After the Brexit, can we store UK data in EU region? Can you please tell me, whether we can store PII data belong to UK in EU region? I know the other way round is illegal. But I could not find a place where this problem address properly. Can you please help me with this?
When personal data is transferred between the EU and UK, this is an “international transfer” (also called “restricted transfer” in ICO guidance). Transfers of personal data from the UK to the EU/EEA are easy since the UK has granted an adequacy decision to the EU (see Art 45 GDPR). Nevertheless, this must be disclosed to data subjects per Art 13(1)(f) GDPR. Transfers of personal data from the EU to the UK are different. An adequacy decision is still under negotiation, but is not guaranteed. As an interim measure, the Brexit trade deal says that transfers of personal data into the UK are temporarily not considered international transfers, so that no legal basis such as an adequacy decision is needed. This interim measure will expire after April, but will likely be extended to expire after June. If this temporary measures expires before an adequacy decision is in place, alternative transfer mechanisms such as standard contractual clauses (SCCs) have to be used. In a way, the temporary measure allows an extended transition period for putting SCCs into place.
I decided to rewrite this after the clarification in the comments. You can find the old version in the history. The question is not, actually, about a browser extension. It is about a web service that can be accessed by the browser extension. The way to access the service should make little difference, it could be clay tablets, homing pigeons, or this browser extension, what matters is the service. The service has two functions: Receive PII of the victim, sent by the customer, to calculate the probable email of the victim, and return this PII to the customer. The service operator could argue that the customer is really the data controller under GDPR rules, and that the service operator is only the data processor, but that is not a plausible use case. The customer would need to get and document the consent of the victim before the probable mail is calculated, so why would the customer pay the service operator for a service like this? There is already contact with the victim. Generate a database of specific company email patterns to enable 1. This would also use PII, from random employees of the company in question, and there is no customer to shield the service provider by pretending that consent was collected. The way around the first issue might be to sell the database and have all calculations on the customer's system, but that doesn't resolve the second issue, that of creating the database. This involves looking for patterns in PII of individuals, unless the target company is obliging enough to make the pattern public.
You asked about other jurisdictions. As you'll probably be aware (from cases like EU vs Microsoft and EU vs Google) European countries and culture tend to have much stronger protection laws for consumer and employee rights than the US does. In the UK you could make a strong case, although such cases are not often undertaken. The current legislation is Part 2 of the Consumer Rights Act 2015, but the unfair contract terms clause goes back to at least the Unfair Terms in Consumer Contracts Regulations 1999. Basically the law protects a person in a situation where disparity of size and bargaining power have led to unfair terms in a contract (typically a large company offering "take it or leave it" standard terms) - and specifically if they create a significant disparity in the parties rights and obligations. In such a situation the company which drafted the terms alleged to be unfair must show they are reasonable. A list of common terms likely to be seen as unfair is provided. (Employment terms are covered by other laws but also aim to prevent abuses due to inequality of contracting power) A company which sold a product like Windows 7/8/8.1 and then later said "we are changing our terms of support and forcing you to upgrade" (especially to a different product the user may not want, or a product that is maintained in a different way),would almost certainly be at substantial risk of falling foul of this. It wouldn't matter if it was done by not providing the support/patches as originally implied (by custom or normal expectation) or as agreed in an explicit statement of support life cycle, or by saying "we have the right under the contract to do this", or by forcing what is essentially a change of product to get the updates. It also wouldnt matter how big they are, nor whether or not the user had already agreed "because I felt I had no choice". The law is there specifically to protect against abuses like this, so it is drafted to catch companies who try to find "wriggle room".
In order to process data (which includes storing data), a data controller must establish one or more of the lawful bases contained at Article 6(1) of the UK GDPR. Briefly, those are: a) Consent of the data subject b) Necessary for performance of a contract with the data subject c) Necessary for compliance with a legal obligation d) Necessary to protect vital interests of data subject or another person e) Necessary for public interest or exercise of official authority vested in the controller f) Necessary for controller's legitimate interests Clearly a) and d) don't apply. As you've settled the debt, it seems unlikely to me that b) or f) apply. That leaves c) and e). A common example under c) would be a requirement by Companies House or HMRC to keep accounting records for a certain period of time. Some public bodies may also find it necessary, under e), to retain records which they need to be able to carry out their other functions. It seems highly unlikely to me that either of these would justify retention for your &quot;lifetime&quot; however. I would start by sending them a written demand to have your data erased under Article 17(1). Make sure you also specifically request that they provide you with all the information (and in particular the purposes of the processing) under Article 15(1), and that, in the event that they refuse to erase your data, they explain the reasons why pursuant to Article 12(4). Their response on these points will be helpful in establishing whether there is a lawful basis. Your next step after that is either to complain to the ICO or to apply to court for a compliance order under Section 167 of the Data Protection Act 2018. The former is free while the latter is not and carries risks of cost if you are unsuccessful. If you opt for one of these steps, make sure you cite the relevant provisions of the GDPR and explain why you think there is no lawful basis for the data retention (including by referencing any response you received from them). &quot;I have read GDPR guides on how to request erasure, but I don't really feel this applies- I want to have my account deleted, not the track record of the loan and repayment&quot; It doesn't matter whether we are talking about your account or your track record. What matters is whether the account constitutes personal data, which it almost certainly does, per the definition at Article 4(1): &quot;‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;&quot;
Per Art 3(2), GDPR only applies to non-European companies when their processing activities relate to the offering of goods or services to people in Europe, or when the processing activities relate to monitoring people in Europe. However, the word “offer” of this targeting criterion requires some level of intent. It is not enough for GDPR to apply that they're marketing to someone who happens to be in Europe, but GDPR would apply if they are intentionally marketing to people who are in Europe. I don't know what they are marketing, so I don't know if that would be the case here. Even if GDPR were to apply, it would not be the most appropriate law. Yes, there's the GDPR right to erasure, which applies under some conditions (though there's a pretty absolute right to opt-out from marketing). The EU's ePrivacy Directive provides more specific rules though, in particular that every such marketing email must offer a way to unsubscribe. Other countries have comparable anti-spam laws, potentially also the home country for this online service.
Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.) Under GDPR Article 6 the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service. Under GDPR Article 13 a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing (which the DC must define), who will receive the data, the data retention period, and various rights of the DS. Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests. Other GDPR provisions may well apply in addition to these, but that is enough to show that such service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU or the related market area.
Maybe, but probably not The geographic location of the organisation is immaterial: under Article 3.2: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ... (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Posts anyone (not just EU citizens) make to Reddit (or anywhere else) while they are physically located in the EU or UK engage the GDPR. Pushift.io is therefore captured by the GDPR and any denial of that is just plain wrong. Given the denial, it is likely right out of the gate that they are non-complient. For example, they are unlikely to provided the required information under Article 14. More importantly, it seems that they have not determined the lawful basis for processing the data under Article 6 - they can possibly rely on the public interest basis (preserving deleted publication is arguably a public interest) or a legitimate interest but that requires a balancing of their interest against the data subject's. That said, the right to be forgotten is not absolute, the reasons that might be applicable here are: The data is being used to exercise the right of freedom of expression and information. The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority. The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
Yes When personal data is processed in the context of an EU/EEA/UK establishment (for example, by a company with offices in the UK), then all these processing activities must fully comply with the GDPR, regardless of where the data subjects are located. For the UK GDPR: This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the United Kingdom, regardless of whether the processing takes place in the United Kingdom or not. For the EU GDPR: The GDPR applies to: a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or …