Would a business that has no office in EU still have to worry about GDPR, and if so, why? This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR. Although opportunistic lawsuits against US-based businesses on their handling of EU-residents data might be possible, I find it doubtful that EU would audit businesses outside their jurisdiction for GDPR compliance. This is why I wanted to ask: Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR? If it is then how (and by whom) would compliance be audited and/or enforced?
Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR? Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)). Note that: having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency. If it is then how (and by whom) would compliance be audited and/or enforced? Supervisory Authorities will care of it.
[I'm not so well-versed on US and Russian law, thus I will limit my answer to EU law.] Your specific use of a user identifier, as I understood from your question, can be classified as personal data, so in your case, the GDPR seems to apply. This means that you need to have a) legitimate purposes to process that personal data (e.g. crash reporting) and b) a legal justification for each purpose of processing: it could be based on consent or another legitimate purpose (inc. your own legitimate interests). Consent might not be the best option for you, but it's up to you to decide. In any case, you need to assess the risks to the data subjects (your users) before you decide. How likely is it that you will get breached, and what potential harm will that cause to your users? These are some guidelines; my recommendation is that you read the law and the guidelines by the Article 29 Working Group and European Data Protection Board, or hire some good experts on this. There is no easy answer, or one size fits all solution. The GDPR isn't so hard to understand or implement, but it does require some change in mindset. With the new law, processing personal data carries a higher risk of penalties, so you should do it only when it's absolutely necessary, and with respect to the rights of your users.
Can a city request deletion of all personal data that uses a certain domain for logins? Well, they can, but they have no legal backing to make it happen. Their chances of succeeding are about as good as me requesting a Ferrari, a Yacht and a Mansion. I can make that request. People will laugh. I will not get it. I'm a little worried that I shouldn't allow certain domains to be used as logins in the first place, especially ones that might be school related You have no way to know who owns what email address. And it's none of your business. Your only interest should be in whether the address is owned by the person that is creating the account. You probably already do that by sending a confirmation link to the email address when people sign up. I'd like to have some idea for future reference if there's any case where the GDPR would require me to comply with such a request The only way you have to comply with such a request is if the owner can prove their identity. As far as I understood, the &quot;Finnish city&quot; was three degrees away from that. They could not provide any proof they are who they said they are, they could not provide a finite list of accounts they claimed to own and they could not even provide proof they own those accounts. They literally just wrote an email with zero legal meaning. I want to figure out the right way to reply to emails like this one The correct way to handle this is have a feature on your website where the account owner can delete their own account. GDPR compliant. Then you make a text template explaining how to use that feature and reply with that template to every request, no matter how stupid (like this case) they are. If they cannot identify themselves to you by proving they have access to their &quot;own&quot; email, they have no business wasting your time. Legally, they could provide you with a different method of identification. In case of a Finnish school, that would probably need to be power of attorney from all children's legal guardians and a specific way to identify the accounts that is consistent with the data given (for example if they entered their full name and address on your website). You would probably in your rights to demand a certified translation if it's all in Finnish. Apart from the fact that you as a private US citizen have no real means to check the validity of all that paperwork, personally, if I saw hundreds of pages of certified translated paperwork, I would probably just comply. Not sure it it were actually enough, but it certainly gets an A+ for effort to delete data from a private website. But a real lawyer might give better advice with a real case on their hands. Is deleting the data actually more of a legal liability than not deleting it in some cases? (People shouldn't be able to delete other people's accounts.) Indeed. You should not delete people's data because a random punk on the internet sent you an email. You need to identify who the request is from and if they are allowed to make such a request. Whether you have a legal duty to actually keep data, is up to you or your lawyer to find out. It depends on your data and laws. It is perfectly legal to make a website with a textfield that deletes any data you enter after a second. Destruction of data you own is only a problem if you break other laws with it. For example the IRS might not be amused if you destroyed invoices and other proof of taxable income. &quot;Some dude claimed I must in an email&quot; is not going to fly with them. That said, again, please, identify who you deal with, find out if their claim is valid. Don't do stuff because random internet punks write you an email. Because the next mail you get, will be from a Nigerian Prince. Please wisen up before opening that one. People on the internet, through stupidity or malice, might not have your best interests at heart. Don't believe random emails.
There is no requirement about "data" in the GDPR, so provided this is just "data", no. An empty form with fields for personal data contains no personal data. On the other hand, if the form is filled in by the user with personal data (as defined in GDPR article 4), and you receive a copy of the filled in form and process these personal data (as defined in GDPR article 4) - then the answer is: Yes. However, if you do not process the personal data (i.e. the form is just printed out on paper and filled in with a pen, and nobody except the data subject has access to the piece of paper with the filled in form - then the answer again is "no").
The key issue here is the unauthorized collection of video thumbnails, not the use of cloud services. Under GDPR, every personal data processing activity has one or more controllers who are responsible for the activity, and every such activity needs a “legal basis”. With such cameras, the operator will typically be a controller, since they determine the purposes for which this camera is used. In this scenario, the operators – as part of their responsibility to conduct the data processing activity in a GDPR-compliant manner – had disabled any cloud features provided by the camera manufacturer. Despite this configuration, the camera manufacturer collected thumbnails and uploaded them to servers under their control. So, we likely have two distinct issues at hand: the camera manufacturer misled its customers about the privacy settings of the cameras. This is not necessarily a GDPR issue by itself. the manufacturer performed data processing activities in contravention of various aspects of the GDPR. Relevant aspects of the GDPR that might have been violated: the manufacturer did not have an Art 6 GDPR legal basis for this processing activity, such as a “legitimate interest” the manufacturer did not provide information per Art 13 GDPR to the people being monitored this way even if the cloud-based thumbnail processing were intended, this could be a violation against the Art 25 obligation to ensure “data protection by design and by default” depending on how the cloud storage services were configured, there might be violations against the Art 28 responsibility to contractually bind such vendors as data processors, or against the Chapter V rules on international data transfers Different actors might have different remedies against this violations: buyers of the camera might have remedies under consumer protection and product liability laws against the manufacturer data subjects of the illegal processing activity have remedies under the GDPR they can exercise their data subject rights against the data controllers, such as erasure of the thumbnails. However, this will be difficult to exercise in practice since the manufacturer will not have identifying information, and would then be free from having to fulfil certain data subject requests per Art 11 GDPR. they can lodge a complaint with a responsible supervisory authority, which would be the data protection agency in their EU/EEA member state (or the ICO in the UK). The EDPS is irrelevant here, since it is only the internal supervision authority for EU institutions. The competent supervisory authorities can levy fines. they can sue the data controllers, both for compliance (e.g. deleting unauthorized thumbnails) and for damages, if any were suffered. However, immaterial damages awarded for GDPR violations are typically fairly low, if they are recognized by the court at all. the right to judicial remedy (sue the controllers in court) and to lodge a complaint are independent. They largely pursue different remedies. Both can be used to seek compliance, but only supervisory authorities can impose fines, and only direct lawsuits by the data subjects can seek damages.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
For land ownership records and other similar scenarios such as business directors, the requirement for these to be public will be in legislation rather than a contract - this provides the legal basis, see GDPR Article 6(1c). Additionally when government departments are doing it they also have 6(1e) as lawful basis: "1. Processing shall be lawful only if and to the extent that at least one of the following applies: ... (c) processing is necessary for compliance with a legal obligation to which the controller is subject; ... (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;" -- GDPR, Article 6(1c,e). I'm not familiar enough with the specific legislation that will apply here but pretty sure this will be the case, and having said this you may well find public registries also become less public going forward. The reason ICANN has come under fire, is partly because under GDPR privacy is a protected fundamental right and therefore to comply personal data should be kept private by default and privacy never something you would be required to pay extra for. Any contract ICANN have in place with their registrars will not override legislation, it is in fact the other way around. "2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons." -- GDPR, Article 25(2). This doesn't stop ICANN from maintaining a register of domain name owners (registrants), but it does mean they can't just publish all records upon request to anyone anymore - whether people will be granted access to personal data will now depend on if they have a lawful basis for this, and in these cases their processing of the personal data will be limited to those purposes. Being nosey doesn't count! "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of the contract." -- GDPR, Article 7 (4) - Conditions for consent. What this means essentially, is that if the consent is conditional for the contract it will not be treated as freely given, and therefore not valid - it will no longer be acceptable to contractually bind the provision of a product or service with consent to publish personal data or any other form of processing such as marketing mailing lists. Looking now at the specific points you have raised: "GDPR article 6 allows for processing of personal data on a contractual basis (section 1b)" Whilst this is true, this is only part of it - it doesn't allow for unlimited processing for any purpose and sharing it with any people, if you look at Article 5(b) it states that the information is collected for specific explicit legitimate purposes. Each purpose requires its own legal basis and needs to be compatible with the principles of GDPR. Without consent, ICANN currently does not have a legal basis to make the WHOIS records public for EU citizens and should have adopted some technical controls to require them to opt-in if they wish to be included in the public register. They're coming under fire for non-compliance having been given 2 years to prepare and change their systems/processes. "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;" Again whilst this is true, not all processing is necessary for the performance of a contract. In the same way people must give consent to receive marketing communications, they must freely give consent for their information to be shared/published (separate to the contract for provision of service) in the absence of other lawful basis for this processing. "Also section 1c, processing is necessary for compliance with a legal obligation to which the controller is subject;" There is no legislation which requires them to publish the personal data of domain name registrants. In this paragraph 'legal obligations' refers to those required by legislation (i.e. statutory obligations), not contracts (or non-statutory obligations) which are covered under Article 6(1b). "And finally section 1e, processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;" ICANN has no official government-assigned authority, and publishing the personal data globally is not in the interests of the data subject's or others' welfare or well-being - this is what is meant by 'public interest'. As far as I can see what ICANN are actually doing to comply seems to be accepted by the European Data Protection Board, they are only 'under fire' as you say because they are late in doing so. The deadline was 25th May 2018 and they had 2 years to prepare like all other organisations.
That a company (C) has a website that can be accessed from a given county does not mean that the company operates in that country. If C is located in country A, markets and advertises to country A, offers products designed to appeal in country A, has its site only in the primary language of country A, uses servers located in country A, and has all its assets and physical offices in country A, it is not operating in country X, even if a few people from X do business with C over its web site. Country X may have laws which claim to apply to C or its web site. It will find it hard to enforce those laws, particularly if owners and officers of X do not travel to X. It will find it hard to extradite anyone for violations of the laws of X unless those actions are also crimes under the laws of A. If X is a major, powerful country such as the US, the UK, or the EU it may be able to get A to enforce its court orders, or to use its influence over the banking system to impose penalties on C. If X is North Korea, or even Brazil, it is probably out of luck. Thus the management of C needs worry primarily about the laws of A, and to a lesser extent the laws of major countries that make some effort to enforce their laws outside their own borders, such as the GDPR, or certain US laws. It probably has little reason to worry about the laws of other countries. If A is itself a major country that can easily resist any pressue from X, C has even less reason to worry. If C does significant business in countries D and E, and particularly if it opens physical offices in D or keeps assets in E, it will have much more reason to worry about the laws of D and E. If it does advertising in the D &amp; E markets, this also gives C more reason to be concerned with their laws. There is always some risk of X finding a way to enforce its laws, but the risk is small.