Right to personal data on youtube : what if account is banned Since GDPR at least we have the right to access and get the data we generated on websites like Facebook or Google (our history, likes, almost everything). My question is : what happens if Facebook or Google decides to suspend or ban your account ? Does it abolish your right to access your personal data ? Is it legal for them to suspend your right Thanks in advance,
No, a company cannot suspend your GDPR rights – contracts can't override the law. Your rights as a data subject apply as long as your personal data is being processed. However, there is no requirement in the GDPR that they fulfill your data subject rights through a self-service mechanism like a “download my data” button. They can require you to use another support channel. (But Google offers infamously bad support.) In some cases, the service may legitimately decide that they cannot give you access to the data, for example if they believe that you are not the actual data subject (e.g. if they think that you hacked the account). The right to access must not adversely affect other people (Art 15(4)). If they have doubts about your identity, they can require further information to verify you (Art 12(6)). If your requests are excessive or unfounded (if you are spamming them), they can also turn down the requests (Art 12(5)).
These documents constitute personal data and - in principle - you, as the subject, have the right to get a copy of them by issuing a "subject access request". The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (Art. 15 (3) GDPR) GDPR applies to controllers of any kind, including government organisations. The subject access request can usually be a simple email. The ICO has a template for this: https://ico.org.uk/your-data-matters/your-right-of-access/ (but keep it simple, you can literally just ask for "all personal data" they have on you; no need to speculate on what kind of data they may have). The subject access request is sent to the actual controller, but if you don't get a response to your request after 30 days, you can file a complaint with the supervisory authority (see here for Germany; note that federal institutions are supervised by the BFDI, not the data protection authorities of the Länder). Also note that you may have to go through some trouble to be properly authenticated by the controller. They do need to be certain that you are the data subject. There are also reasons why a controller can refuse to provide some or all of the information (e.g. if your request is clearly excessive or unfounded, if it's impossible to comply without violating another data subject's rights), but I would be surprised if any of those applied in your case. Your rights can also be restricted depending on the legal basis for processing. This includes rights that are illogical as well as some that provide special protection for processors: You can't object to processing based on consent (but you can revoke your consent), fulfilment of contract (but you can cancel your contract), a legal obligation on the part of the processor, or a vital interest (but you still have the right to erasure) Your right to portability and right to erasure does not apply if processing is based on a legal obligation or a public task (justice, parliamentary or government functions, statutory functions etc.) your right to portability also doesn't apply if processing is based on vital interest (e.g to protect someone's life) or legitimate interest of the processor. It is possible that processing all or some of your data was based on the performance of a public task, in which case they will refuse your request.
On the face of it, transcripts are derivative work covered by copyright (even if automagically generated). You are allowed to use them if the use is fair use or if you comply with YouTube's terms of service.
Probably not Now, some US constitutional rights do get interpreted very broadly, and it's possible this might be the case here too. But fundamentally, this situation is not equivalent to the security contractors example you mentioned. The crux is that Facebook already has every right to delete your posts for whatever reason they want. A security contractor does not have any intrinsic right to conduct searches (warrantless or otherwise) on your person, residence or effects. Facebook can choose, at their sole discretion, to delete all your posts, delete none of your posts, or delete some of your posts according to whatever metric they came up with. In this case, the metric is 'did the government flag this as misinformation'. The government isn't censoring you - Facebook is, and Facebook is allowed to do that (they happen in this case to be following the government's advice on what specifically needs censoring, but where they choose to get their advice is also purely their business). A security contractor, by contrast, can't do much of anything to you, except when they have been specifically deputized by the government to do so by some legal process. If this happens, then they are said to be acting 'under color of law', and suddenly First (and Eighth, etc) Amendment restrictions do begin to constrain their actions. Facebook is not getting any kind of state power delegated to them, and thus they aren't considered to be acting 'under color of law'. They aren't doing anything they were not already allowed to do.
Quoting content may or may not constitute copyright infringement, depending on the various factors that go into the fair use defense. Short quotes which are made for the purpose of discussion, research and commentary and not for copy would be squarely in the domain of "fair use" under US law. That means that the copyright owner would not succeed in suing you for quoting them: under the statutory mechanism for recognizing his right to his intellectual product, there is a limit on how much control he can exert over your behavior (since the two of you have not worked out some kind of agreement -- copyright law creates rights even when there is no contract). As for Facebook, you have a contract with them, embodied in the terms of service. You have been given permission to access material that they host (permission is required, under copyright law), and their permission is conditional. It says "you may access stuff on our platform only as long as you do X": if that includes a clause "don't be nasty", then that limits your right to speak freely and be as nasty as you'd like. If it says "don't quote even a little", that means you cannot quote even a little, even when you would have the statutory right to quote a little (or, to be nasty). Fair use would mean that you can't be sued for copyright infringement of the stuff that you quoted a little of. You can, however, be expelled from Facebook. You probably cannot be sued for "accessing Facebook without permission". There is a federal law against unauthorized access of computer networks, and there was a failed attempt to construe violation of a TOS as "unauthorized access" – it isn't. But accessing Facebook necessarily involves copying (that's how computers work), and there is no "fair use" defense whereby everybody has a fair use right to access Facebook. Theoretically you could be sued for copyright infringement, for accessing Facebook's intellectual property without permission. Also, Facebook can rescind your permission to access their content (see this case), and once you have been banned, it is a crime to further access their network. This assumes that there is no overriding limit on contracts that would nullify a no-quoting condition. There is no such limit on contracts in the US, so such a contract would be enforceable. There is also nothing illegal (unenforceable) about a TOS which prohibits automated methods of access.
GDPR seems quite clear that if you are recording calls, video and/or audio, you must get consent. Wrong. The GDPR requires that your have a legal basis for processing personal data. Consent is a legal basis but there are others. With respect to note taking, the GDPR only applies to “personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.” So, if they notes are not about an individual (and many B2B phone calls will not be) or are neither automated nor filed, the GDPR does not apply. If they are captured by the GDPR, you need to have a legal basis for the notes. Again, consent is one but it is not the only one.
You are right that a visitor of a website does not expect to be tracked upon opening the website. But when using Google Analytics configured in the way explained in my other post, the visitor is not tracked. At least not in a way which violates the GDPR. You worry about the cookies. I also found this article which also does and suggests to either: change the _ga cookie to a session cookie, so it will be removed when the browser is closed. To do this, set the Cookie Expiration variable in your Google Analytics Settings to 0. completely disable cookies. (GA does not require cookies). To do this, set the storage field to none: ga('create', 'UA-XXXXX-Y', { 'storage': 'none' }); If you do not disable cookies, cookies can be used for tracking, which is more general defined in the GDPR as profiling. Profiling is defined in Art. 4 GDPR as: ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; Art. 22(1) GDPR disallows profiling. Therefore in the settings menu from Google Analytics you have to disable data sharing and data collection. So data will only be used for the analytics function. But because you have configured to Anonymize your visitors IP Address, the part of the IP address used for this, is no longer considered personal data. This is because approx. 250 other users share the same part of the ip address which is stored, so data is not distinguishable between those 250 users. The anonymisation used by google is currently considered good enough. At least by the Dutch DPA. This might change if someone proves it is not good enough anonymized. Note that I am not a lawyer either, but I have read from multiple experts that analytics can be a "legitimate interest", the same way marketing can be a legitimate interest. This way configured the privacy impact is considered very low. It is also very important to note that a DPA consideres GA Google Analytics compliant. Even if a court would not agree in the future, you are acting in good faith if you follow those instructions, so you will probably not be fined. The DPA does currently not suggest to change the _ga cookie to a session cookie, or disable cookies completely. Note that the GDPR does not require doing anything to make it technical impossible to track someone. If a website has access to the data to track someone, but "promises" not to do that, that is fine. And rules regarding the usage of cookies in general, is not part of the GDPR, but (currently) part of the ePrivacy Directive. Only the way to ask for consent for storing cookies is defined in the GDPR.
Alice's business sells database management software. Organisations buy or licence the software, deploy it on hardware they control and use the software to help store and, process and analyse 'personal data' within the meaning of GDPR. Alice's business has no access whatsoever to the personal data being stored and processed by those organisations. In respect of that personal data, GDPR is not engaged by Alice's business. The business is neither a 'controller' nor 'processor' of that personal data. Who does the data protection law apply to? - European Commission Who does the UK GDPR apply to? - Information Commissioner's Office