wimh
  • Member for 3 years, 6 months
  • Last seen more than a month ago
  • Netherlands
1 answers
votes
2k views
Can Slack really claim not to be a data controller?
15 votes

The GDPR's right to erasure just applies in some specific situations. While messages you wrote on Slack are personal data, they are generally also part of a larger discussion with others. If your ...

View answer
2 answers
votes
17k views
Do the GDPR and Cookie-Law regulations apply to localStorage?
Accepted answer
14 votes

The official EU-legislation does not use the word "cookies", except in the recitals. The "Cookie-Law" is part of the Privacy and Electronic Communications Directive 2002/58/EC and is amended by ...

View answer
2 answers
votes
250 views
How can German supermarkets get away with not following the EU regulations, which have been established long ago?
10 votes

You are referring to article 9 of Regulation (EU) No 1169/2011 which contains: Article 9 List of mandatory particulars In accordance with Articles 10 to 35 and subject to the exceptions contained in ...

View answer
3 answers
votes
10k views
Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers
10 votes

Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue ...

View answer
1 answers
votes
2k views
Is it really possible to use Google Analytics without consent, and if so, why exactly?
8 votes

Update: On 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that cookies require explicit consent regardless of personal data is being processed. (...

View answer
1 answers
votes
4k views
Does a user have the right to request their forum posts deleted?
8 votes

Earlier this year, the Internet lawyer Arnoud Engelfriet wrote a blog post about exactly this topic. As it is written in Dutch, I will summarize it here: As you also said, deleting posts breaks the ...

View answer
2 answers
votes
5k views
Is hash of a username still personal data?
7 votes

The Art. 29 WP has released Opinion 05/2014 on Anonymisation Techniques. There it defines a hash function like this: Hash function: this corresponds to a function which returns a fixed size output ...

View answer
1 answers
votes
1k views
Deducing and using an email address under GDPR
Accepted answer
7 votes

First take a look at Article 13(1) of Directive 2002/58/EC Article 13 Unsolicited communications The use of automated calling systems without human intervention (automatic calling ...

View answer
2 answers
votes
721 views
Are GDPR-Walls legal?
6 votes

If the website containing the GDPR-wall processes any personal data of users who hit the GDPR-wall, the GDPR applies to that website. This can be as simple as writing a logfile of all visits to the ...

View answer
1 answers
votes
813 views
GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?
Accepted answer
5 votes

Update: On 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that cookies require explicit consent regardless of personal data is being processed. (...

View answer
1 answers
votes
2k views
Can usage of Google Analytics (without consent) be considered a legitimate interest?
Accepted answer
5 votes

You are right that a visitor of a website does not expect to be tracked upon opening the website. But when using Google Analytics configured in the way explained in my other post, the visitor is not ...

View answer
1 answers
votes
4k views
GDPR: cookie for login management
Accepted answer
5 votes

From the WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194: Persistent login cookies which store an authentication token across browser sessions are not exempted ...

View answer
1 answers
votes
962 views
Is email verification for account creation in violation of GDPR?
Accepted answer
5 votes

When someone registers at your website, they enter a contract with you. You need an email address, because you need to be able to contact them (at least for the password recovery). You probably want ...

View answer
1 answers
vote
35 views
What data processing requires opt-in consent for an existing customer under GDPR?
4 votes

Recital 47 contains: The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. So even if you never explicitly gave your consent for any ...

View answer
1 answers
votes
212 views
Was my GDPR request not complied with?
Accepted answer
4 votes

The same page at the ICO website also lists what an organisation should do if they refuse to comply with a request: What should we do if we refuse to comply with a request? You must inform the ...

View answer
1 answers
votes
164 views
GDPR and personal data that gets crawled and ends up on other websites
4 votes

See Art. 17(2) GDPR: Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available ...

View answer
2 answers
votes
186 views
Can the terms of service contain a clause that instructs a user to forfeit their rights under the GDPR?
Accepted answer
4 votes

It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside,...

View answer
2 answers
votes
269 views
If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?
Accepted answer
3 votes

The liquidator which sells the assets of an insolvent company is not allowed to sell personal data if it does not has a legal basis as defined in Art. 6(1) GDPR for it. Getting as much money as ...

View answer
1 answers
votes
564 views
Is it legal for Blizzard to demand a copy of my government id before deleting my account?
3 votes

When you make a request based on the GDPR, Art. 12(6) GDPR applies. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person ...

View answer
3 answers
votes
310 views
Does CC-SA (Share-Alike) force me to provide a free version of the derivative?
3 votes

Nothing in the license requires you to distribute an derivative work you create. But if you distribute it, you must put your contributions under the same license as the original. This means as you ...

View answer
4 answers
votes
111 views
Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?
Accepted answer
3 votes

Recital 26 contains To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or ...

View answer
3 answers
votes
278 views
GDPR: Is giving out customer name and implied existence of customership legal?
3 votes

Art.5(1)(f) contains: Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful ...

View answer
2 answers
votes
134 views
anonymisation/redaction of public website content as response to 'right to erasure'
Accepted answer
3 votes

I agree with Ben that there are many exemptions to the right to be forgotten. For example if messages are removed from a mailing list archive, the replies to deleted messages will become useless. That ...

View answer
1 answers
vote
584 views
Public domain English translation of Mein Kampf
Accepted answer
3 votes

The link you refer to, has this description: In 1940 the Germans decided they wanted to have an english language copy of Mein Kampf published for the invasion of Britain. They used a rough draft ...

View answer
2 answers
votes
286 views
GDPR - Recording simple page views
3 votes

The so called "cookie law" is Article 5(3) of Directive 2002/58/EC: Member States shall ensure that the use of electronic communications networks to store information or to gain access to ...

View answer
1 answers
votes
83 views
Can a user request the deletion of their IP address that is stored for moderation purposes?
3 votes

No. Art. 17(1) GDPR lists conditions when erasure can be requested. None of the listed grounds would apply in this case. However, you might have to explain why you process the data (for moderation ...

View answer
3 answers
votes
2k views
Are publicly available password dumps legal under GDPR
3 votes

I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a ...

View answer
2 answers
votes
4k views
Do I have the right to ask Github to hide my Contribution activity according to General Data Protection Regulation (GDPR)
Accepted answer
3 votes

The "Contribution activity" is extracted from repositories hosted on Github. Looking at the privacy statement, Github considers itself as a hosting service for those repositories. See EU Directive ...

View answer
1 answers
votes
517 views
google analytics cookie consent with anonymized ip on
3 votes

Simply use a cookie to store consent. First consider the opposite. If a user does not agree to store cookies, a cookie is the only way to remember this, as you want to avoid a new pop-up on every ...

View answer
1 answers
votes
195 views
Specificity of GDPR's right of erasure
Accepted answer
3 votes

b. the data subject withdraws consent on which the processing is based [...] That refers to Article 6(1)(a): Processing shall be lawful only if and to the extent that at least one of the ...

View answer