What data processing requires opt-in consent for an existing customer under GDPR? I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where they offer money to refer new customers. I never explicitly gave my consent for any marketing purposes. If I am a customer and I have given my consent to be contacted for things like service availability and payment notifications, does this allow them to contact me for other reasons like this referral program? The company also says that their email and letter is not marketing material as it is not something that everyone will receive and it contains a code unique to me. This doesn't make any sense to me as it's clearly targeted advertising. If this is not allowed how can I make a complaint about their behaviour?
Recital 47 contains: The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. So even if you never explicitly gave your consent for any marketing purposes, they can send you marketing (e)mail. However, art. 21, paragraphs 2-4 contain: Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information. So you can object, and they must stop sending marketing mail. They should also have told you that you can object. And it does not matter how the marketing is presented. A unique code does not change anything (regarding the GDPR). Also, they are not allowed to add marketing to any mail you want to receive, like service availability notifications, after you have objected.
While German law indeed requires providing correct contact information it does not require the recipient to answer queries. It is there so that you can submit legal notifications. In your case I wouldn't be so sure that the information is not correct. However, even if the contact information is incorrect, there is not much you can do about it. This is reserved to the following groups by § 8 Abs. 3 UWG: every competitor; associations with legal personality which exist for the promotion of commercial or of independent professional interests, so far as a considerable number of entrepreneurs belong thereto, and which distribute goods or services of the same or similar type on the same market, provided such associations are actually in a position, particularly in terms of their personnel, material and financial resources, to pursue the tasks, under their memoranda of association, of promoting commercial or independent professional interests, and so far as the contravention affects the interests of their members; qualified entities that prove that they are entered on the list of qualified entities pursuant to section 4 of the Injunctions Act or on the list of the Commission of the European Communities pursuant to Article 4 of Directive 98/27/EC of the European Parliament and of the Council of 19 May 1998 on injunctions for the protection of consumer interests (OJ Number L 166 page 51); Chambers of Industry and Commerce or Craft Chambers. Unless you are a competitor you are out of luck. The hoster or other providers can't do anything and don't need to, as they are not required to check legality of their user's websites. It doesn't really matter where you are by the way for these laws.
The GDPR does not set fixed retention periods. Instead, it says data may not be kept for longer than necessary. What is necessary depends very much on the specific context of the processing activity, in particular on the purpose of processing. The GDPR allows retention for as long as necessary. For example, businesses (including financial institutions) are required to keep financial records. This requirement stems from EU member state law, which also sets specific retention periods. If a business wants to keep personal data in financial records for longer than this retention period, they can't just point to the law to authorize this processing – they must instead find a different purpose why they need to keep the data, and then find a suitable Art 6 legal basis. In some cases, retention periods might not be coupled to a fixed duration, but to certain events. For example, personal data for online accounts should typically be kept until the account is closed, which is potentially indefinite. This follows directly from the GDPR approach of limiting data storage by necessity, not by duration. All processing needs a clear purpose + a legal basis. In the context of a genealogy site, the site should analyze carefully what data they collect for what purposes. These purposes might enable potentially unlimited retention. But such processing must also be covered by a legal basis, and I doubt that the site would have a legal basis to make such storage irrevocable. If the data is collected based on Art 6(1)(a) consent, then the data can only be used as consented to, and consent can always be withdrawn in the future. If the data is collected based on Art 6(1)(b) necessity for performance of a contract, then the data can be used for compatible purposes in the sense of Art 6(4), but that would require a new legal basis (e.g. legitimate interest). If the data is collected based on Art 6(1)(f) legitimate interest, then the data can be used for Art 6(4) compatible purposes but the data subject has the Art 21 right to object to processing. While a genealogy site may have a legitimate interest in keeping supplied data in order to use it for future research, I think this is a fairly weak legitimate interest that can be easily overridden by an Art 21 objection, which in turn could require Art 17 erasure of the data. The genealogy site should also keep in mind principles like data minimisation and data protection by design and by default, so just keeping data for the off chance that it might be useful in the future is not GDPR-compliant. Data can only be collected and processed for “specified, explicit, and legitimate purposes”. The Art 89 privilege for research purposes also imposes conditions. There is a pretty big carveout in these GDPR requirements for archiving purposes in the public interest, scientific or historical research purposes, and statistical purposes. Specific rules for this exemption are given in Art 89 GDPR. The main value of this exemption is that Art 89 research purposes are always considered compatible with the purpose for which the data was originally collected (cf Art 5(1)(b)), though this might not cover data that was collected under the legal basis of consent (cf Art 6(4)). Other GDPR rules stay intact, and Art 89(1) imposes extra steps to consider: Special attention MUST be given to the data minimisation principle. If the research purpose can be achieved without identifiable data, the data MUST be anonymized. If the research purpose can be achieved with pseudonymized data, pseudonymization MUST be used. Appropriate safeguards MUST be implemented (though this just re-iterates the general requirement in Art 24). In some cases, the research purpose stands in conflict with data subject rights like the right to be informed or the right to object. If so, EU or member state law can provide exemptions from the data subject rights, but can also impose further conditions or safeguards. It is not possible to rely on the Art 89 exception without taking member state law into account. Art 89 does not modify necessity-based retention. Now on to the main question: how long can the personal data be kept for research purposes? While Art 89 research purposes allow us to extend the retention period because we have a new and compatible purpose of processing, it does not affect the general principle that data may only be kept as long as necessary for that purpose. In a scientific context, it would be common to preserve many data sets indefinitely for the purpose of enabling reproducibility of the scientific findings. A privately-run genealogy service might not benefit from Art 89. This “research” angle doesn't seem to be a good fit for a genealogy site. Such a site would typically not be collecting personal data for specific research purposes. At best, it would be operating as an archive of personal data which can be mined by future generations of researchers. But the GDPR specifically only considers archiving purposes in the public interest, which might not cover privately run archives. Archives rely on specific privileges in national laws, and severely restrict access to the information. For example, I'm leafing through the law on public archives in a German state. It forbids access for 10–100 years, depending on the date of death of the data subject and on the age of the documents. This leads me to believe that a privately run genealogy site cannot reasonably rely on the Art 89 exemption, and must instead rely on an ordinary processing purpose + corresponding Art 6 legal basis. This doesn't directly prevent indefinite storage, but means that it will be easy for a data subject to invoke their right to erasure. It is not quite enough to say “we will keep the data indefinitely”, it is also necessary to have a clear purpose for this retention.
Data can only be processed if there is at least one lawful basis to do so. The lawful bases for processing data are: the data subject has given consent to the processing of his or her personal data for one or more specific purposes. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. processing is necessary for compliance with a legal obligation to which the controller is subject. processing is necessary in order to protect the vital interests of the data subject or of another natural person. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. So unless you have some very compelling reason to need to process that person's data without their consent, you can't legally do it. Therefore it is hard to see how you could produce this "template", and even if you somehow did the person receiving it might not have a lawful basis for fetching (processing) that data anyway.
There is no requirement about "data" in the GDPR, so provided this is just "data", no. An empty form with fields for personal data contains no personal data. On the other hand, if the form is filled in by the user with personal data (as defined in GDPR article 4), and you receive a copy of the filled in form and process these personal data (as defined in GDPR article 4) - then the answer is: Yes. However, if you do not process the personal data (i.e. the form is just printed out on paper and filled in with a pen, and nobody except the data subject has access to the piece of paper with the filled in form - then the answer again is "no").
Don't collect or process personal data Many (though of course not all) websites can easily be run without collecting or otherwise processing any personal data. The position of GDPR is that if you are not able to fulfil the basic, simplest core conditions for processing personal data (understanding what you're processing and why and why it's allowed, describing it in a privacy policy, having a non-underage person who's responsible for that) then you are not allowed to process personal data of other people. So don't. Build your website so that any personal data are not collected.
The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities). According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be: for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"), proportionate ("it was the only possible way available"), and communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy). In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).
No. According to GDPR consent must be: Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement Scrolling down is not a clear, affirmative, specific or unambiguous indication of consent, and therefore does not fulfill the requirements for GDPR.