Do I still need to check if users are inside of EEA/UK for GDPR consent if my Android app is ONLY released in countries outside of EEA/UK? Example: A US user downloads the Android app from the US Google Play Store The user does not view any consent form and begins using the app and viewing ads The user then travels to EEA/UK and continues viewing ads Would a consent form be required to adhere to GDPR in this instance, even if personalised ads are disabled for EEA/UK users?
The GDPR roughly applies in the following scenarios: Art 3(1): you have an establishment in Europe Art 3(2): you do not have an european establishment, but Art 3(2)(a): offer goods or services to persons in Europe Art 3(2)(b): monitor the behaviour of people who are in Europe (where Europe means EU/EEA/UK as appropriate). Art 3(1) does not seem to apply for you. Art 3(2)(a) does not apply, since you're not actively targeting people in Europe. At the point in time where you are offering the app to users, those users are in the US. Art 3(2)(b) could apply if you collect some kind of tracking data, in particular (but not limited to) location data. But if you temporarily shut down collection of new data for personalisation while the user is in Europe, that's probably going to be reasonably safe. It might not be necessary to disable ad personalisation if that personalisation is based on data collected outside of Europe. In practice, unless your app is specifically targeted at travellers, no one will care about what your app does outside of the US. For detailed guidelines on the territorial scope of the GDPR, consider reading EDPB guidelines 3/2018 (PDF). The document contains some relevant examples, but since it's official guidance they won't explicitly say that GDPR won't apply in a scenario like yours. The closest is Example 8: An Australian company offers a mobile news and video content service, based on users’ preferences and interest. Users can receive daily or weekly updates. The service is offered exclusively to users located in Australia, who must provide an Australian phone number when subscribing. An Australian subscriber of the service travels to Germany on holiday and continues using the service. Although the Australian subscriber will be using the service while in the EU, the service is not ‘targeting’ individuals in the Union, but targets only individuals in Australia, and so the processing of personal data by the Australian company does not fall within the scope of the GDPR. Also relevant is Example 10, which says that app downloads in the EU might not be subject to GDPR: A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market, evident by the app terms of use and the indication of US Dollar as the sole currency available for payment. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR.
IANAL. (1) GDPR is certainly relevant. (2) This is certainly "personal data" under the definition in GDPR article 4. (3) Maintaining this data is probably lawful under article 6 sections 1(a) (consent) - provided that the Terms and Conditions of the site make clear that the user by signing up is consenting to this information being held (3) There is certainly an obligation under article 14 to disclose that the information exists, and to say how it used. (4) Article 15 says that data subjects are entitled to see the information and know what recipients or categories of recipient have access to the information (I don't know whether it's enough to just say "moderators", or whether the moderators need to be identified). (5) I can't see any reasons why the obligations under articles 16, 17, and 18 regarding rectification, erasure, and restriction of processing aren't relevant. This is exactly the kind of situation that GDPR is designed to address. If you're restricting the service available to particular users based on a record of their behaviour or on judgements made by moderators, then they absolutely have a right to know, and a right of redress.
Technically, yes, GDPR might apply. Filming other people does involve the processing of personal data, and GDPR will apply unless this is for “purely personal or household purposes”. But exactly that will be the case for most holiday snapshots or short clips for your personal social media. As far as I understand, you do not have to worry about purely personal activities. Even if GDPR would apply, this doesn't mean it would be illegal. It means you'd need a “legal basis”, such as a “legitimate interest”. If there are just a couple of people in the background of a video, it's possible that their rights might weigh less important than your interest in shooting the video – but that would need a case by case analysis. Your legitimate interest would almost certainly prevail if you need to record a crime to which you are victim. Regardless of GDPR concerns, note that this is just a small aspect of legal concerns. Instead, also consider personality rights copyright (if art or architectural works are visible) / freedom of panorama customs and reasonable expectations of other people These issues will depend largely on the specific country or area you are travelling to. Europe is not homogenous in its perception of privacy issues. For example, consider the issue of dashcams in a car. These are considered to be quite normal in some European countries, but effectively illegal in others.
I will try to answer some of my questions based on recent developments and other information I've seen. Yes. 2. No. On page 23 of this Commerce Dept. memo on TikTok, it describes: This prohibition would remove the TikTok app from U.S.-based mobile app stores, preventing mobile users from being able to download the app to their devices or receive updates. As scoped, this prohibition would only apply to app stores accessible in the United States, thus users would still be able to download the app while outside the United States. On page 15 of this Commerce Dept. memo on WeChat, it describes: This prohibition would remove the WeChat app from U.S.-based mobile app stores, preventing mobile users from being able to download the app to their devices or receive updates. As scoped, this prohibition would only apply to app stores accessible in the United States, thus users would still be able to download the app while outside the United States. 3,4,5. No for WeChat. In letters sent to the opposite party in a lawsuit and filed with the court, the US government has provided assurances that WeChat users will not have any civil or criminal liability for downloading or using the app for personal or business communication. we can provide assurances that the Secretary does not intend to take actions that would target persons or groups whose only connection with WeChat is their use or downloading of the app to convey personal or business information between users, or otherwise define the relevant transactions in such a way that would impose criminal or civil liability on such users. In other words, while use of the app for such communications could be directly or indirectly impaired through measures targeted at other transactions, use and downloading of the app for this limited purpose will not be a defined transaction, and such users will not be targeted or subject to penalties. I'm not entirely sure for TikTok, but the same may be true for TikTok since the prohibited transactions for both are essentially the same. No. The regulations on prohibited transactions do not require the blocking of traffic from the apps. Simply carrying the traffic of the app is not one of the prohibited transactions, as long as the company does not have a contract for internet transit or peering with ByteDance/Tencent, nor are providing hosting or content delivery services to ByteDance/Tencent. On page 23 of the Commerce Dept. memo on TikTok linked above, it says: User data could still be served by data centers, [redacted] operating outside of the United States. On page 7 of this declaration by a Commerce Dept. official further explains that WeChat traffic will still flow through the US: Moreover, this prohibition would not affect Internet transit or peering services in the United States that are not “directly contracted or arranged” by Tencent, and thus would leave the overwhelming majority of Internet traffic, including WeChat data, untouched.
Among other things, GDPR regulates what you may do with the data within your systems. You can use it for the contracted purpose, or in accordance to law, or with informed and revokable consent, or for some other enumerated purposes. Even with consent, you have to take security measures to avoid the misuse of the data. Remember the software shrink-wrap licenses? &quot;By opening the package, you agree to the terms inside.&quot; GDPR makes the equivalent in the cloud world impossible. You have to document exactly what you do with the data, and for any use that is not necessary to perform the service the customer can opt out. In the scenario you describe, it is possible that you are not the data controller under GDPR but the data processor, and that you have a duty to keep the data from separate controllers apart. And delete any batch at the end of contract. If you want to do this professionally, you need to consult a lawyer for your specific plans.
There is nothing extraterritorial about these laws. If a company sells a good or provides a service to individuals based in the EU, then this good or service has to comply with EU laws. This concept is self-evident for physical goods that are produced anywhere in the world and then sold in the EU and the GDPR just applies this concept to services provided over the internet. The same legal concept also holds in all other major jurisdictions. The only thing that makes this more complicated for the GDPR is the actual enforcability of these laws but that is a technical issue not a legal one.
There doesn't seem to be any legal requirement to show banners to announce the use of strictly necessary cookies ("functional cookies"). However, the GDPR's transparency principle requires you to disclose the purpose and legal basis for all processing of personal data. This could be done via a banner, but more commonly via a site-wide privacy policy. The GDPR requires such information to be provided at the latest at the time when personal data is collected. A layered disclosure approach could use banners to alert visitors to the privacy policy, but I'd want to avoid this to prevent confusion with non-compliant consent banners. Of course, GDPR only applies when the cookies are used for processing of personal data. Cookies are handled more specifically by the EU's ePrivacy directive, for which each country has it's own implementation. You should therefore check with local laws and guidance from your local data protection agency.
Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea. If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution? Is it GDPR compliant that their answer to my deletion request is "We will delete the data..." The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”. You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.