Penalties for requesting GDPR data you are not entitled to Looking at Accessing public CCTV footage about you I could see a scenario where a stalker might request GDPR data &amp; footage on a person they are stalking who has passed the camera. So, imagine actress A regularly walks past Millionaire M's house which is plastered with CCTV directed at both the house and the surrounding streets. Stalker S (pretending to be A) makes a GDPR request to M for all footage of A, giving an approximate time &amp; date of one sighting of A. What are the legal penalties to S for making this request or in successfully getting the footage? Is this just standard fraud or are there specific GPDR penalties involved and has anyone ever been prosecuted?
There are no direct penalties per GDPR. The data controller must make sure that the person making the request is the data subject, or at least authorized by the data subject. If the controller has reasonable doubts about the identity, they should request additional information for identification purposes. The controller must find a middle ground between violating the GDPR by rejecting a potentially valid request and violating the GDPR by disclosing data to potentially unauthorized recipients. Having reasonable technical and organization measures that prevent unauthorized disclosure is part of the controller's responsibilities per Art 24. What the data controller can do is to block future requests from the alleged stalker. When a request is “manifestly unfounded or excessive, in particular because of their repetitive character”, then the controller can charge a reasonable fee or refuse to act on the request (Art 12(5) GDPR). But it's up to the controller to prove that the requests are unfounded or excessive, it is not possible to reject potentially valid requests on sight. Depending on what the alleged stalker does with the obtained data, they would fall within the scope of the GDPR themselves and would probably be violating it because there is no sufficient legal basis. Also, the alleged stalker, as a data controller, would be required to inform the data subject about subsequent processing of the data per Art 14 GDPR. Attempting to obtain another person's personal data through an access request would have to be punishable by other laws. For starters, such attempts would likely involve identity theft, and successfully obtaining the data would probably be a kind of fraud.
There is nothing in the GDPR requiring you to collect individual personally identifiable information. If the website has no need, and the website owner no desire, to collect such information, there is no requirement to do so. The GDPR requires that if such information is collected, that there is a lawful basis, and that it be handled appropriately and stored securely, and deleted when there is no longer a need to retain it, or on a proper request. If no such information is collected in the first place, all the rules about how to handle it do not apply. It is possible that some law of an individual country in the EU might mandate collection of some particular information, but I have not heard of any such requirement.
I spent a few years working in and around the Energy industry - including a stint working at a supplier, I'm no longer there so unfortunately I no longer have access to the email chains I had discussing this with legal. The consensus at the time was that a "traditional" i.e. non-half-hourly (NHH), non-smart meter reading itself was not considered personal data - they are conceptually tied to a metering point (which may or may not be a physical meter), not to an individual and don't represent an individual's energy consumption (the granularity of the reading is insufficient to tell anything about the usage profile) But this information, while all around the implementation of GDPR it was a couple of years back and to be honest it was bugging me that I might be out-of-date on the current practices so I reached out to a former colleague who was the Data Protection Officer at the supplier I worked at to try and get a more up-to-date take. He's since moved on but was there until recently so has more experience with the topic since GDPR actually went into effect. I asked him whether a) estimated opening reads were considered "personal data" and b) what would happen with a request to change one under article 16 and he had this to say, I've translated industry-speak in square brackets: a) for NHH ["Non Half Hourly" - meters that are read ad-hoc, essentially all non-smart domestic meters will be this] an estimated reading wasn't personal data automatically until the billing flag was set in CRM and those would be the only ones we'd include on an SAR [Subject Access Request], any others are internal data not personal. HH ["Half Hourly" - meters for higher consumption users, typically larger business premises are billed on increments for each half hour so have readings for each] and remote [smart meter] readings are always personal for domestic and microb [micro-businesses are a certain class of non-domestic energy customer see condition 7A] b) erm no! we'd only change it if the value in CRM didn't match the value in the D10 [industry Data Flow used to transmit meter reads] for some reason. if they match it's an accurate representation of what we estimate the reading to be so it's just a vanilla billing dispute not a data protection issue so i'd have punted it to [name of person who was head of metering] From that it would sound as though the estimated read would count as personal data - so long as it's being used for billing purposes, but that doesn't mean they have to accept your read in it's stead. It all comes down to accuracy - GDPR requires that personal data be "accurate" but provides no definition as to what "accurate" means (which makes sense since you can't give a one-size-fits-all answer that isn't an encyclopedia) and while The Electricity Directive 2019 confirms the need for accuracy in billing again it doesn't tell us what that means. The implementation is left to member state regulators. In the UK this is OFGEM and all opening meter readings are validated through third parties (so you don't end up with the foxes guarding the hen house!) and are calculated using the following formula: Last validated reading for the meter point &lt;= supplied reading &lt;= (expected daily usage x number of days since last validated reading x 2.5) where "expected daily usage" is obtained from a database maintained by the regulator - it's calculated off meter type, property type, property use, previous validated reads etc. So if the customer provides a reading that falls outside the above the supplier can (and in practice invariably will) reject it as being inaccurate. Now this is why the when a meter reading is provided matters - reads you provide are always assumed to be the read on the day you give them. With opening reads there's some leeway, I can't remember the official rule on how much but usually they give you up to the next estimated read is generated but more on that later. Now if the reading you're trying to submit is a "now" reading and it's failed the validation criteria and you aren't happy with the rejection you can force the issue by demanding the supplier come read the meter. You don't say how long has passed since the opening read - more than the week from what you've said so presumably at least a month (guessing you've had at least your first bill). Now if they are saying the opening read was X (based on the estimated usage) and you're it should have been X + Y and the current reading is X + Y + Z you want to pay your actual usage Z not Y + Z. What you need to do is dispute the opening read, which you're entitled to do, arguably GDPR of Article 16 gives you this right, but on it's own it's a weak argument. There's established means by which an estimated read's "accuracy" is determined and assuming they followed that they're going to just tell you that as far as they are concerned it is accurate. Any challenge to that accuracy is going to have to be done within the legal/regulatory frameworks for assessing accuracy, that's what they're there for, if they won't accept your reading escalate that to the regulator - and as soon as you can. OFGEM for example allow disputing of opening reads for 12 months - it doesn't have to be resolved within that 12 months it just has to be lodged with them within that time. If you try and use the GDPR angle to pursue this IMHO it's going to muddy the waters and not help you get what you need - pursue this on billing accuracy.
Term 1 isn't going to hold up, but that is not a GDPR matter. It's just a matter of basic consumer protection law in the EU. You can't offload responsibility for your mistakes. Looking at 2, Dale M. already pointer out that it's now how the GDPR works. You are the Data Controller. X,Y and Z are Data Processors. Article 28(1) of the GDPR is in direct conflict with your disclaimer. You accept zero responsibility, the GDPR says you are fully responsible. That's the exact opposite.
Since the Steam ID contains or may contain enough information for it to be possible to link your account to you as a physical person, it would definitely be considered "personal data" according to Article 4 of the GDPR. However, by agreeing to the DOTA2 terms of service, you have given consent for them to show your information to other players (or at least that is included in most terms of service I have read for other games. I have not read the one for DOTA2 specifically). Replays are an interesting corner case. If download of replays are only possible for other players or if the wording of the ToS says that you consent to displaying your user ID to anybody, that would mean that they would have covered their bases. As long as they comply with other parts of GDPR, like "the right to erasure" (Article 17) that is. If the API is accessible to anyone and not covered by the ToS you might have a case. If you only want to remove the traceability between you and the replays, you can always evoke Article 17 and delete your account.
An app(lication program) is software run on the end-users machine. That does not fall under the GDPR. Any processing (including storage) you do on user data has to be compliant with the GDPR. Allows a user to authenticate via e.g. Facebook and stores some basic data (optional) Authentication via Facebook leaves GDPR compliance to Facebook (AFAIK). It would be a good idea to provide alternative authentication methods, such as Google and an "own account" user name and password so that the user doesn't have to share information with a multinational company in order to use your service. The "basic data" will need to be processed according to the GDPR. As long as the "optional" part is "opt in" (i.e. the user needs to at least click on something) then this means you have permission to process that data. Providing this "basic data" as a JSON or CSV file should meet data portability requirements. Allows a user to upload a GPX file (a route or some other activity) Stores the above file to Google's database Allows the user to analyze that file. Since the user is actively choosing to upload each file you have permission to do this. You should make it clear in your privacy policy that the data will be held by Google. Doing so should not be a problem as Google has set up the legal framework to do this under the GDPR. You don't have to store the information encrypted, but you should use encryption (e.g. HTTPS) for any data transmission. Allowing the user to analyse the file is not an issue; either the user is doing it on their own machine (GDPR irrelevant) or you are doing it under user instruction (meaning you have consent). Since the user has uploaded GPX files they already have data portability on those files. You should tell your users that while you will employ best endeavours you don't promise to keep their files accessible and they should maintain their own private copies. That way if your entire database gets corrupted they can't blame you for loss of data. Finally, make sure there is a "Close my account and delete all my data" option.
As per this question &amp; answer, in the US there is no expectation of privacy in public places (not to be confused with private places where public is allowed e.g. supermarkets). Photos taken in public belong to the photo taker and he/she is free to use them in whatever way. No privacy is violated here. The fact that the person whose photo was taken was a celebrity does not change anything. It would have been completely their fault to expect privacy in a public place and behave rashly.
To preface my answer, this aspect of UK law is unclear at best and I try to set out general principles where available. If you are acting in a private sphere, then the recording of conversations are unregulated, however this is only for personal use – i.e., should you desire to make notes on what was said for your reference at a later date. Should you wish to share it with a third party, then you would need consent from all participants or be able to demonstrate that it would be in the public interest. If you are acting as an employee or a company, then the situation changes. Firstly, you need to check your contract, whilst this does not constitute a crime, it may be against the terms of your employment. Secondly, a company can only make recordings without knowledge under statutory conditions, such as to establish facts, ensure regulatory compliance or demonstrate standards that are achieved or need to be achieved by training. It is a general principle that conversations recorded without consent are inadmissible in court, particularly in terms of a criminal proceedings. In civil matters, it similarly follows the concept that a claimant should come to court with clean hands. However, judges are usually more pragmatic in civil cases and if parties are aware of the existence of the recording, then it often be subject to usual rules of disclosure, though this may open the creator of the recording to subsequent litigation regarding the illegality of the recording under Data Protection Act or others.