How much can the GDPR be amended by EU member states in their national laws? Citing article 8 of the GDPR (emphasis added): Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years. So member states can define a different age, even though the GDPR says that it should be 16. But is this an exception? Are there any other exceptions? Must these exceptions be explicitly stated in the GDPR? I'd like to understand to what extent the GDPR must be followed by member states, and to what extent it could be amended in national laws.
Note that the answer to most of your questions has nothing to do with the GDPR specifically, but has to do with the legal force that an EU Regulation has. Here's a related answer on EU Regulations vs. Directives. That said, here are my answers to your specific questions: So member states can define a different age, even though the GDPR says that it should be 16. But is this an exception? Yes. Are there any other exceptions? Yes. Scanning the Regulation for instances of "Member State" is a good way to find them. In my opinion, the biggest area of the GDPR where Member States have influence is Article 6, "Lawfulness of Processing". In some circumstances, it allows Member States to specify what could be considered a lawful basis for processing. Must these exceptions be explicitly stated in the GDPR? Yes. As a Regulation, exceptions must be explicitly stated in order to be permissible because Member States have no authority to overrule EU law*. I'd like to understand to what extent the GDPR must be followed by member states, and to what extent it could be amended in national laws. "Amended" is a fuzzy term. It can mean adding, changing, or removing from the law. Unless otherwise specified, Member States could not change or remove provisions, but there could very well be additions consistent with the GDPR. *Some Member States dispute this statement when it comes to constitutional issues.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
U.S. law does not forbid 15 year olds from joining dating websites. Direct U.S. regulation of Internet communications mostly via the Children's Online Privacy Protection Act (COPPA) has a cutoff age of 13 years old. This said, nothing obligates websites to allow minors to join their dating app, and they may be reluctant to do so for fear that if you are mistreated by someone as a result of the app that they could be held responsible. In particular, amendments to the Communications Decency Act (CDA) called FOSTA-SESTA for the &quot;Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA) and &quot;Stop Enabling Sex Traffickers Act (SESTA)&quot; which took effect April 11, 2018, limited the prior near total protection from liability under Section 230 of the CDA. The amendments maked it illegal to knowingly assist, facilitate, or support sex trafficking, and amended the Communications Decency Act's section 230 safe harbors (which make online services immune from civil liability for their users' actions) to exclude enforcement of federal or state sex trafficking laws from immunity. Federal sex trafficking laws largely apply to commercial sex by people under the age of 18, which an online dating app could facilitate, if used by someone inclined to use it in that manner. The two main federal sex trafficking laws are as follows: Section 1591 now provides in part the following: “Whoever knowingly in or affecting interstate or foreign commerce, or within the special maritime and territorial jurisdiction of the United States, recruits, entices, harbors, transports, provides, obtains, advertises, maintains, patronizes, or solicits by any means a person; knowing, or in reckless disregard of the fact, that means of force, threats of force, fraud, coercion ... , or any combination of such means will be used to cause the person to engage in a commercial sex act, or that the person has not attained the age of 18 years and will be caused to engage in a commercial sex act,” shall be imprisoned not less than 15 years (not less than 10 years, if the victim is 14 years of age or older and the offender is less than 18 years of age). The Mann Act outlaws prostitution and unlawful sexual activities that involve interstate or foreign travel. It consists of three principal substantive sections. Section 2421 proscribes the interstate or foreign transportation of someone for purposes of prostitution or unlawful sexual activity; misconduct which is punishable by imprisonment for not more than 10 years. Section 2422 condemns coercing or enticing another person to travel in interstate or foreign commerce to engage in prostitution or unlawful sexual activity, or using interstate communications to coerce or entice a child to engage in such conduct. The communications offense is punishable by imprisonment for not less than 10 years; the travel offense by imprisonment for not more than 20 years. Section 2423 outlaws four distinct offenses: (1) §2423(a) - transportation of a child in interstate or foreign commerce for purposes of prostitution or unlawful sexual purposes; (2) §2423(b)—interstate or foreign travel for purposes of unlawful sexual abuse of a child; (3) §2423(c)—foreign travel and subsequent unlawful sexual abuse of a child; and (4) §2423(d)— arranging, for profit, the travel outlawed in any of these offenses. The first is punishable by imprisonment for not less than 10 years, each of the others by imprisonment for not more than 30 years. So, the reluctance of a dating app to allow minors to use their services is understandable. They either need to aggressively police a low cost or free except for ad support service with considerable employee expense to do so, to avoid the risk of FOSTA-SESTA authorized liability, or they can not offer the service at all. In a nutshell, the app providers consider you to be jail-bait and don't want to face the associated risks.
I don't believe GDPR makes a distinction between 'real life' and 'online'. It's all real life. You can tell anyone that they don't have consent to keep your personal data, but that doesn't mean they always have to delete it. There are six lawful bases for processing of personal data, so if an organisation is using and can justify one other than consent then they don't necessarily have to delete your data when they ask. The six bases are listed by the UK Information Commissioner's Office: (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/#ib3
&quot;Age of consent&quot; is a legal meme that refers indirectly to different criminal statutes, for example in Missouri under MO Rev Stat § 566.034, A person commits the offense of statutory rape in the second degree if being twenty-one years of age or older, he or she has sexual intercourse with another person who is less than seventeen years of age §023 also states that &quot;It shall be an affirmative defense to prosecutions under sections 566.032, 566.034, 566.062, 566.064, and 566.071, that the defendant was married to the victim at the time of the offense&quot;. MO Rev Stat §451.090 allows marriage with parental permission to those aged 16 and 17 (by prohibiting licensing of marriage to those younger) No recorder shall issue a license authorizing the marriage of any male or female under sixteen years of age nor shall a license be issued authorizing the marriage of any male or female twenty-one years of age or older to a male or female under eighteen years of age. Combining these legal parts, you get the result that a man may marry and impregnate a woman whom he could not legally have intercourse with (irrespective of pregnancy) were they not married. It just depends on what the specific law says.
The material scope of the GDPR (Article 2) is limited to the processing of personal data (including mere storage) by automated means or as part of a filing system. The question of whether your activity falls within this scope hinges on what you actually do with the data once you take possession of it. You have mentioned saving the contact information of people you have met at conferences, which could refer to simply retaining it for later use, or to the technological process of storing data in a computer. The former, if not done in any structured way (a filing system) would not fall within the scope of the GDPR. The latter, even if poorly executed, such as a photo stored on a business smartphone or a text document thrown onto your workstation's desktop, would always fall within scope as computerised data is processed &quot;by automated means&quot;. When the contact information you receive identifies a specific person, as distinct from just a corporate switchboard number and company name for example, it is personal data. When you get that personal data from the person it identifies (data subject), and you're otherwise in scope, Article 13 is invoked, requiring you to provide a list of information, &quot;at the time when personal data are obtained&quot;, unless &quot;the data subject already has the information.&quot; This is known as the right to be informed. The requirements differ when personal data are not obtained directly from the data subject. I would argue it is unreasonable to be expected to provide the information to the data subject over a cup of coffee or in a quick business card exchange, but if you start entering it into a spreadsheet or your CRM, you need to provide the required information, which may be as simple as a follow-up email thanking them for their time and letting them know you'll keep their contact details on file, along with a link to your organisation's privacy policy, assuming it covers this use, or if not, a specific privacy notice. You will of course be required to comply with other requirements such as the principles of data minimisation and identify a lawful basis, maintain adequate security by implementing technical and organisational measures, hold contracts with any third parties who process personal data on your behalf, and have a process for upholding data subject rights and responding to requests to exercise them - among others - but you should already be doing that for your other processing activities unless exempt. Additional information Edits have been made as clarifications and questions were forthcoming. Email marketing You need to consider the applicable country's implementation of Directive 2002/58/EC as amended (&quot;ePrivacy Directive&quot;). For example, in the UK you could send such messages without consent to contacts at incorporated companies or public sector bodies, but would have required consent for sole traders, private individuals, or partners in an unincorporated partnership. In Ireland, you have an exemption to consent for existing customers who were offered the opportunity to opt out when their email address was collected, but must use the email address for marketing within 12 months. Each EU country will have a different implementation of the Directive. In the Netherlands, Article 17 of the Telecommunications Act implements Directive 2003/58/EC and thus provisions for direct marketing by email. Processing by automated means Processing by automated means refers to processing of personal data in electronic, rather than manual form. All electronic processing is within the material scope of the GDPR, while only manual processing that forms or is intended to form part of a filing system is. Recital 15: The protection of natural persons should apply to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system. Art. 4(2): ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means ICO guidance What is personal data?: The GDPR covers the processing of personal data in two ways: personal data processed wholly or partly by automated means (that is, information in electronic form); and personal data processed in a non-automated manner which forms part of, or is intended to form part of, a ‘filing system’ (that is, manual information in a filing system).
It means places that would fall under the EU laws and rules by treaties and things like that. For example, a consulate. The GDPR also applies wherever EU Member State law applies by virtue of public international law. The Recitals provide a single example: a diplomatic mission or consular position. While that case is limited, the rule in public international law established by the Permanent Court of International Justice in Lotus is that a country has any extra-territorial jurisdiction it claims so long as there is not a public international law rule prohibiting the assumption of jurisdiction. Thus, the EU potentially could expand the GDPR scope in the future using this provision. https://www.wileyrein.com/newsroom-newsletters-item-May_2017_PIF-The_GDPRs_Reach-Material_and_Territorial_Scope_Under_Articles_2_and_3.html
So far as I can see, no US law required an airline to demand written parental consent for a passenger aged 17 in 2004, nor does any law requires such consent now. A passport could probably have been required. Minors in general may make and enforce contracts, including those for purchase of travel services. Parental consent is only required for a few specific activities, and air travel does not seem to be one. The question asks &quot;Was I liable at 17 or 18...?&quot; Liable for what? There is no liability unless there is wrongdoing or negligence or at least harm to someone. I don't see what there was to be liable for here, so there is no reason to try to determine who was liable. Had a law been violated, it would make sense to ask who was criminally responsible, but apparently none was. If no one was harmed there is no civil liability. I am not clear why the OP thinks there was a legal problem. Nothing in the question indicates that there would have been.