I live outside of Europe. If I gain e-Residency in Estonia, will I be protected by GDPR regulations? Are people who gain an Estonian e-Residency treated as a European citizen under upcoming GDPR regulations?
Whether or not you are protected by GDPR depends on the location of both yourself and the party processing your data. Citizenship and residence statuses are completely irrelevant (Recital 14(1)): The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence If the party processing your data is established in the EU, then you are protected no matter who you are or where you are (Art. 3(1)): This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. If the party processing your data is not established in the EU, then you are only protected if you are in the EU (Art. 3(2)): This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union
Alice's business sells database management software. Organisations buy or licence the software, deploy it on hardware they control and use the software to help store and, process and analyse 'personal data' within the meaning of GDPR. Alice's business has no access whatsoever to the personal data being stored and processed by those organisations. In respect of that personal data, GDPR is not engaged by Alice's business. The business is neither a 'controller' nor 'processor' of that personal data. Who does the data protection law apply to? - European Commission Who does the UK GDPR apply to? - Information Commissioner's Office
It depends. Can the data controller or another person, with &quot;means reasonably likely to be used,&quot; (see clause 26 of the preamble of the GDPR) use that data alone or in combination with other data to identify a natural person? If yes, it is personal data within the meaning of the GDPR. If no, it is not personal data within the meaning of the GDPR. Anonymous data is not subject to the GDPR. &quot;The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.&quot; Assigning an unique alphanumeric code to a thing does not necessarily make the code and/or the thing &quot;personal data&quot;. But if you have a set of data that is or can be linked by the unique alphanumeric code (e.g. as a primary key in a set of tables) and you can use it to identify a person, then it is personal data. Either way, to be GDPR-compliant / to mitigate risk you should make some kind of record to reflect that process of thinking and what you decided. And if the answer is Yes, it is personal data, then you should record your &quot;lawful basis&quot; for processing the data and how you decided that.
I don't believe GDPR makes a distinction between 'real life' and 'online'. It's all real life. You can tell anyone that they don't have consent to keep your personal data, but that doesn't mean they always have to delete it. There are six lawful bases for processing of personal data, so if an organisation is using and can justify one other than consent then they don't necessarily have to delete your data when they ask. The six bases are listed by the UK Information Commissioner's Office: (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/#ib3
As you, the data controller, are from the EU, all your processing activities must comply with the GDPR, regardless of where the users are from. Since the EU–US Privacy Shield was invalidated in the 2020 Schrems II decision, it is no longer straightforward to use US-based services as your data processors. You have a variety of options to consider. Accept the ~77ms latency from an EU data center. This is the easiest solution from a compliance perspective. Depending on the application, this really might not be a problem. Use services based in a nearby country that is covered by an EU adequacy decision, such as Canada. E.g. the AWS Canada-Central region near Montreal is about 10ms away from NYC. Digital Ocean's Toronto region is about 20ms away. I would choose this approach if you're very concerned about latency and want GDPR compliance with reasonable effort. Handle non-EU data processing activities through a non-EU subsidiary entity. However, that entity would have to actually determine the purposes and means of processing. Setting up a non-EU office with non-EU staff would be costly. You couldn't work remotely for that entity from within the EU without defeating its purpose. Sign standard contractual clauses (SCCs) that serve as a legal basis for data processing activities in the US, after performing an analysis that indicates that the specific concerns as in the Schrems II case do not apply in your case, and potentially after identifying and implementing measures such as end-to-end encryption as explained by the EDPB Recommendations 01/2020 on supplementary transfer measures. Most companies end up relying on SCCs, since otherwise the use of US-based services is impossible. But it's doubtful whether the necessary analysis has been properly performed. The supplementary measures suggested by the EDPB are sometimes feasible in specific use cases (e.g. encrypted backups), but are generally impossible to fulfill for typical cloud services. So even though this is a popular option, it comes with substantial risk for your compliance efforts.
a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already been a rule to follow Sometimes the question who is responsible for privacy information might not be that easy to decide when you're on platforms. I take this situation as being pretty clear though. You are basically given a blank slate, you can do with that page whatever you want, and the visitor has no clue whatsoever that it might be hosted by Github. In addition to this, Github would be classified as a data processor (providing the tool) and you as the data controller who is in charge of practically everything except for the provision of the page. I hope this helps. Btw. it's not that hard anymore to write a privacy policy these days.
Yes, but ... It doesn’t protect you. Let’s imagine you put such a clause in and a person in Europe used your service notwithstanding: they’ve broken the contract but you’ve broken the law. You get the fine and they get ... nothing. Because you can’t contract outside the law you never had a valid contract with them so you have no basis to sue. Further, because you are purporting to something you can’t legally do, you are probably on the wrong side of misleading and deceptive consumer protection law: which is another fine. If you can ensure that you don’t breach local law - like by not operating over the internet - then you can choose not to deal with e.g. Europeans. If you can’t guarantee that, then you’re stuffed.
No. Refusing to tell the address alone is not a reason to detain somebody. But there are situations where the authorities can demand that a person identifies himself or herself, including such details as the address (or lack of a permanent residency). In such a situation, failure to identify yourself can get you locked up. Also, the tone of your posting seems to question the legitimacy of the UK government and legal system as a whole. That is a box you're putting yourself into, and the company you find there is not very pleasant.