New answers tagged gdpr
2
You are mixing your terms; GDPR talks about personal data:
‘Personal data’ means any information relating to an identified or
identifiable natural person (‘data subject’); an identifiable natural
person is one who can be identified, directly or indirectly, in
particular by reference to an identifier such as a name, an
identification number, ...
1
Generally, if you have a GDPR issue, it should be reported to your local Data Protection authority.
However, an attacker would have to: transcribe the hash from the image; attempt to reverse the hash (unless you have actually done that yourself, you are only guessing that the hash might be easily reversible). Having done that they have an IP address, which ...
1
There is a lot of confusion around the UK and its laws which supposedly require full log retention - the only law which addresses this is the 2016 Investigatory Powers Act (amended by the 2018 Data Retention and Acquisition Regulations Act) and this act requires you to retain full logs only on receipt of a valid "retention notice" from the Secretary of State....
1
It is not the case that every organisation whose activities are within the scope of the EU General Data Protection Regulation must have a qualified person dealing with data processing tasks, rather, some organisations may be required to appoint a Data Protection Officer, which GDPR Article 39(1) has "at least the following tasks":
(a) to inform and advise ...
4
If the website's processing of your personal data is within the scope of the GDPR, then you have a qualified right to request the erasure of your personal data.
It is relevant whether:
the website operates within the EU;
the website is operated by a company established in an EU country;
the website aims to sell goods or services to people in the EU; or
the ...
3
The material scope of the GDPR (Article 2) is limited to the processing of personal data (including mere storage) by automated means or as part of a filing system.
The question of whether your activity falls within this scope hinges on what you actually do with the data once you take possession of it. You have mentioned saving the contact information of ...
3
The GDPR is wide in scope, and flexible in application. Therefore it is not possible to give an absolute yes/no as to whether masking text with asterisks is or is not lawful.
We can gain a deeper insight by looking at the GDPR itself. Firstly, the definition of processing (Art. 4 lit. 2):
any operation or set of operations which is performed on personal ...
0
Unauthorised access to your account, which granted access to personal data, would have constituted a data breach under GDPR. The obligations incumbent upon the controller (Company A) may include informing their supervisory authority and/or the data subject (you) once they became aware of the breach. When you reported it, and they received that report, the ...
0
There is no specific requirement in the GDPR to inform users of an update to a company's privacy policy, nor is there anything to say it must be done by email.
The GDPR requires businesses and organisations making decisions about the means and purposes of processing personal data ("controllers") to inform the people whose data they process ("data subjects") ...
1
The doses of radiation are not unique identifiers. Should those numbers be transferred to a controller established in the EU (and thus to whom the GDPR applies), that controller may not identify the natural persons to whom the dosage pertained, without correlating each dosage with information held by the non-EU lab. As such, it is not personal data and the ...
2
Because this is a requirement of the HSWA, the lawful basis is not consent, but rather GDPR Art. 6(1)(c):
processing is necessary for compliance with a legal obligation to which the controller is subject
It is also important to identify whether any personal data are indeed being collected and transmitted with this form, as it is this that establishes ...
3
Belgium enacted an implementing law, the Act of 30th July 2018 on the protection of natural persons with regard to the processing of personal data. This, along with the GDPR, are the key legislative references that relate to your question.
On 5th September 2017 the ECHR judged that it "considers that States should ensure that, when an employer takes ...
1
The app is likely GDPR compliant. However the organization has a remaining obligation, namely that of Art 11.2 GDPR. A user who can show exclusive control of that IP address (i.e. that the IP address uniquely identifies him or her) still has the usual GDPR rights.
It is not necessary to offer these rights via the app itself. Another reasonable mechanism ...
0
Why would consent be the legal basis for collecting personal data here?
It’s a work health and safety incident report. As such, this falls under a legitimate business reason for collection - consent is not required.
Top 50 recent answers are included
