What are the types of personal data? In the GDPR, the concept of data categories is used and examples of such categories are given. The concept of data types is also used, but I do not know what they are. Example of data categories, Article 9(1), "Processing of special categories of personal data": Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. So what are the types? Article 28(3): Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor:
The "type" is the specific nature of the data to be processed For example: name, date of birth, ID photograph, address, email, description, etc.
GDPR killing genealogy websites? I could see GDPR totally killing genealogy websites if they follow the rules strictly, but would they really want to do that. Seems to me genealogy has an important historical role. Treat living persons with anonymization I assume you don't have data to identify a person or contact the living person. How would you contact to get consent to show personal information if you only have a name, impossible right? GDPR tries to stop abuse of personal data, yes, and your family tree certainly is personal data. However those who come to your website would mostly want to search and edit the non-living, search back in the history, thus the current generation follows the family tree and are not the point of entry. You can provide certain anonymization to those alive by not displaying the first names in full, maybe just the first letter. You may want to hide address, spouse, children for current generation. You could make those available for view/edit first by going through a secondary login, "not a robot". Further you may remove living people from search results and hide from search engines so they do not have ability to index the current generation. That would make it harder to abuse if you're going after an individual, but at the same time doesn't lock out the people providing information.
Storing medical data in cloud services can be legal, but isn't necessarily so (as with any other kinds of data). The GDPR considers health-related data as “special categories” of data per Art 9. Processing such data is forbidden, unless an exception applies. Per Art 9(2)(h) such processing is allowed when it is […] necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 Paragraph 3 requires that processing under 9(2)(h) only occurs under the responsibility of someone who is subject to an obligation of secrecy per Union or member state law, e.g. a doctor. Paragraph 4 allows individual member states to add further conditions, including limitations, to such processing. Assuming that electronic storage or processing of health data is in fact necessary, the GDPR does not make a strong distinction between in-house processing, and processing via Data Processors. Of course, the usual conditions for using data processors and performing international transfers apply. However, a data controller processing medical data will almost certainly have to first perform an Art 35 Data Protection Impact Assessment. This DPIA must consider various risks. Transferring data into third countries is risky. Using data processors is risky. But processing data in-house can also be risky, so using an external service could improve things. There is a lot to be balanced here. Where the planned processing has high risks, the responsible supervisory authority has to be consulted first (Art 36). The authority can provide “advice”, or even ban the processing per Art 58.
This is clearly personal information (PI) , and indeed personally identifiable information (PII). and so is Personal Data under the GDPR. Under Article 6 of the GDPR any processing must have a lawful basis. There are 6 possible bases. The most likely ones here would be (a) consent, or (f) legitimate interst, but the private association may claim some other basis as well. They should tell you what basis or bases justify their processing of this information, which includes storing it and publishing it. Under Article 13, Paragraph 1(c) the association should have informed you of the purposes for which information was collected when it was first collected. Under Article 15 paragraph 1 you are entitled to request and obtain from the association (or any other Data Controller) a statement of what PI about you they hold. along with this they must supply various other information including; (a) the purposes of the processing; (b)the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; and other specified information. Article 17 paragraph 1 provides that: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ... if one the the specified conditions applies, particularly: 1(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; 1(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) Article 21 paragraph 1 provides that: The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Thus I would suggest that you send a written communication to the association, stating that you: Request access to all PI which they have about you, as permitted by GDPR article 15 paragraph 1; Request that they delete any such information from the public website and any other publications, as permitted by GDPR article 17 paragraph 1; State that you object to further processing of this information under GDPR article 21 paragraph 1; Request information on the name and contact info of the relevant supervisory authority under GDPR article 15 paragraph 1; State that you expect these requests to be complied with promptly, in no event later than 30 days. Mention your prior request for the public info to be deleted, and that several months have already elapsed. Give the exact date of the prior request. I would suggest sending these requests, together in a single email, specifically mentioning the relevant GDPR provisions. I would suggest sending a copy of this by registered mail, and retaining a copy, along with the identifying number of the registered letter. In the letter, mention the email. If the association does not promptly respond in a way you consider satisfactory, you may wish to file a complaint with the relevant data protection supervisory authority. You may also wish to consult a lawyer with experience in this area to determine if you have any legal recourse if the association does not comply.
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. That is not correct. According to GDPR Article 2: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. This Regulation does not apply to the processing of personal data ... ... (c) by a natural person in the course of a purely personal or household activity; GDPR Recital 18 states in relevant part: (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. Personal data that is not processed by &quot;automated means&quot;, for example data which is transmitted verbally, by hand writing, or by manually sent email, is not covered by the GDPR. Data which is used by a natural person for &quot;personal activities&quot; is also not covered. Consulting one's personal lawyer might well be a personal activity unless it is a business matter. Even if such a transfer of data were in scope for the GDPR, consent of the data subject (DS) is not the only available lawful basis. GDPR article 6 permits any of several possible lawful bases to be used, particularly paragraph 1 point (f) which reads: (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Also possibly relevant is point (c) which reads: processing is necessary for compliance with a legal obligation to which the controller is subject; In short, providing one's personal lawyer with the names and addresses of relevant people in connection with a legal issue is not at all likely to be prohibited by the GDPR, nor to require the consent of the people whose names and contact info are provided. However, a comment by user PMF reads: The Data Protection laws are mostly for companies, not for individuals. This is an overstatement. The laws do apply to natural persons as DCs, although enforcement is largely targeted at businesses, particularly large, for-profit businesses.
Consent for processing someone's personal data is only one of the possible requirements to process that person's personal data. The options listed in Art. 6.1 are (text in Spanish, with links to other languages): a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; c. processing is necessary for compliance with a legal obligation to which the controller is subject; d. processing is necessary in order to protect the vital interests of the data subject or of another natural person; e. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Obviously, your case meets the criteria for c.1 So, you do not need consent from your hosts, and your hosts do not have to sign any consent and they cannot refuse to provide their data if they want to reside at your dwelling. The moment you ask your hosts any data to which you do not have a legitimate interest, you need the consent. And you cannot refuse hospitality to your hosts if they do not want to provide that piece of data. Anyway, maybe it would be a good idea to print a leaflet explaining why you require their data in case they have any doubts. 1 For the Guardia Civil, it would be c. and maybe a few more cases.
Articles 13 and 14 discuss what information must be provided to the data subjects, for example via a privacy policy. Art 13(1) requires: (a) the identity and the contact details of the controller, and where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; The quote you have shown contains both the identity and contact details (postal address) of the representative, and the contact details (postal address) of the DPO. This seems to comply with the letter of the law.
Yes When personal data is processed in the context of an EU/EEA/UK establishment (for example, by a company with offices in the UK), then all these processing activities must fully comply with the GDPR, regardless of where the data subjects are located. For the UK GDPR: This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the United Kingdom, regardless of whether the processing takes place in the United Kingdom or not. For the EU GDPR: The GDPR applies to: a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed; or …