New answers tagged gdpr
2
The GDPR includes a right to correct incorrect data (Article 16). But (without being a lawyer) I doubt that the change of an user name would be considered a correction.
2
The GDPR is no blanket prohibition of data use, it requires a legal basis and/or the consent of the data subject for data processing.
Is your company large enough to require a data protection officer? If so, consult this officer. If not, talk to the legal department. Document that, and you should be legally on the safe side if they tell you to go ahead. An ...
1
Ideally, an employer should have a code of conduct or policy that covers workplace monitoring. If a code or policy has been agreed, it will usually form part of your contract of employment. This means that where an employer is allowed to monitor your activities, these activities could be the subject of disciplinary action if you are using workplace equipment ...
1
When you make a request based on the GDPR, Art. 12(6) GDPR applies.
Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the ...
6
It’s personal data
... but why do you think you can change it for free?
It’s clearly personal data because it can be demonstrably linked to you, both within and outside Blizzard’s database. Presumably, you consented Blizzard having it or they have some other legitimate basis for having it. So far, this is all GDPR compliant.
You have a right to be ...
2
You probably cannot force twitter to delete your account. Art. 16(6) contains:
Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity ...
2
The territorial scope of the GDPR is defined in Article 3. It covers "personal data of data subjects who are in the Union", whether they are EU citizens or not. So to answer your questions:
1) are EU users, but moved to USA a few years ago, and signed-up on my website?
They are not in the EU, so are not covered. You don't need to know if someone is an EU ...
13
The GDPR's right to erasure just applies in some specific situations. While messages you wrote on Slack are personal data, they are generally also part of a larger discussion with others. If your messages are removed, the discussion becomes incomplete, so that will violate the freedom of expression of those others. Art. 17(3) GDPR provides an exception for ...
0
Neither the GDPR or the EPrivacy Directive specify any duration. However, on 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that users must be informed of the duration before they consent to store cookies:
Although the duration of the processing of the data is not included as part of that ...
1
Company retained my card details after payment completed and suffered a breach. What are my options?
If you accept the offer you gain £100 and probably forego any damage claims you're entitled to from the company. Now whether this is a good deal or not depends on the expected damage you can claim minus the costs associated with getting those damages.
What sort of damages can arise for you? Financially: Basically none. In the UK you're fully protected ...
2
Names, phone numbers and email are indeed personal data. This has already been established in European jurisprudence prior to the introduction of the GDPR. Even IP addresses are (do you keep logs?).
Since the name and contact details are provided by the customer in order to initiate communications, you can keep them for a while. But please note that you ...
2
You should make sure that the person making the request is actually the data subject. However, you have a lot of flexibility to create an approach that is appropriate for your specific circumstances.
Per Art 12(6), where you have reasonable doubts about the identity of the person making the request, you may request additional information to confirm the ...
2
What is pseudonymized and anonymized data?
Pseudonymized data is still personal data because the data subjects are (indirectly) identifiable. As such, processing pseudonymized data is still subject to the GDPR. For example, you need a clear purpose and legal basis for any such processing.
In contrast, anonymized data is no longer identifiable, so that its ...
1
The law is clear on this matter. Data for research purposes has to be fully anonymized in a way, that prevent reversing this process by anyone, so any forms of:
pseudonymization by reversible encryption (having a proper key)
pseudonymization by very-easy-to-brute-force hashing
splitting into separate "users" (private) and "data" (public/research) datasets
...
3
Per GDPR Art 79, you can sue data controllers if you consider your rights to have been violated. Where you have suffered damages due to GDPR infringements, you also have a right to compensation per Art 82.
However, your rights may not have been violate as far as the GDPR is concerned. Under the GDPR any kind of personal data processing needs a clear purpose,...
5
Company retained my card details after payment completed and suffered a breach. What are my options?
The first thing to notice is that the £100 offer appears to be a legit offer. That is to say, accepting it will create a binding agreement between you and the company. There is no reason yet for the company to believe that you have suffered more damages, and you do have reasonable options to prevent them (ask bank for a new card - that's not going to cost ...
2
Non-essential cookies require consent because the EU's ePrivacy directive says so, which in turn is implemented by the laws in each EU member state. While the applicable definition for “consent” is given in the GDPR, this is not directly a GDPR question.
Where does ePrivacy apply?
Unlike the GDPR, the ePrivacy directive doesn't have a clear geographic ...
2
That is not a best practice, but some sites do this, particularly US or other non-European sites which are not attempting to comply with the GDPR. If the site is required to comply with the GDPR (because it is in Europe or has users who are in Europe), it depeends what lawful basis it is relying on.
If the basis is consent, then consent must be freely ...
-1
GDPR is not the right framework anti-spam laws are
Details vary, for example, you do not need permission to send marketing emails in the US but you do in Australia and in both jurisdictions you must provide an easily accessible opt-out.
3
Under the GDPR, consent is not the only legal basis that allows processing of your personal data. Other legal bases such as legitimate interest exist as well. So the question is: does the company have a legitimate interest to send you these emails?
The answer is that this case is more about direct marketing, less about personal data. The circumstances under ...
2
Yes; take it up with your national GDPR agency. Every EU member has one (see this list of DPAs on Wikipedia). In some countries such as Germany, you need to contact agency in your state. If a company is getting complaints from multiple countries, the GDPR agencies will among themselves appoint a lead investigator, but you don't need to care about that.
Top 50 recent answers are included
