What should I reply when someone ask about their GDPR information against a cold marketing email? I recently received an email says "..please send me a GDPR information about all my data you have assigned to this email.." I collect the email address from a public domain (say GitHub) and technically I didn't store the email or name to my system. I send a cold-marketing email with a typical sales pitch about my product. Now, what should I reply? Also, I didn't include any privacy page or terms of use to my website. Since I didn't run any email campaign so there is no opt-out option available. Does it violate any GDPR clause? If so then how I'll send marketing email!
The GDPR is about "processing" not "storing", so your actions definitely fall under the GDPR. Also you have stored the email address and the email you sent in your "Sent" folder. You need to reply with all the information you have associated with that email address. This will at least be the email you already sent. If you scraped the email address from GitHub then you have it in a table with (presumably) other information such as the repository where you found it, in which case send that row of the table with the associated column headers. If you really just have a list of email addresses then say so. If you merely saw the email address and then typed a fresh email then say so.
GDPR rights and obligations cover different things: A duty of the data processor towards the government of the country where they operate to present certain documentation, and to implement technical and organizational measures to protect data. These would be audited by government agencies, not the individual customer. A single data subject cannot waive them. A duty of the data processor to process and store personal data only with a legal justification. User consent is one possible justification, if it is informed, revokable, etc. So a single data subject can waive a &quot;ban&quot; on storing his or her data in a database along with all the other users who waived that &quot;ban,&quot; but the duties towards the government regarding that data would still apply. A duty of the data processor to respond to an Article 15 request by the data subject in a certain way and timeframe. If a data subject writes a letter to the data processor and explicitly states that the letter is not an Article 15 request, then Article 15 does not apply. The data subject would of course have the right to make an Article 15 request at a later time.
First of all, in a GDPR contest, the process described is not strong anonymization. It may be hard for an outsider to go from the stored record to any PII, it is much easier for an outsider to &quot;single out&quot; an individual. This means that given a known individual, one can determine whether that person is among those listed in the records, or can determine this to a significant degree of probability. For this only the algorithm and the rotating salts are needed, one need not break the hash. Note also that the GDPR specifies that if a person can be singled out with the assistance of the site operator the data is not considered anonymized. Thus this data needs a lawful basis under the GDPR, and the various other GDPR requirement all apply. However, even if the data were totally anonymized, and say just added to a count of users with this or that User Agent, the process of reading local data (including but not limited to cookies) itself requires informed consent, and so a cookie banner or other interaction with similar info under the e-Privacy directive (EPD). The EPD, being a directive and not a regulation, must be implemented by national laws, and the exact provisions in those laws may differ somewhat from country to country. But I believe that all of them require consent before any local data is read.
This might be based on a misunderstanding of the GDPR. The GDPR applies under three circumstances: Art 3(1): you (the data controller) are established/live in the EU. Art 3(2)(a): you offer goods or services to people in the EU. Art 3(2)(b): you monitor behaviour of people who are physically in the EU. What is not a factor: what citizenship your site visitors have (see Recital 14). whether your site can be accessed from the EU (see Recital 23). The crucial part is what “offering of goods or services” means. The EDPB has issued official guidelines on the interpretation of this targeting criterion (guidelines 03/2018 on the territorial scope of the GDPR). Some important notes: The offer of goods or services does not have to involve any compensation. Gratis access to a website can also be a service. GDPR applies when targeting people currently in the EU. US tourists in the EU are protected, EU tourists in the US are not. The moment of offering the service matters. E.g. a US person using an US service cannot claim GDPR protection against the US service while travelling to the EU. Instead of looking at the users of the service, we should look at the target market of the service: if the service doesn't cater to people in the EU, GDPR doesn't apply. The essential question is whether the provider of the service “envisages” offering services to people in the EU. Does the service provider intend for EU data subjects to use the service? The guidelines assemble a non-exhaustive list of indications from case law, in particular the Pammer and Alpenhof case. An excerpt of indications that GDPR might apply: the EU or member states are mentioned in the offer of services the website has marketing targetted at an EU audience the activity at issue is of international nature, e.g. tourism mentioning special contact details for the EU market using a top-level domain name associated with the EU or member states travel instructions when visiting from the EU mentions of an international clientele including people/companies from the EU use of a language or currency other than yours offering delivery of goods to the EU So whether GDPR applies would depend on the subject matter of your website, and on whether you intend to participate in the EU market (even if only online, even if your service is gratis). If GDPR were to apply, then blocking people from the EU would be questionable. It might also be illegal, but not on GDPR grounds. If GDPR does not apply, then blocking people from the EU is already unnecessary. However, geoblocking would be a very strong indication that you don't intend to offer your services to people in the EU. There is no good case law on whether geoblocking is necessary or sufficient. I assume that geoblocking is sufficient (even if it can be easily circumvented e.g. with a VPN), but that it's not necessary in the first place. You could also re-emphasize that you're not targeting the EU market when considering the above indications. E.g. a web shop might clarify that they only ship to North America, but not internationally. Again: your targeting of your website is the crucial factor, not the origin of your visitors. So even if there is an occasional EU visitor, that doesn't mean you have to comply with GDPR.
As always, it depends. However, it is by no means certain that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR. Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet. However, when considering this, one should take the following two facts into consideration. 1. The "personal use exeption" in the GDPR is not new. The personal use exemption is unchanged from the article 3(2) of Directive 95/46/EC. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.) 2. Case-law under the previous regulation restricts the scope of the exception The ECJ has ruled on the scope of the personal use exception in two cases: C-101/01 C-212/13 In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals. In C-101/01 it can be argued that the hobby project as a blogger was connected to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there no such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did not apply. Discussion Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR. However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just because what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR. Conclusion IMHO, you may be exempt, or you may not be exempt. I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.
The GDPR's right to erasure just applies in some specific situations. While messages you wrote on Slack are personal data, they are generally also part of a larger discussion with others. If your messages are removed, the discussion becomes incomplete, so that will violate the freedom of expression of those others. Art. 17(3) GDPR provides an exception for the right of erasure in such cases. So basically, whoever is the controller, you probably don't have the right to have your messages to be deleted. However, you would have the right to have your account pseudonymized like Slack replied in the Reddit post you linked to. See also my answer in "Does a user have the right to request their forum posts deleted?". Basically, it is correct that Slack can be just the processor. Even if the controller cannot get access to more than 10000 messages unless they pay. However, Slack is not allowed to do anything with those messages, except when the controller says so. In its Privacy Policy, Slack distinguishes between customer data and other data. It states to be the processor for the customer data, but controller for the other data. Because those are tied together, I am not sure this distinction can be made. If not, Slack and the customer will be joint controllers, but it requires probably a court case to decide on that. For example, the Court of Justice of the European Union has ruled (in the Fashion ID case) that putting a Facebook "like" button on your website, makes you a joint controller together with Facebook. And (in the Wirtschaftsakademie case) that also creating a Facebook "fan" page makes you a joint controller. But neither of those are very similar to the situation with Slack.
Defamation requires communication to a third-party I can say (or write) anything I want about a person directly to that person and, unless it is a threat, they have no recourse at all. I can call them a liar, a thief, a Nazi, or a goat fornicator. Of course, I have to be careful – calling them a “bastard” might be a slur on their mother communicated to a third-party (them) which would give her a right to sue although that would require a literal and largely archaic use of the term. That said, you do need to check with your lawyer if you can redact names in the face of a subpoena - complying with a legal obligations is a legitimate use of personal data under GDPR.
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. That is not correct. According to GDPR Article 2: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. This Regulation does not apply to the processing of personal data ... ... (c) by a natural person in the course of a purely personal or household activity; GDPR Recital 18 states in relevant part: (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. Personal data that is not processed by &quot;automated means&quot;, for example data which is transmitted verbally, by hand writing, or by manually sent email, is not covered by the GDPR. Data which is used by a natural person for &quot;personal activities&quot; is also not covered. Consulting one's personal lawyer might well be a personal activity unless it is a business matter. Even if such a transfer of data were in scope for the GDPR, consent of the data subject (DS) is not the only available lawful basis. GDPR article 6 permits any of several possible lawful bases to be used, particularly paragraph 1 point (f) which reads: (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Also possibly relevant is point (c) which reads: processing is necessary for compliance with a legal obligation to which the controller is subject; In short, providing one's personal lawyer with the names and addresses of relevant people in connection with a legal issue is not at all likely to be prohibited by the GDPR, nor to require the consent of the people whose names and contact info are provided. However, a comment by user PMF reads: The Data Protection laws are mostly for companies, not for individuals. This is an overstatement. The laws do apply to natural persons as DCs, although enforcement is largely targeted at businesses, particularly large, for-profit businesses.