New answers tagged gdpr
0
A controller may have a good reason to publish or otherwise process information about a person even where that person has made a lawful request for erasure, restriction of processing, etc. However, the continued processing must itself be lawful. The many permutations do not permit a clear-cut answer to this question.
You have the right to request that ...
2
A user agent string may be personal data depending on how it is processed. Aggregate statistics of user agent strings are not personal data. But if you combine user agent records with IP addresses or other identifiers, the user agent string would relate to a data subject that you can single out/identify.
While user agent strings can contain arbitrary text (...
3
Is X considered personal data?
Can you use X to directly or indirectly identify a natural person? In the data to which you have access can X be related to an identifiable natural person?
If you answer yes to either of those questions then X is personal data.
Article 4(1):
‘personal data’ means any information relating to an identified or
identifiable ...
1
Is this considered storing personal data? Do I need user's consent?
No. Article 4(1) of the GDPR defines personal data as "any information relating [directly or indirectly] to an identified or identifiable natural person" (brackets added). The closest your sample gets to that is the IP address. Due to how IP addresses are managed, typically an IP ...
0
It would depend on the context of the processing.
Looking at the comments to the initial question, a program such as "a fitness tracker, or a mapping program that records GPS locations" would seem to qualify as a "purely personal activity" given that only the user is involved and the processing happens solely on their computer/device.
...
0
The GDPR applies regardless of where and how data is processed.
But it is necessary to look at what the processing activities in question are,
and who is the controller for these activities by determining their purposes and means.
This argument is supported:
by the absence of relevant exemptions in the GDPR
by the GDPR's broad definition of the data ...
8
The article 17 right to be forgotten aka the right to erasure is not absolute.
Assuming you lawfully recorded the email address, if the email address is necessary for the purpose for which you collected or otherwise processed it then you aren't obliged to erase the email address on request.
Seems to me you have a 'legitimate interest' under article 6(f) to ...
17
GDPR & EPD require user consent before storing a users personal information.
Wrong.
User consent is one of the ways that justify storing personal information, but there are others.
You may check art.6 to see the several reasons that allow to store personal information.
In this case, it seems reasonable to justify it under the paragraph f
(f) processing ...
0
A simple cookie banner is not sufficient.
Users have to opt in by clicking a button or checking checkboxes, note if using checkboxes they can not be pre-checked unless for "strictly necessary" cookies as defined by EPR.
As per the legislation valid consent can not be obtained by the user continuing to use the website or scrolling down the page. ...
25
The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in which member state data is stored or processed. Member states cannot generally limit this single market via national laws.
Furthermore, secure processing may be ...
5
No, GDPR does not apply here — but other laws might .
The General Data Protection Regulation only concerns itself with the following:
This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form ...
1
if the company is registered in the UK, then if I were to seek legal advice, I must turn to UK lawyer or any lawyer in EU could do that?
It would be best to seek the services of a UK lawyer because any enforcement action against the company would typically be taken by the UK's GDPR regulator: the Information Commissioner's Office.
1
So as a Data Protection Officer - what exactly should I do (if anything)?
Demand and get proper training or resign. Don’t take legal responsibility for doing a job you don’t know how to do.
This is not a criticism of you or your skills - your employer should not have put you in this position.
0
On the facts you've given us, you have obligations and potential liability as a processor of the data
You're responsible for the security of the data in the database, maintaining records, appointing a data protection officer if necessary, and so on.
You can be held liable for any breaches by the ICO or other relevant regulatory authority, and an injured ...
2
In order to sue someone (successfully, not just waste their time and the court's time), they have to have done a legal wrong. A picture can be taken with consent, and a painting can be made from that picture with consent. A 1 year old child does not have the legal capacity to consent, but a parent does. It only requires the consent of one parent. In the ...
2
The reason for that is that according to GDPR explanation on EU website under GDPR company collecting my personal data and using it for automated decision making should inform me about that and have me agree to it.
Only if the basis for processing is consent.
The GDPR provides 6 legal basis for data processing - consent is only one of them. If their basis ...
Top 50 recent answers are included
