&#39;Right to be forgotten&#39; denied due to insufficient identification I registered for a free online service with fake data while being underage. Years later I request to have the account deleted, using the e-mail address I registered with. However, to identify me as the account owner they request various information like the day of registration or my identity card. Some of this information is just lost due to the amount of time that passed since the registration or last use of the service and some never existed in the first place as these are fake. How much information can the company request in order to identify me? Is there still a way 'to be forgotten' if I cannot give the requested information to identify myself? Do I lose my right to be forgotten if some or all of the data provided was inaccurate/fake? Should I tell the company that the data is inaccurate or that I was a minor at that time? Does this increase the chance of being forgotten? I am most interested in the EU (Germany) but would also be interested in the USA or others as well, if there are different answers.
The data controller is obliged to use “all reasonable measures to verify the identity” of the person exercising their data subject rights (GDPR, Recital 64). That sentence has caused a lot of confusion: “all reasonable”: does this mean all measures the controller can be reasonably burdened with, or all measures that are necessary for identifying the data subject with reasonable certainty? “identity”: does that mean the identity of a natural person, or just a check that the person exercising their data subjects rights is identical with the data subject? So depending on how the company interprets this, there is a lot of leeway regarding which info may be requested from you. In general, being able to log in to the service should be all that is necessary (compare also Recital 57). Note that the company doesn't just have to satisfy your data subject rights, they also have to protect your data against unauthorized access. Giving an attacker access just because they control a particular email address might not be secure enough (but is in practice because the attacker could use a password-reset functionality to get the full credentials anyway). You do not lose your data subject rights if you used pseudonymous/fake data: the service may still contain other personal data regarding you, for example usage profiles. You are still a data subject. Pseudonyms can also be identifying data, e.g. Art 4(1) calls online handles out as a kind of personal data. However, this does lead to complications with companies that interpret identity verification as ensuring that the person making a request is a particular natural person. If the controller isn't sure about your identity, they can request additional information (Art 12(6)). If the data subject cannot be identified, the data subject rights do not apply (Art 11(2)). However, that describes a subtly different scenario: that the data held by the controller lacks identifying data. You do have a right to access and a right to rectification (correcting the data they hold about you). However, they require the exact same identity verification as the right to erasure. That you were underage at the time of account creation is likely irrelevant now, if the data in the account doesn't indicate your true age. Unless the subject matter of the online service makes an age restriction necessary, the relevant age limits are 13-16 years (Art 8 GDPR, subject to EU member state laws) or 13 years (COPPA, U.S.). If you believe you have provided all data that is reasonably necessary to verify your identity and your data subject rights are denied to you, you can issue a complaint with your local data protection authority. In Germany, each Bundesland has their own Datenschutzbeauftragte agency. Below, relevant GDPR excerpts used in this answer. “Erasure” is Art 17 but Art 12 covers modalities for exercise of data subject rights. Recitals are explanatory but not normative. Art 12(6): Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. Art 11(2): Where […] the controller is able to demonstrate that it is not in a position to identify the data subject, […] Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification. Recital 57: Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. Recital 64: The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.
The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now). there is the EU cookie law too If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).
The GDPR has a fairly broad concept of personal data: any information that relates to an identifiable person. This is far more than directly identifiable information! The concept of identifiability is further explained in Recital 26: To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. So indirectly linkable information can still be personal data. In your example, that ID can be easily re-identified with a particular person if you know who the secretary was between 2012 and 2014. It is quite likely that there are members in the club with this knowledge, or that this information can be gained from public sources like newspaper reports. Thus, you should assume that your member IDs are at most pseudonyms, but not anonymous. They are likely still personal data. However, it doesn't necessarily follow that you would have to erase everything. Art 17 comes with lots of caveats and exceptions. For example, if you are processing this personal data under a legitimate interest, and someone requests erasure, you might have overriding grounds to continue processing anyway. E.g. such a legitimate interest could involve security or auditability purposes. There might also be such a legitimate interest for keeping some history for the club, but there would have to be a decision based on the individual circumstances. Furthermore, you can of course retain data e.g. due to a legal obligation, or when this information is necessary for the establishment of or defence against legal claims. I understand your desire to keep some data around. Instead of asking “do I have to delete this?” it might be more productive to consider “under which legal basis can I keep this?”. I think you might have a legitimate interest, but you'd have to carry out a balancing test between the various interests and rights. A really problematic approach would be to hold on to de-identified data in the belief that it no longer were personal data. Such a belief is usually mistaken. True anonymization that meets the GDPR's definition is really hard, in particular because you would also have to prevent indirect identification, also by other actors than yourself. There are theoretical models that can help with anonymization, e.g. with k-anonymization methods you'd ensure that there are no unique records in the DB. But this can be tricky to apply correctly, so I'd recommend to only treat aggregate statistics as truly anonymous. In 2012, the ICO has published an anonymization code of practice (PDF). It is no longer up to date with the current legal environment (in particular since the GDPR has expanded the concept of identifiability), but it provides a good overview of both the difficulties of preventing re-identification and an overview of potential solutions.
I think there are a couple of different ways to look at this. Deduplication is a technical detail that's irrelevant here While the data may be deduplicated on a technical level, the files remain logically distinct. If users 1 and 2 upload identical files, and then one user edits or deletes their file, this will not affect the other user's data. Users cannot tell whether their files are duplicates of someone else. From the user's perspective, it makes no difference whether or not the storage uses deduplication, except perhaps via the cost of the service. Because there is no user-perceptible difference, it would be difficult to interpret some GDPR significance into this scenario. Whose personal data is it anyway? Personal data is any information that relates to an identifiable data subject. The files here are likely to be their uploader's personal data. Thus, the uploaders would also have a right to have their uploaded files erased. In case of deduplicated storage, this would affect their logical copy. The contents of the uploaded files might also be personal data relating to a third party. Then that third party might have a right to get the file contents erased. But this right must be invoked with the data controller for that processing activity, which might be company A, company B, or the uploaders, depending on context. Which leads us to the next aspect: Company A is not responsible for handling erasures From your description, it sounds like company A is a data processor providing services on behalf of company B. In turn, B might be a processor acting on behalf of the uploaders. In any case, it seems that A would not be the data controller for these processing activities. Data subject rights like erasure must be invoked against the controller, as only the controller can understand whether such a request should be granted. The right to erasure is not absolute, and depends a lot on why that data is being processed. In particular: Personal data need not be erased if it is still necessary For example, a person might very well be the data subject of some of these files, and might then ask for erasure. But if the files are being stored because they are going to be needed as evidence in legal proceedings, the data subject can't use this GDPR right to destroy evidence. The data controller would be allowed to refuse a request in such cases. It could now happen that two different users of this deduplicated storage are storing the same file, but for entirely different purposes. Blanket deletion of all copies of a file could be quite problematic. Note that deletion is also a &quot;processing activity&quot; and needs a legal basis under the GDPR. Unexpected data loss could be a data breach. One user's erasure could be another user's reportable data breach incident. Thus, I would strongly expect such requests to be handled on a logical file level, not on the deduplicated storage level. Caveat: public access and cloned files If the (logical) file is made available to the public who can then clone or copy this file, and if the &quot;original&quot; is taken down due to an erasure request (or copyright takedown notice), it might be appropriate to remove logical clones as well. Again, this might not involve deleting the contents on the deduplicated storage level, but it might affect other users' copies. In a GDPR context, the grounds for this would be the Art 17(2) right to be forgotten: Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. But this depends crucially on who those other controllers are. If A is the sole controller, the logical files could probably be deleted directly. If B or the end users are controllers, it could be more appropriate to forward the erasure request to them.
You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine. It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.
The simple way is to post a picture of you and the widget to a site like Flickr. A more expensive way (but with rather more weight) is to get a Notary to certify they saw you and the widget on January 9th. Both the above provide evidence you had access to the widget before January 10th, but neither prove you owned it. For that, you would need a dated (possibly even notarized) bill of sale or similar - but if you acquired the widget via a gift, that won't work. A signed witness statement from the giver would probably serve (and the statement could legitimately be created when you are prosecuted). None of the above are unforgeable - but you don't need that. Depending on how the law is written, you will only need to show ownership on the balance of probabilities, or you might only need to show reasonable doubt that you didn't own it on 9th January.
GDPR does not cease to apply because of the location of data storage. It applies based on the location of the data processor, data controller, and data subject. If you are in the EU, you are a data subject covered by GDPR. It does not matter where the data are stored. Note that you are asked to confirm that you're aware that US laws may be less protective, but you're not asked to acknowledge that anything about the arrangement causes the "laws of your country/region" not to apply. The company also does not seem to be claiming that they don't apply, although it seems that they want you to think so, and it's not clear whether they think so. You are correct that GDPR doesn't allow its protections to be waived. A data subject may always consent to certain processing, and some processing may be performed without consent, but it's not possible to waive the right to withhold consent for processing that does require it.
Disclaimer: Links are in German. My German is quite rough. Quoted translations provided by Google Translate. Turns out the question "Do I need an Impressum?" is complicated. I'll start with examining the case for companies, then work down to the average private citizen. Impressum requirement The requirement for an online Impressum comes from the Telemediengesetz (TMG) &sect;&nbsp;5: 1) Service providers are obliged to keep the following information readily available, readily accessible and constantly available for commercial, usually paid telemedia: the name and address under which they are established [...] Applicability based on country of origin The applicability of the TMG is described in &sect;&sect;&nbsp;2a, 3. Thankfully, there is a 2013 court case focused on these sections, involving an Egyptian company marketing cruises and not having a proper Impressum on their website. Also thankful is that law firm mth Tieben &amp; Partner summarized this decision, because as it turns out, I cannot read judicial German. Summarizing their summary, &sect;&sect;&nbsp;2a, 3 sets the standard that the required information is based on a country of origin principle (Herkunftslandprinzip), where if that country of origin is Germany, § 5 applies. However, this principle is rooted in EU directives, and as such is not applicable to non-EU countries. For these, the law falls back on the older principle of market location (Marktortprinzip). If the non-EU company advertises in Germany and thus participates in the German market, then it must have a valid Impressum. I'll note that, the TMG considers Germany to be the "country of origin" if the company is either registered in or has significant operations in Germany (see the given sections for specifics). This is not the same "country of origin" as is found in copyright law. Applicability to private website hosts As it turns out, an Impressum is not required for private non-commercial websites. However, as pointed out by this Anwalt article, the wording of the TMG makes it such that omitting an Impressum may often be illegal. In particular, the definitions section of the TMG provides very broad definitions of "Service provider" (Diensteanbieter): Service provider shall mean any natural or legal person who provides his own or third-party telemedia for use or provides access to use; in the case of audiovisual media services on demand, service providers shall mean any natural or legal person who effectively controls the selection and design of the content offered, and "commercial communication" (kommerzielle Kommunikation): Commercial communication means any form of communication which serves the direct or indirect promotion of the sale of goods, services or the appearance of an undertaking, other organization or a natural person engaged in trade, trades or crafts or a liberal professions; [...] Conclusion In terms of variables like the one you suggest, the proper "variable" for companies is the country of origin. For private web hosts, I would argue that residency is the closest analogue to country of origin as defined in TMG &sect;&sect;&nbsp;2a, 3. Location of server doesn't matter, and I don't think citizenship does either. With that in mind, the values would be: Germany: Required EU: Not required Rest of world: Required if advertised/directed in/towards Germany. with the caveat that truly private non-commercial websites never require an Impressum.