Is there any restriction in the GDPR on creating a Whatsapp group? I work with an assistance entity that helps people in situations of social vulnerability (poverty). Surprisingly everyone has a cell phone and uses Whatsapp. Taking this facility into account, I thought of creating a group on Whatsapp and registering each number of these assisted people, to keep them informed of any news about the entity. However, I was warned if this could violate any GDPR terms. It is important to note that this would be a group where participants DO NOT SEND, they only receive our messages. Could anyone tell me if is there any restriction in the GDPR to create a Whatsapp group?
Certainly. A phone number is personal information (and on top of that, WhatsApp may provide some &quot;profile info&quot; from the people you contact). It is not difficult to identify a person by its phone number. So, sharing the phone number of the people affected should take into account the restrictions of GDPR. For instance, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) established in its Resolution R/03041/2017 that the Town Hall of Boecillo had violated the GDPR because it had created a WhatsApp group of citizens. Those citizens had provided their phone numbers to be informed about town hall activities, but they had not agreed to share their numbers with the other members of the group. And that was a very generic group. Doing a &quot;patients recovering from cancer&quot; or &quot;drug abusers under treatment&quot; or &quot;people who need food assistence&quot; group would involve sharing personal information that gets the maximum protection (in some specific instancies it could be that your information sharing that information is illegal even if the users gave you full consents). So yes, creating a WhatsApp group could very easily lead to a GDPR violation, and in fact it has been ruled at least once that it has. The fact that people cannot send messages is irrelevant. It would not make the issue any better or worse. After all, if I send a message through WhatsApp I am implicitly giving permission to everyone in the group to read it.
No, it is not legal. Regardless of their location, the only legal options for companies serving to EU residents are to either deny access altogether or to make consent truly optional1 Recital 42 states (emphasis mine): Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement[...] Recital 43 states: Consent is presumed not to be freely given [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. 1 Of course, remember that consent is only one of several means that allow them to process data. For example, if you were getting a trial account for a limited time, it would be considered a legitimate business need to ensure that you are not just opening new trial accounts when the old ones expire. So, if they wanted some data from you to ensure that you are not a previous user and you refused to provide it, then they could deny giving you that trial account without breaking the GDPR.
This very much depends on where you are. Different jurisdictions have wildly different laws about this. Some places are very permissive. You can record a conversation that you aren't even a party to so long as nobody has any reasonable expectation of privacy. In others, affirmative consent is required from every party to a conversation before it's legal to record it. The laws run the entire spectrum. Some places allow you to record anything you're a party to without permission, but you can't record others' conversations. Some places require you to disclose, but not obtain explicit permission. Some allow you to record but restrict who you can disclose it to. Some allow you to record or ban recording only under certain circumstances. It's a really wide gamut of laws. Since you don't say where you are, who you're recording, or why, there's no way to really answer the question. Here's a good rundown on the United States. This Wikipedia article covers lots of different countries, but only with regard to phone calls.
In the question, you write: The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file). No, it does not. To quote Miss Infogeek: GDPR DOES NOT MAKE CONSENT A MANDATORY REQUIREMENT FOR ALL PROCESSING OF PERSONAL DATA. Consent (Article 6 (1)a) is indeed one of conditions that can be used to comply with the GDPR requirement that processing must be lawful, but it is not the only condition available to the controller to ensure lawful processing &ndash; there are alternatives (before the list of conditions it says that "at least one of the following" must be satisfied). All the conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. One of alternatives are Article 6 (1)f. It says says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) As noted in the question, logging IP addresses for the purpose of security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. It is the default, and most (all?) web-sites do this. I.e. it is legal to do this without consent (if this is not the case, I am pretty sure the outcry had been heard all over the Internet by now).
There is no clear answer to this question. The GDPR doesn't not apply, but it delegates rules for processing in the context of employment to member states. That means, the laws in your country might override the GDPR here. As the data controller in this situation, the company must protect the personal data it processes, including the personal data of employees. Protection doesn't have to be absolute, just proportional to the risks. It may be fine to treat data in one context more carefully than another. This is always a judgement call of the data controller. There is nothing about holiday rotas where the GDPR would require them to be kept under lock. The company could very well decide that this data isn't very sensitive and that everyone can look at it themselves. For example, the company might argue they have a legitimate interest for this so that employees can see whether their colleagues are unavailable. But until the controller makes such a decision, the rota contains other person's personal data and cannot be disclosed without a legal basis. Here, I see three reasons why the company might be acting that way: They are overly careful with GDPR compliance and are cargo-culting restrictions that are not actually necessary. They have made a conscious decision to restrict access to this data to protect the private life of employees. They want to make it more difficult for employees to take time off.
I believe in this case, your company (OrgX) is a data processor and your customer's organization (OrgY) is the data controller. OrgY is responsible for establishing a lawful basis for sending you (OrgX) the personal data for their employees. Note that consent is just one of six lawful bases outlined in article 6(1). I'm no expert, but I believe OrgY's admin can claim they have a legitimate interest in sending their employee's personal data for training sake. In either case, the data processor is not responsible for establishing the lawful basis for processing. Of course, data processors aren't completely off the hook. GDPR outlines specific requirements for data processors (see chapter 4, particularly article 28).
It is not an either–or. You may have certain rights under both CCPA and GDPR, but they have rather different mechanisms for determining their scope. When does the CCPA apply? CCPA applies to certain businesses and consumers. It covers any business (regardless of legal structure) that that does business in the State of California and has a certain scale. A consumer means a natural person who is a California resident. These aspects are not influenced by your current location. When you as a California resident travel to the EU, you still have all your CCPA rights against businesses that do business in California. You do not have any CCPA rights against businesses that don't do business in California, for example a national rail company in the EU you've bought a train ticket for. When does the GDPR apply? Whereas the location of the user/data subject can be a factor in the GDPR context, their residency or nationality does not. The GDPR applies to all processing activities by data controllers who are established in the EU, including any businesses, non-profits, and individuals. This includes processing activities in the context of an EU establishment of a non-EU company. For example, GDPR would apply with respect to processing of personal data by a hotel you're staying at in the EU. The GDPR also applies to non-EU data controllers in the context of (a) offering goods or services to people who are in the EU, or (b) monitoring behaviour of people who are in the EU. Here, “offering” does not mean “doing business”, but “targeting or marketing”. For example, you might have installed a smartphone app that assists with sightseeing while in Paris. If this app monitors your behaviour while you are in the EU (such as by tracking your GPS position to alert you to nearby points of interest), that would fall under the GDPR while you are in the EU. The app may also fall under the GDPR per case (a) if it is marketed to / targeted at people who are currently in Paris. That the GDPR applies in such cases comes from the offering/monitoring while you are in the EU, not from your continued presence in the EU. You would be able to exercise your GDPR rights relating to this processing even after leaving the EU. Note that some service or processing activity can fall under CCPA and GDPR simultaneously. For example, this app would also fall under CCPA if the company also does business in California, e.g. if it also provides sightseeing information for Los Angeles or San Francisco. And both CCPA and GDPR could apply when an EU company does business in California. Under which privacy law would a deletion request be dealt with? In practice, most companies don't have this sorted out properly and results are unpredictable. Ideally, a company would just comply with both laws simultaneously, thus making it unnecessary to determine which law applies. Information that is only required under on law can be provided with conditional statements, e.g. “If this processing activity is covered by GDPR, you have the right to lodge a complaint with the supervisory authority in your country”. As mentioned above, both laws can apply simultaneously. Whether GDPR applies and whether CCPA applies are independent questions. However, the answer to neither of these depends on your current location at the time of making the request. In this answer, any statement about the EU applies equivalently to the UK.
Among other things, GDPR regulates what you may do with the data within your systems. You can use it for the contracted purpose, or in accordance to law, or with informed and revokable consent, or for some other enumerated purposes. Even with consent, you have to take security measures to avoid the misuse of the data. Remember the software shrink-wrap licenses? &quot;By opening the package, you agree to the terms inside.&quot; GDPR makes the equivalent in the cloud world impossible. You have to document exactly what you do with the data, and for any use that is not necessary to perform the service the customer can opt out. In the scenario you describe, it is possible that you are not the data controller under GDPR but the data processor, and that you have a duty to keep the data from separate controllers apart. And delete any batch at the end of contract. If you want to do this professionally, you need to consult a lawyer for your specific plans.