Why is my GDPR (a.17) request not fulfilled? For over a year, I'm trying to get &quot;wordpress.org&quot; to delete my personal data from their bugtracker (the pseudonym is linked to my full personal address). According to https://wordpress.org/about/privacy/ The website states GDPR compliancy and appropriate rights are theoretically granted. There is no legal or even practical reason not to (at least) anonymize the data in question. No payments or contracts are involved. Until today I have written about 7 mails to 4 different receivers including but not limited to the address listed in the above privacy statement, starting from August 2019. Without any reply at all. I tried opening tasks in their bugtracker and request information about the legal holder of the domain or a contact who may be able to fulfill my request. All my requests have been blocked and deleted immediately - even one of my domains has been blocked completely. Wordpress is putting preasure on avoiding me as hard as possible even tho I have written most polite messages and acknowledging integrity of their systems. What could I possibly do now to get my data erased or anonymized?
If a data controller fails to fulfil your data subject rights, lodge a complaint with your data protection authority. In Hamburg, the appropriate form is here. However, they are not required to investigate your complaint. Independently from a complaint, you could consider suing Wordpress for compliance – Automattic has a subsidiary in Ireland so this might actually be feasible. I'm not quite sure though that Automattic is indeed the data controller for wordpress.org, as opposed to the .com domain – the privacy policy isn't quite GDPR compliant. While your GDPR Art 17 Right to Erasure might not apply in this case, there's a definite GDPR violation because the data controller failed to respond to your request within a month as per Art 12(4). That your posts on the bugtracker were deleted doesn't look like an issue in this context, what does matter is that they didn't respond to emails to the addresses mentioned in their privacy policy. Whether you have a right to erasure depends on the legal basis for storing your data. In general, you have a right to erasure if: the data is no longer necessary; processing is based on consent (because you can always withdraw consent); or processing is based on a legitimate interest and they have no overriding legitimate grounds to continue processing despite your objection (Art 21). The data is still necessary to identify you for your actions on the bugtracker, but depending on your particular situation you may be able to object successfully and force them to anonymize your posts.
I believe in this case, your company (OrgX) is a data processor and your customer's organization (OrgY) is the data controller. OrgY is responsible for establishing a lawful basis for sending you (OrgX) the personal data for their employees. Note that consent is just one of six lawful bases outlined in article 6(1). I'm no expert, but I believe OrgY's admin can claim they have a legitimate interest in sending their employee's personal data for training sake. In either case, the data processor is not responsible for establishing the lawful basis for processing. Of course, data processors aren't completely off the hook. GDPR outlines specific requirements for data processors (see chapter 4, particularly article 28).
The GDPR applies to such sites if they offer services in the EU/EEA. If they clearly wanted to avoid being subject to the GDPR, they should block visitors from the EEA. For the GDPR, only location matters. Other concerns like residence or citizenship are generally irrelevant. Personal data does not turn non-personal just because it was public. So the GDPR still applies when the data was collected from public sources. However, the data controller (who determines the purpose of processing) often has to balance your rights and interests against other interests (e.g. when using legitimate interest as a legal basis for some processing). For the purpose of publicly displaying your data, only showing data that was already public anyway makes it easier to argue that this is fine. But when the GDPR applies, you have data subject rights. Relevant rights include: a right to access, to see all the data they have about you a right to rectification, to correct wrong data they hold about you a right to restriction, effectively an opt-out a right to erasure (also known as the right to be forgotten) These rights apply both against the website and against Google Search (arguably, both are doing the exact same thing). Google correctly points out that they can't remove information from the Web, but they can hide information from search results. If you feel that your requests have not been resolved correctly, you can issue a complaint with your country's data protection authority. In theory you can also sue them. In practice, GDPR enforcement against overseas data controllers can be quite difficult and has not yet happened.
Cookies are information stored on the end users device and require consent¹ per the ePrivacy directive, even if the cookies or similar technologies don't contain personal data. Conditions for consent are defined by the GDPR. This was also confirmed by the &quot;Planet49&quot; case. 1. consent is required unless the storage of or access to information on the end users device is either strictly necessary for a service explicitly requested by the user, or necessary for technical reasons. E.g. functional cookies like a shopping cart feature in a web shop are fine, as are cookies used solely for security purposes or technical features like TLS session resumption. It is however likely that this cookie does qualify as personal data in the sense of the GDPR. The cookie contains an ID that lets you single out/distinguish this user from all other users, even though that ID doesn't link the user to a real-world identity. It is also possible to argue that the cookie is entirely anonymous, but the safer approach is to treat it as personal data. Similarly, other features of the website necessarily involve the processing of personal data, such as processing the user's IP address, if only for the purpose of responding to their HTTP requests. The GDPR's criteria for valid consent are mainly about ensuring that the consent is a freely given unambiguous indication of the data subject's wishes. For example, consent can never be the default, it needs to be an opt-in. However, Art 7(1) GDPR says that the data controller has the burden of proof of showing that valid consent was given. The GDPR itself does not provide further guidance on what this means specifically. I would argue that it can be decomposed into two aspects: Showing that valid consent was given. The manner in which you ask for consent must enable a free choice, and must respect that &quot;no consent&quot; is the default. For example, you could archive screenshots of the cookie management flow to show that there is a free choice. You could archive the frontend software so that it can be demonstrated that the cookie is not set until consent is given. Showing that this user gave consent. There is a wide variety of opinions on how to do that. My personal opinion is that the existence of a cookie paired with a valid consent flow to set that cookie demonstrates that the cookie can only have been set in a valid manner. However, there are consent management solutions that provide additional insight, such as the user's entire history of giving and revoking consent. For example, the user's browser might generate a pseudonymous ID enabling that user's consent history to be stored on some server. Indeed, that would be personal data, and this would have to be disclosed transparently. It would not be valid to use the consent management information for other purposes, for example by using the consent management ID for analytics purposes. Storing the user's consent history is definitely appropriate if you have a concept of identity, such as for signed-in users. I have doubts whether this is also helpful on websites that don't have user accounts, and I have not heard of a case where the existence of such records made a difference. After all, such records can only be relevant if the user gave consent but later disputes this in a complaint with a DPA or in a lawsuit. Which approach to choose will depend on more specific guidance provided by your country's data protection authority, and on the risk balance appropriate for your business. After all, the purpose of such compliance work is not to be 100% safe from lawsuits, but to reduce risks from enforcement/litigation to acceptable levels. What is acceptable is ultimately a business decision. E.g. the only 100% safe way to do web analytics is to have no analytics at all, but that is not acceptable for most businesses.
Any processing of personal data needs a legal basis, for example necessity for some contract or legitimate interest. If no other legal basis allows the processing, you need to acquire consent. Consent must be freely given. If something is gated behind consent without that consent being really necessary, this might coerce users and they would not be able to consent freely. The GDPR does not have a hard ban on this, but it explicitly calls out that this case must be considered when determining whether consent is valid. So what your company is trying to do is in a dark grey area. Not necessarily wrong, but likely so. Consent could be made free if users have an actual choice. For example, some online newspaper sites had success with a “pay or consent” wall. (Success in the sense that some data protection authorities allowed this). In your case, this could mean that users either consent to extra data collection, or that they buy some reasonably priced premium mode. But none of this is for you to decide. You can voice your doubts that the software would be compliant. You could also ask if the Data Protection Impact Assessment document for this proposed processing is available (creating such an assessment is likely mandatory in this case). But in the end, it is the company's obligation to be compliant, and this responsibility is largely shouldered by the company's data protection officer (to whom you can turn with further questions).
There is nothing in the GDPR requiring you to collect individual personally identifiable information. If the website has no need, and the website owner no desire, to collect such information, there is no requirement to do so. The GDPR requires that if such information is collected, that there is a lawful basis, and that it be handled appropriately and stored securely, and deleted when there is no longer a need to retain it, or on a proper request. If no such information is collected in the first place, all the rules about how to handle it do not apply. It is possible that some law of an individual country in the EU might mandate collection of some particular information, but I have not heard of any such requirement.
Do I need to inform the user about storing the score locally? No, there is no need as long as you don't transmit, store or process any personal info. It's doubtful that the score could be considered personal info, but you're not sending it to your servers in any way, so you don't seem to be processing it anyway. Do I need consent for using non-personal AdMob? You have to check this with AdMob, but usually, if it is non-personal, they shouldn't be processing any PI, so you're clear without informing. Do I need to ask for the age? How should I handle kids? Again, you're not processing any PI, so regarding GDPR there isn't any problem. Can I disallow a user from using the app if consent is not given? If you needed consent, no, it would be unlawful to block a user for not giving consent, unless it is impossible to provide the service without it. See recital 43: Consent is presumed not to be freely given if [...] the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
How can I truly say that I 'consent' to data collection and processing when I am coerced, so to speak, by the threat of failing my courses if I do not use this novel software? There is no need for you to "consent". Consent is just one of the reasons that allows a data processor to collect your data. There are other reasons that allows the data processor to capture your data. In this case, it seems of application the "legitimate interest clause", as it is in your university's legitimate interest to capture your activity in order to evaluate you. Of course, that covers only the data collected that is relevant to that interest. They will certainly capture your identity and your answers, they may log your sessions and may try to gather some data to detect if you are somehow cheating, but they would not be allowed to check which are your favorite pornhub videos because that is not relevant for the university's legitimate interest. Art. 6 of the GDPR states: Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This page also provides some in-depth analysis