Can a company charge you to update your address under GDPR? I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone it got me thinking about the ethics and even the legality of it. Under GDPR, I have the right to rectification of my personal data that a company holds about me. So, shouldn't I be given fair means to do so? What if I couldn't afford it and couldnt pay it? Would my policy be void? I asked what would happen if I couldn't afford the fee, and was told they would speak to management about the possibility of waiving it. Yes, this was after I'd already paid (frustratingly). The facility to change the address on their website doesn't exist yet (still being built) and even then it would cost £10 to do so. Or, is it just unethical for a company to charge a fee for updating personal details? Especially when it incurs no cost to the company for me to update a row in the database. What if I didn't have a phone or Internet? Would I have to send the money in the post? But then what if I was unable to send a something in the post? Any info would be appreciated
Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Thus, I think it would be invalid to charge a fee for an address change if that change was made in exercise of your data subject rights. If you didn't invoke this right, it's debatable whether charging a fee would be proper. On the one hand, they can charge whatever service they want (provided that this was part of the contract you entered). On the other hand, they have an obligation to assist you with your exercise of data subject rights. This includes recognising a data subject request even if you didn't explicitly invoke the specific GDPR article. For example, refusing a request for erasure just because you didn't invoke some magic GDPR words would be clearly noncompliant in my opinion. If the company offers multiple customer service options, charging for some of them may be all right. Typically, the lowest-cost solution for a company to deal with GDPR requests is to offer an online self-service option. An email to the data protection officer would typically also be free. Charging for phone support might be fine though. In an insurance context, there could also be a legitimate claim that updating your address is not a mere correction of your personal data, but a modification of the contract (depending on what you're insuring). Another possible counterpoint (which I think is not valid though) would be that the company never stored inaccurate data and therefore doesn't have to satisfy a rectification request.
You have the right to refuse the insurance company's offer and keep your car, but that would be self-defeating. You can keep the car at the shop, and you will incur storage fees; it is possible but quite unlikely that the insurance company will change its mind and offer you more money (unless you're contending that they made a serious technical error in computing the value). The insurance company has no obligation to the shop, but they might have an obligation to you (i.e. it might be a term of the policy that they will pay storage fees up to some limiting condition). Whether or not you have to move the car or pay storage fees is between you and the shop. If I understand your idea about a signed document from the shop waiving fees, you're suggesting that they might waive the fees if you end up having to pay it, but they would stick the insurance company for the amount if the insurance company were to pay. Again, the insurance company only pays what you owe, and under this scenario, you wouldn't owe storage fees, so the insurance company wouldn't be obligated to pay. If you were on the up and up about this, the insurance company would just say "No, that doesn't work". If you were not on the up and up about the arrangement, that would be fraud.
I am not a lawyer; I am not your lawyer. You do not cite a jurisdiction so this makes it very difficult to get a definitive answer. What follows is for Australia but the general principles are common law and would be applicable to other common law jurisdictions except where statues apply or case law has diverged. In the first instance, it seems that you were not party to any arrangement to pay for the electricity. So on the face of it you are not party to any contract requiring you to pay. Even if there was such an agreement: family, domestic, social and voluntary agreements (which this would be) are presumed not to be intended to legally bind the participants. Whether this presumption would be overturned would depend on the specific facts. On the face of it, there is no legal obligation to pay. Your options are: Do nothing; this puts the ball in their court, they can: Forget about it (it would then be over) Attempt to sue you with little prospect of success (which would cost them and you a lot more than $50 irrespective of who won) Do something illegal like beating you up (you really need to assess this risk) Tell everyone they know (in person and on social media) what a skiving prick you are (you could probably sue them for damages but that's not really going to happen, is it?) Pay them what they are asking Offer to pay them something less. Option 1 is likely to break any relationship you have with the person, Option 2 is likely to preserve it and Option 3 could go either way. Ultimately, like most legal questions, this is not about the law; it's about relationships ... broken ones mostly.
In the question, you write: The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file). No, it does not. To quote Miss Infogeek: GDPR DOES NOT MAKE CONSENT A MANDATORY REQUIREMENT FOR ALL PROCESSING OF PERSONAL DATA. Consent (Article 6 (1)a) is indeed one of conditions that can be used to comply with the GDPR requirement that processing must be lawful, but it is not the only condition available to the controller to ensure lawful processing &ndash; there are alternatives (before the list of conditions it says that "at least one of the following" must be satisfied). All the conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. One of alternatives are Article 6 (1)f. It says says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) As noted in the question, logging IP addresses for the purpose of security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. It is the default, and most (all?) web-sites do this. I.e. it is legal to do this without consent (if this is not the case, I am pretty sure the outcry had been heard all over the Internet by now).
This practice is probably not illegal, but I think it is at best ethically dubious. The invoice specifies &quot;&quot;Advising in relation to employment agreement with X&quot;, but according to the question no advice about X was given or even asked for, and while advice about Y was discussed, no such advice was given. That suggests that the asker owes the solicitor nothing. However the asker was informed of the hourly charge and then continued to discuss the issue. it could be argued that the constitutes an implicit contract to pay that rate for those discussions. It seems that the asker never said &quot;does that rate apply to this telephone call&quot;, nor did the solicitor say &quot;that hourly clock starts now if you want to continue&quot;. This leaves the situation less clear than it could have been. The second email, as described, seems to imply that the work of giving advice had not yet commenced, and thus no fee was due for services to date. A person in this situation could reply with a letter (sent by email or postal mail or better both) saying that no advice was given, no useful service was performed, and there was no agreement to pay for any service, so no fee is due. If the solicitor takes this to a court case, the asker may well want to consider consulting a different legal professional. This is a case where the exact facts may well matter, so no more precise answer can, I think, be given here.
[I'm not so well-versed on US and Russian law, thus I will limit my answer to EU law.] Your specific use of a user identifier, as I understood from your question, can be classified as personal data, so in your case, the GDPR seems to apply. This means that you need to have a) legitimate purposes to process that personal data (e.g. crash reporting) and b) a legal justification for each purpose of processing: it could be based on consent or another legitimate purpose (inc. your own legitimate interests). Consent might not be the best option for you, but it's up to you to decide. In any case, you need to assess the risks to the data subjects (your users) before you decide. How likely is it that you will get breached, and what potential harm will that cause to your users? These are some guidelines; my recommendation is that you read the law and the guidelines by the Article 29 Working Group and European Data Protection Board, or hire some good experts on this. There is no easy answer, or one size fits all solution. The GDPR isn't so hard to understand or implement, but it does require some change in mindset. With the new law, processing personal data carries a higher risk of penalties, so you should do it only when it's absolutely necessary, and with respect to the rights of your users.
You seem to have a solid understanding of the ePrivacy implications, but lack a fundamental insight: your organization does not have a right to achieve its mission or a right to disseminate unwanted marketing. But other people do have a right to not be subject to excessive marketing. Of course, reality is more complex, so it's probably not entirely impossible to do marketing. In your point 1, you note that some EU/EEA/UK countries distinguish ePrivacy protections between consumer and business subscribers. You can research the exact rules in the potential customer's country. This may allow you to email corporate/business accounts. I would strongly advise against messaging via Linkedin if there is a chance that the person is using that account for personal purposes like networking or hunting jobs, not just for conducting official company business. ePrivacy has markedly different rules for email marketing vs phone marketing. Whereas there are pretty strict rules for electronic messages and robocalls, manual cold calling can be OK from an ePrivacy perspective. However, many EU/EEA/UK countries have rules that go beyond ePrivacy, and may have a kind of do-not-call registry that you must respect. Of course manual calls take more effort than spamming emails, but recall the above point that you don't have a right to spam other people. Phone calls are probably the most appropriate approach when the company lists individuals' phone numbers on its website. This will at least give you a few seconds of attention with a real human, more than you can expect from an email that is likely to be caught by spam filters. Marketing via physical mail tends to have very lax rules. Note that every company/business that has a website will have to disclose its contact details including an address there, so this information is easy to acquire. However, chances are low that anyone would seriously engage with that marketing. You can consider alternatives to direct marketing, so that interested companies eventually come to you. Things like press releases, writing guest articles in industry publications, speaking at relevant conferences, working on search engine optimization, buying ads. On the GPDR aspects: GDPR and ePrivacy overlap, and it is necessary to comply with both sets of rules (GDPR likely applies here via Art 3(2)(a)). But where they potentially contradict each other, ePrivacy as the more specific law has precedence. For example, ePrivacy overrides the default GDPR legal basis rules when it comes to email marketing to existing customers (opt-out basis, no consent needed) or to using cookies (needs consent unless strictly necessary). Information that relates to corporations is not personal data, but information that relates to individual employees or to sole proprietors would typically be personal data. Since you are unlikely to obtain consent for using this data, you would need an alternative GDPR legal basis such as a &quot;legitimate interest&quot;. Relying on a legitimate interest requires that you conduct a balancing test, weighing your interests like marketing against the recipient's interests, rights, and freedoms. Core question in this context is whether the data subject can reasonably expect their personal data to be used like this, taking into account the nature of their relationship with you. Since there is no pre-existing relationship, claims of a legitimate interest are weak to start with. However, it may be possible to argue that when a company makes employee contact details available via its website (not LinkedIn!) then relevant marketing can be reasonably expected. I would rather not rely on such arguments, though.
Per GDPR Art 79, you can sue data controllers if you consider your rights to have been violated. Where you have suffered damages due to GDPR infringements, you also have a right to compensation per Art 82. However, your rights may not have been violate as far as the GDPR is concerned. Under the GDPR any kind of personal data processing needs a clear purpose, and that purpose needs a legal basis. One possible legal basis is consent, but there also are others (such as legitimate interest). Just because you didn't consent doesn't mean that your rights have been violated. Where processing is based on legitimate interest, you can object to that processing of your personal data – but your rights must be balanced against that legitimate interest (Art 21). If your friends post a photo and you only appear in the background, your friends' legitimate interest to post that photo likely outweighs your rights. In practice, suing Facebook because of GDPR infringement is not a sensible way to achieve the outcomes that you likely want. First, this is expensive. Second, it is arguable whether Facebook or your friends should be the defendant. Third, removal of existing data won't prevent the processing of new data in the future. It would be more sensible to treat this as an interpersonal rather than a legal problem, and to talk with your friends so that they don't include you in their photos that they would like to share online. I've focussed on photos because their situation is fairly clear. Voice snippets might not count as personal data when you are not identifiable in them. Personal assistant apps should not be listening continuously, but only start recording when a wake-word is recognized.