it, without a full argument and the other assuming it does.
It is not perfectly obvious whether a standard meter reading is covered under GDPR.
The definition of personal data under GDPR is extremely broad, See https://gdpr.eu/...
0
The Art 16 right to rectification reads:
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of ...
31
GDPR isn't going to help you here - a meter reading isn't PII, they are kept against the relevant MPAN (elec) or MPRN (gas) references. In short people don't have readings, meter points have readings. Trying this from the GDPR angle is going to be a complete waste of time.
That said their "policy" is pretty flimsy, if you're in the UK it may be worth ...
15
Yes, GDPR applies:
you are a data controller established/living in the UK or are offering services to people in the UK
you fall under the material scope of the GDPR. The Art 2(2)(c) exemption for “purely personal or household activity” does not apply since you're offering the service to the public.
You must consider GDPR compliance here. This is especially ...
-1
You should notify it to Google or Apple.
The application is clearly spying on customers.
The owner of the application said "we only collect X information" but instead, the application is collecting X + Y. then it breaches the contract.
1
As the company implemented it that way, it is a bad idea to notify them.
First and foremost, you notify the company of a security issue - you give them a reasonable amount of time to resolve it, and then you publish it. The management may know nothing about how the data is handled, and may rush to fix it when notified - you cannot make an assumption that ...
1
I fear that you have 'jumped the gun' - I think you and your colleagues in the legal/compliance department should first meet to discuss your project. You must facilitate their understanding of the project so that you and they can discuss your options and obligations under GDPR and other such rules in your jurisdiction.
It may be the case that this project ...
1
This isn’t anonomization under the GDPR
The reason IP addresses are personal data is because they are unique to an individual. So are your hashes.
7
How can I truly say that I 'consent' to data collection and processing when I am coerced, so to speak, by the threat of failing my courses if I do not use this novel software?
There is no need for you to "consent".
Consent is just one of the reasons that allows a data processor to collect your data. There are other reasons that allows the data processor to ...
0
I think all these are "Personal Data" according to GDPR (right?)
Can the data controller or another person, "with reasonable means reasonably likely to be used," use that data alone or in combination with other data to identify a natural person?
If yes, it is personal data within the meaning of the GDPR.
If no, it is not personal data within the meaning ...
7
But that a phone number exists in your collection is interesting information. Since phone numbers are identifying and so short that they are guessable, hashing does not provide anonymization. Hashing could still be an appropriate safety measure or pseudonymization technique. Note that the salt is typically stored as part of the hash value, and should not be ...
5
Article 5(1)(f)
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
2
GDPR Articles 13–14 assume that the information is provided once. Art 15 has some overlap in the information requirements, but is not identical. The relevant recitals 60–62 offer no further guidance. They state that there's no information obligation where the data subject already posesses the information, but don't account for the case that the information ...
0
Based on the information provided in the question and comments, you are a Software as a Service provider established outside the European Union, providing services to European Union clients who will use your SaaS solution to process personal data that is subject to the jurisdiction of the GDPR. If you market your service to consumers in the Union, you are ...
Top 50 recent answers are included
