Do cookie banners need to change for GDPR compliance? Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts to implicit consent to the use of cookies. Some online resources suggest that since GDPR states that consent must be explicit and revocable, that this also applies to cookies, rendering the "cookie banner" insufficient. Many sites use 3rd party libraries which will store cookies for tracking, such as Google Analytics. Additionally, other 3rd party libraries, such as AddThis, store tracking cookies which cannot be disabled. To prevent the storage of these cookies, AddThis and some other functionality would need to not be included on the site at all if the user hadn't opted in, which could affect functionality. It may also require a fairly significant investment of time. However, I don't see anything in the actually GDPR that relates to cookies in this sense. The application of GDPR to cookies seems to be based on independent interpretation. Does GDPR actually require a change to cookie banner functionality, or are current implementations sufficient?
The GDPR only mentions cookies once (Recital 30). (It says that cookies are personal data if they are associated with natural persons.) As far as cookies go, nothing has really changed since 2002, and the exception granted in the EU cookie directive Article 5(3) is still valid: This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. If your site complies with the 2002 directive today, it will be GDPR compliant. All the "EU Cookie Law Compliance" plugins I've checked out let the admin configure the site to comply with the 2002 directive, and most let you choose between implicit consent (which is, and still will be, OK if you or third party services do not use cookies for profiling or to collect personal data), soft consent, or hard consent. The latter is however mandatory if you or third party services use cookies to for profiling or to collect personal data. However, if at least one of your cookies are used for profiling (and if you use Google analytics, you are), or if they are used to collect personal data, the exception from explicit consent quoted above does not apply and implicit consent (i.e.: "continued use of the site amounts to implicit consent to the use of cookies") has never been legal for the site. So while nothing has changed since 2002, there is a lot of misinformation about cookies floating on the Internet, and a lot of sites have their cookie banners set up wrong. You may want to do a new cookie audit for your site to verify that you comply with existing legislation.
The basic requirements for the effectiveness of valid legal consent are defined in Article 7 of the GDPR and specified further in Recital 32. There is no form requirement for the consent, so using a button is not a problem. However, I do not think the MailChimp-button you reproduce as an example is good enough. It asks for a blanket consent to stuff that is buried in MailChimp's “Anti-spam Policy &amp; Terms of Use”. But according to the GDPR, what the data subject consent to can’t be buried in the ToU – it must spelled out in clear, plain language. Requests must be granular, asking for separate consent for separate types of processing. “When the processing has multiple purposes, consent should be given for all of them” (Recital 32). Blanket consent, as used by MailChimp, is not allowed. The other clear requirement from the GDPR is that opt-in is mandatory. Pre-ticked and opt-out buttons are explicitly banned: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent” (Recital 32). ‘No’ must become your data default, but if the user chooses to opt-in by clicking a button, this is valid consent. The MailChimp-button complies witrh this. The GDPR also requires you to keep a records of the consents given (so make that part of the user profile), and to withdraw consent at any time &ndash; so you make make provisions for that as well in your implementation of consent.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.
Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service? For your scenario a common answer seems to be that websites ask for the users first and last name during account creation. The reason is that they need this information to confirm the identity of the account creator. But the public profile only displays a user name that the user can pick freely. In general there is no good reason to publically show the legal names of users so websites don't do it. So for your website ask yourself, why do you want to publically show the names of your users? If you have a good reason to do that specify it in the user terms and go ahead. If you don't have a good reason don't do it.
GDPR will continue to apply to UK customers directly until the end of the transition period (31 December 2020): So, while the UK will no longer have any voting rights, it will need to follow EU rules. The European Court of Justice will also continue to have the final say over any legal disputes. Thereafter, the Data Protection Act 2018 will continue to apply (which itself applies "GDPR standards"). Six of one, half a dozen of the other.
There is no clear answer to this question. The GDPR doesn't not apply, but it delegates rules for processing in the context of employment to member states. That means, the laws in your country might override the GDPR here. As the data controller in this situation, the company must protect the personal data it processes, including the personal data of employees. Protection doesn't have to be absolute, just proportional to the risks. It may be fine to treat data in one context more carefully than another. This is always a judgement call of the data controller. There is nothing about holiday rotas where the GDPR would require them to be kept under lock. The company could very well decide that this data isn't very sensitive and that everyone can look at it themselves. For example, the company might argue they have a legitimate interest for this so that employees can see whether their colleagues are unavailable. But until the controller makes such a decision, the rota contains other person's personal data and cannot be disclosed without a legal basis. Here, I see three reasons why the company might be acting that way: They are overly careful with GDPR compliance and are cargo-culting restrictions that are not actually necessary. They have made a conscious decision to restrict access to this data to protect the private life of employees. They want to make it more difficult for employees to take time off.
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).