Does information related to client IP address is been allowed as per GDPR policies. Without asking user&#39;s location We need implement user's nearby store locator. Where we have code to get user's ISP location from where the client request is been triggered. But getting lat-long &amp; city details by checking client browser IP address. Even if user don't allow website to share user's current location. Does above doing violates any of GDPR policy? Please share your views. Thanks.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
If GDPR applies, then no one can opt out. If it doesn't apply, then an IP block is superfluous. Whether GDPR applies is determined by Art 3 GDPR. For this, we must distinguish where the data controller is operating from. It is irrelevant where the site is hosted, but primarily relevant where the data controller (your colleague) has an “establishment”, e.g. where he resides or typically works from. Per Art 3(1), GDPR applies to all processing activities in the context of an European establishment, regardless of where the users are. So if your colleague were running this site from Europe, they wouldn't be able to circumvent GDPR by blocking European users. However, if your colleague is running this site from outside of Europe, then Art 3(1) doesn't trigger. Per Art 3(2), GDPR can apply to processing activities where there is no European establishment. There is the Art 3(2)(a) “targeting criterion”: if your colleague “offers” goods or services to people who are in Europe, regardless whether paid or gratis, then GDPR applies to all processing activities related to this offer. I'll discuss this more below. There is also the Art 3(2)(b) criterion: if your colleague monitors the behaviour of people that occurs in Europe, then GDPR applies. For example, an app collecting geolocation information or a website creating interest profiles for ad targeting might trigger this criterion. An IP block can help to establish that no offering/monitoring related to people who are in Europe is happening, but it might not be necessary. It may be worth talking a bit more about the targeting criterion. The GDPR explicitly says that mere availability of a website in Europe doesn't imply that GDPR would apply. Instead, it is necessary to establish the data controller's intention – are they soliciting users from Europe, or otherwise expecting that people from Europe might use those services? Recital 23 gives a couple of non-exhaustive factors that can be considered here, for example: the site uses a language or currency used in the EU but not used in the controller's own country the site mentions users or customers from Europe, e.g. in testimonials This means that a lot of US websites, written in English or Spanish, only mentioning payment in USD (if any), not mentioning any European countries, will not be subject to GDPR. Then, occasional European visitors are irrelevant. It wouldn't be necessary to IP-block potential European users. However, such an IP-based block would help establish that the data controller really doesn't intend for those services to be offered to people who are in Europe. My personal opinion is that it's wasted effort to block users from foreign countries in case their foreign laws claim to apply, but if such a block brings peace of mind that might be worth it. While geoblocking might not be necessary, is it sufficient? There is no clear guidance on this subject, but it seems to be generally accepted that IP-based geoblocking is fine, even though it is trivially circumvented using VPN services. Of course, if a website were to block European IP addresses but were to also advertise that people in Europe can use their services via VPNs, that would probably still be an “offer” and might defeat the point of doing any geoblocking. The Art 3(1)(a) targeting criterion is most easily applied to things like ecommerce where physical goods are shipped to the customer in return for payment – so essentially whenever the data controller participates in the EU Single Market. This is roughly similar to the concept of a Nexus in US tax law. But in principle the targeting criterion can also apply to other kinds of websites or apps such as blogs, even if they are gratis. GDPR does not just apply to for-profit commercial activity, and doesn't distinguish between controllers that are entities/LLCs and controllers who are natural persons. Things are slightly more complicated due to the Art 3(2)(b) monitoring criterion and the pervasive use of online trackers on websites, but this aspect of the GDPR is difficult to enforce and frequently ignored. In this answer, “Europe” means the European Union (EU), the European Economic Area (EEA), and the United Kingdom (UK). Note that countries like Norway are covered by GDPR, whereas Switzerland is not. Of course, the GDPR is not the only privacy law relevant internationally.
By which law I am enforced to share my personal details (such as my full name) on forum publicly to on-line people which I even don't know (when commenting on random posts)? Contract Law. Google have made it a term of the contract that you use your full name. You can: contact Google and negotiate a change to that term, accept that term, choose not to enter the contract. so I can enforce on my privacy rights without removing my Google Plus account? As a person subject to UK law, your privacy rights involve limiting who and in what circumstances Google can divulge personal private information to. Your name is not personal private information; things like your medical history and bank balance are. Aside from that, you do not have a right to privacy. Anything you do or say that is visible or audible from a public place (like the internet) or a private place where the person in control of that place does not insist on your privacy (i.e. almost everywhere that you are not in control of) is public!
Most likely yes if you are subject to UK or EU laws: The EU ePrivacy directive and implementing laws such as PECR in the UK require that you obtain consent before accessing information on a user's device, unless that access is strictly necessary to perform a service requested by the user. Cookies and similar technologies such as LocalStorage are stored on the user's device. Analytics are not strictly necessary to display a website. Thus, you need to obtain valid consent before setting any analytics cookies. GDPR and ePrivacy/PECR have some interactions: Even though the cookies might technically be set by GoSquared, you as the website operator are responsible for compliance. You are the data controller, the third party analytics are usually a data processor who only process data on your behalf. You must ensure that the data processor is compliant. Even if they were a joint controller you'd be responsible for what happens on the website (relevant precedent is the Fashion ID case). While ePrivacy originally had a fairly weak concept of consent (e.g. “by continuing to use this site, you consent …”). However, the GDPR updated the definition of consent, so that valid consent must be freely given, informed, actively given, and specific. If you set cookies for different purposes in addition to analytics, users should be able to give or withhold consent for analytics independently from other purposes. Since consent must be actively given, consent is never the default, e.g. pre-ticked checkboxes are not compliant (relevant precedent is the Planet49 case). Like Google, GoSquared stores data in the US. You are causing personal data to be transferred into the US, which is an international transfer. Before it was invalidated earlier in 2020, such transfers were easy to do under the Privacy Shield adequacy decision. Now, such transfers are only legal if you sign SCCs with your data processor, and your risk assessment indicates that your user's data is sufficiently safe there, despite your processors potentially being legally unable to comply with the SCCs. Fortunately for you the UK's ICO has taken a more industry-friendly stance on this matter than other countrie's data protection agencies. Why do so many websites use Google Analytics (GA) without requesting proper consent? A variety of potential reasons: They are actually non-compliant. After all, GA is not GDPR-compliant in default settings, and Google doesn't do a good job of providing essential information. Many data protection agencies have indicated that cookie consent enforcement is not their focus. GA can be used without using cookies/LocalStorage/…, and thus without requiring consent under ePrivacy or PECR. The websites might not be subject to EU or UK laws such as ePrivacy.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
To do so I used some images and Gifs which may be under copyright but since I don't earn money for myself and there is no company backing me I was hoping that there is some protection for private persons like me who just want to showcase the project. Sorry. If your website is public facing (i.e. not password protected and available only to family and close friends), you need to follow copyright law. There is no exception to copyright just because a project is run by an individual for non-commercial purposes. I am also insecure about the GDPR regulations since I give users the ability to create an account and try it out. Your profile says you're in the EU. Then you need to comply with the GDPR. Is there any way to protect me against greedy lawyers and companies? Could I write something like: "This website is a peace of art" and save myself with arguments like "artistic freedom" or "free speech"? Nope. A controversial website run by Peter Sunde had at one point a "free speech" disclaimer (similar to the one you propose) posted. However, Sunde did never use this defense in court: Finnish court slaps Peter Sunde with €350k fine. If he had shown up in court, I am pretty sure the court would have told him that such a disclaimer has no legal merit. The only protection that will make you completely safe is to adhere to the law.
I don't believe GDPR makes a distinction between 'real life' and 'online'. It's all real life. You can tell anyone that they don't have consent to keep your personal data, but that doesn't mean they always have to delete it. There are six lawful bases for processing of personal data, so if an organisation is using and can justify one other than consent then they don't necessarily have to delete your data when they ask. The six bases are listed by the UK Information Commissioner's Office: (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/#ib3
It is not different. But one company can decide to approach compliance differently from another. Here, TomTom has chosen a fairly safe/conservative interpretation, whereas Google and Apple decided that more data collection is appropriate. A “find my device” style functionality appears to be entirely unproblematic if the user books that particular service (regardless of whether the service is paid or gratis) and provides consent for the location data collection. The legal basis for such a service could then be Art 6(1)(a) consent or Art 6(1)(b) necessity for performance of a contract to which the data subject is party. Personally, I believe that Google is not sufficiently transparent about how Find My Device works, but that TomTom could provide a compliant service if they wanted to. That TomTom doesn't offer this service primarily shows that they don't think developing this service is worth it. Wiping a remote device is unrelated to this issue and doesn't seem to provide GDPR challenges. At least in a business context, remote wiping may be an appropriate security measure and may then even be mandated by the GDPR (e.g. see Art 24 or Art 32).