New answers tagged

2 votes

Can a company take legal action if the GDPR requestor is not a European citizen?

No, but not for the reason you think For a controller resident in the EU or UK, GDPR applies irrespective of where the data subject is or their nationality. However, the violation of the GDPR does not ...
user avatar
  • 157k
3 votes

Can I request to delete an account with a government?

In order to process data (which includes storing data), a data controller must establish one or more of the lawful bases contained at Article 6(1) of the UK GDPR. Briefly, those are: a) Consent of the ...
user avatar
  • 4,704
3 votes
Accepted

Tenancies and the GDPR

Anyone who processes personal data using electronic means or with some filing system is a data controller, as long as they fall within the GDPR's territorial scope, they're not doing the processing ...
user avatar
  • 18.2k
0 votes

GDPR and hotlinked images: are they allowed?

Potentially allowed, but generally not. You have correctly analyzed that embedding content/images/scripts/frames/videos will disclose some personal data to the target server. I don't think there is ...
user avatar
  • 18.2k
-1 votes

GDPR and hotlinked images: are they allowed?

This is a GDPR violation if the user's browser is not set to reject 3rd party cookies, and the third party site does. I checked and imgur does not appear to use cookies just for requesting that image. ...
user avatar
  • 1,663
0 votes

How to fulfill the General Data Protection Regulation (GDPR) when receiving emails

There is no need to inform in this case. The email address and other personal data is covered by legitimate interest exceptions, as it is necessary to conduct the business of publishing a scientific ...
user avatar
  • 1,663
0 votes

Are internet forum posts considered personal data under GDPR?

It is possible that some forum posts might not be considered personal data for GDPR purposes, but the problem will always be the amount of time needed to make that determination for every single post. ...
user avatar
  • 1,663
-3 votes

Under GDPR, does blurhash of a profile picture count as personal data

if a user requests via GDPR full deletion of their data from my web service, would I be required to delete also their profile picture blurhash? No. In a GDPR inquiry, the blurhash code/image such as ...
user avatar
17 votes
Accepted

Under GDPR, does blurhash of a profile picture count as personal data

From the GDPR's definitions: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be ...
user avatar
  • 25.3k
0 votes

Is it really possible to use Google Analytics without consent, and if so, why exactly?

The following is essentially a replication of my answer this similar question, which also led to the essentially same frequently up-voted answer. In contrast to that answer, which cites a Dutch ...
user avatar
2 votes

GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?

I don’t see the basis for the accepted answer saying that a Google Analytics cookie does not require user prior consent—even after the modifications that answerer proposed. Opinion 04/2012 on Cookie ...
user avatar
4 votes

"Find my device" and GDPR compliance

It is not different. But one company can decide to approach compliance differently from another. Here, TomTom has chosen a fairly safe/conservative interpretation, whereas Google and Apple decided ...
user avatar
  • 18.2k
1 vote

Server side analytics events

I think your approach can be compliant, but it's going to be a bit tricky. Personal data has a broad definition The GUID is almost certainly personal data. Personal data is any information relating to ...
user avatar
  • 18.2k
1 vote

Server side analytics events

It may not be possible to identify a GUID as being associated with a specific named natural poerson. But given information about a small number of specific individuals, it masy wel be possible to ...
user avatar
  • 97.7k
1 vote

GDPR and a cell phone paid through work?

From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B Thia is not at all correct. There is nothing in the GDPR that exempts a data controller ...
user avatar
  • 97.7k
1 vote

Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?

It's personal data, but GDPR might not apply in that scenario. The GDPR has a very broad view of “personal data” – this term describes any information that relates to an identifiable person, even if ...
user avatar
  • 18.2k
1 vote

Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?

Yes The person who stayed in a particular room on a particular night (even if you don’t know their name is Johann or anything else about them). Under the GDPR PII or Personal Identifiable Information ...
user avatar
  • 157k
19 votes

Other use of profile photos: legality fair-use and permissions

Super illegal Just focusing on the GDPR, what is your legitimate basis for taking the personal information of a third-party?
user avatar
  • 157k
51 votes

Other use of profile photos: legality fair-use and permissions

BAD idea It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook. It isn't a fair use of the phonebook pictures - and you might not have a license anyway, ...
user avatar
  • 16.2k
1 vote

Any obligation to disclose one's name and address to private parties for service of civil claims after a street altercation?

There are Subpoenas to identify unknown people! Let's assume Charlene calls herself Alice on Social Media. The Persona Alice defames Bob on Social Media. Bob now sues the owner of the Alice Persona ...
user avatar
  • 16.2k
2 votes
Accepted

Under what circumstances is it lawful or unlawful for police to disclose one's information to third parties, e.g. complainants?

As to the GDPR, Article86 provides that: Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public ...
user avatar
  • 97.7k
1 vote

If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?

Depends on the purpose for which this personal data is used. Presumably, Alice made the DSAR for purely personal or household purposes. If she uses the received third party personal data in line with ...
user avatar
  • 18.2k
1 vote

If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?

Looking at the exemptions on the ICO site it does not seem that "Domestic purposes" would really cover it, as there is a connection to "professional or commercial activity" in that ...
user avatar
  • 7,425
2 votes

Any obligation to disclose one's name and address to private parties for service of civil claims after a street altercation?

A need neither B’s name nor their address A civil claim must identify the defendant - “the man who inched me at such-and-such place on this-and-that date” is sufficient identification. It also must be ...
user avatar
  • 157k
5 votes
Accepted

Do I need to worry about GDPR, CCPA, CalOPPA, if collecting anonymous usage for a non-commercial, no-ads app?

The CCPA is in many ways similar to the GDPR. It applies to firms that profess the personal data of California citizens, just as the GDPR applies to firms that process the data of EU residents. If you ...
user avatar
  • 97.7k
4 votes

Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?

Most of your arguments since you discovered this issue seem to be very self-serving. If IT security is too complex for small businesses, how do you figure individuals can reasonably assess it from the ...
user avatar
  • 540
7 votes

Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?

For the same reason that states require doctors to be licensed Surely, if I want an unqualified, unlicensed surgeon (or a person that says they’re a surgeon) to crack open my cranium and poke my brain,...
user avatar
  • 157k
20 votes
Accepted

GDPR & Blocking EU Visitors?

If GDPR applies, then no one can opt out. If it doesn't apply, then an IP block is superfluous. Whether GDPR applies is determined by Art 3 GDPR. For this, we must distinguish where the data ...
user avatar
  • 18.2k
14 votes

GDPR & Blocking EU Visitors?

As the answer by Dale M correctly points out, the GDPR imposes obligations on businesses. Individual users cannot release a business from such obligations, although they can choose not to file ...
user avatar
  • 97.7k
10 votes

GDPR & Blocking EU Visitors?

The GDPR does not create rights, so there is nothing to waive The GDPR places obligations on businesses, not rights on individuals. The difference is subtle but it means that there is nothing for an ...
user avatar
  • 157k

Top 50 recent answers are included