New answers tagged gdpr
2
votes
Can a company take legal action if the GDPR requestor is not a European citizen?
No, but not for the reason you think
For a controller resident in the EU or UK, GDPR applies irrespective of where the data subject is or their nationality.
However, the violation of the GDPR does not ...
- 157k
3
votes
Can I request to delete an account with a government?
In order to process data (which includes storing data), a data controller must establish one or more of the lawful bases contained at Article 6(1) of the UK GDPR. Briefly, those are:
a) Consent of the ...
- 4,704
3
votes
Accepted
Tenancies and the GDPR
Anyone who processes personal data using electronic means or with some filing system is a data controller, as long as
they fall within the GDPR's territorial scope,
they're not doing the processing ...
- 18.2k
0
votes
GDPR and hotlinked images: are they allowed?
Potentially allowed, but generally not.
You have correctly analyzed that embedding content/images/scripts/frames/videos will disclose some personal data to the target server. I don't think there is ...
- 18.2k
-1
votes
GDPR and hotlinked images: are they allowed?
This is a GDPR violation if the user's browser is not set to reject 3rd party cookies, and the third party site does. I checked and imgur does not appear to use cookies just for requesting that image. ...
- 1,663
0
votes
How to fulfill the General Data Protection Regulation (GDPR) when receiving emails
There is no need to inform in this case. The email address and other personal data is covered by legitimate interest exceptions, as it is necessary to conduct the business of publishing a scientific ...
- 1,663
0
votes
Are internet forum posts considered personal data under GDPR?
It is possible that some forum posts might not be considered personal data for GDPR purposes, but the problem will always be the amount of time needed to make that determination for every single post.
...
- 1,663
-3
votes
Under GDPR, does blurhash of a profile picture count as personal data
if a user requests via GDPR full deletion of their data from my web service, would I be required to delete also their profile picture blurhash?
No. In a GDPR inquiry, the blurhash code/image such as ...
- 40.9k
17
votes
Accepted
Under GDPR, does blurhash of a profile picture count as personal data
From the GDPR's definitions:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be ...
- 25.3k
0
votes
Is it really possible to use Google Analytics without consent, and if so, why exactly?
The following is essentially a replication of my answer this similar question, which also led to the essentially same frequently up-voted answer.
In contrast to that answer, which cites a Dutch ...
- 121
2
votes
GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?
I don’t see the basis for the accepted answer saying that a Google Analytics cookie does not require user prior consent—even after the modifications that answerer proposed. Opinion 04/2012 on Cookie ...
- 121
4
votes
"Find my device" and GDPR compliance
It is not different. But one company can decide to approach compliance differently from another. Here, TomTom has chosen a fairly safe/conservative interpretation, whereas Google and Apple decided ...
- 18.2k
1
vote
Server side analytics events
I think your approach can be compliant, but it's going to be a bit tricky.
Personal data has a broad definition
The GUID is almost certainly personal data. Personal data is any information relating to ...
- 18.2k
1
vote
Server side analytics events
It may not be possible to identify a GUID as being associated with a specific named natural poerson. But given information about a small number of specific individuals, it masy wel be possible to ...
- 97.7k
1
vote
GDPR and a cell phone paid through work?
From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B
Thia is not at all correct. There is nothing in the GDPR that exempts a data controller ...
- 97.7k
1
vote
Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?
It's personal data, but GDPR might not apply in that scenario.
The GDPR has a very broad view of “personal data” – this term describes any information that relates to an identifiable person, even if ...
- 18.2k
1
vote
Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?
Yes
The person who stayed in a particular room on a particular night (even if you don’t know their name is Johann or anything else about them). Under the GDPR PII or Personal Identifiable Information ...
- 157k
19
votes
Other use of profile photos: legality fair-use and permissions
Super illegal
Just focusing on the GDPR, what is your legitimate basis for taking the personal information of a third-party?
- 157k
51
votes
Other use of profile photos: legality fair-use and permissions
BAD idea
It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook.
It isn't a fair use of the phonebook pictures - and you might not have a license anyway, ...
- 16.2k
1
vote
Any obligation to disclose one's name and address to private parties for service of civil claims after a street altercation?
There are Subpoenas to identify unknown people!
Let's assume Charlene calls herself Alice on Social Media. The Persona Alice defames Bob on Social Media.
Bob now sues the owner of the Alice Persona ...
- 16.2k
2
votes
Accepted
Under what circumstances is it lawful or unlawful for police to disclose one's information to third parties, e.g. complainants?
As to the GDPR, Article86 provides that:
Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public ...
- 97.7k
1
vote
If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?
Depends on the purpose for which this personal data is used.
Presumably, Alice made the DSAR for purely personal or household purposes. If she uses the received third party personal data in line with ...
- 18.2k
1
vote
If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?
Looking at the exemptions on the ICO site it does not seem that "Domestic purposes" would really cover it, as there is a connection to "professional or commercial activity" in that ...
- 7,425
2
votes
Any obligation to disclose one's name and address to private parties for service of civil claims after a street altercation?
A need neither B’s name nor their address
A civil claim must identify the defendant - “the man who inched me at such-and-such place on this-and-that date” is sufficient identification.
It also must be ...
- 157k
5
votes
Accepted
Do I need to worry about GDPR, CCPA, CalOPPA, if collecting anonymous usage for a non-commercial, no-ads app?
The CCPA is in many ways similar to the GDPR. It applies to firms that profess the personal data of California citizens, just as the GDPR applies to firms that process the data of EU residents. If you ...
- 97.7k
4
votes
Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?
Most of your arguments since you discovered this issue seem to be very self-serving. If IT security is too complex for small businesses, how do you figure individuals can reasonably assess it from the ...
- 540
7
votes
Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?
For the same reason that states require doctors to be licensed
Surely, if I want an unqualified, unlicensed surgeon (or a person that says they’re a surgeon) to crack open my cranium and poke my brain,...
- 157k
20
votes
Accepted
GDPR & Blocking EU Visitors?
If GDPR applies, then no one can opt out. If it doesn't apply, then an IP block is superfluous.
Whether GDPR applies is determined by Art 3 GDPR. For this, we must distinguish where the data ...
- 18.2k
14
votes
GDPR & Blocking EU Visitors?
As the answer by Dale M correctly points out, the GDPR imposes obligations on businesses. Individual users cannot release a business from such obligations, although they can choose not to file ...
- 97.7k
10
votes
GDPR & Blocking EU Visitors?
The GDPR does not create rights, so there is nothing to waive
The GDPR places obligations on businesses, not rights on individuals. The difference is subtle but it means that there is nothing for an ...
- 157k
Top 50 recent answers are included