What global big tech does to comply with data protection laws all over the world? Give this scenario... A user in Germany, a user in US. Each one decides to create an account on Facebook and facebook is located in US... According with GDPR, US cannot store data from EU Citizens. So, what does Facebook do (or supposed to do) to comply with regulations? I am involved in a global project and we don't know exactly what to do in this sense. Can we have a single global server storing user information? If the answer is no: Can we have a single global server storing only usernames and passwords and all the other data such as first name, last name, phone number, etc be stored in each region? For this I suggested to my team: Let's try to find out what big techs are doing... What happens when Facebook, Apple, LinkedIn, etc earn a new user on the database?
What Big Tech is doing is spending a lot of money on lawyers and appeals – doesn't matter if it costs millions if you can make money in the meanwhile. Facebook stores a lot of user data in the US. Initially, this was allowed because the US was recognized as offering an adequate level of data protection under the Safe Harbor and later the Privacy Shield Framework. Then Schrems I and Schrems II happened and the adequacy recognition was ruled to be invalid. Does Facebook pull back their user data? No. The GDPR offers alternative reasons why you might process data in foreign countries, such as “standard contractual clauses” (SCCs) or “binding corporate rules” (BCRs). Now, Facebook claims that they are using SCCs. Is this valid? Almost certainly not due to the issues of US law analyzed in the Schrems II case, but it can take years for the next round of court cases to work its way through the system. And when Facebook's use of SCCs is ruled invalid they will probably try BCRs next, and once that is over a decade will have passed and the US might actually have achieved an adequate privacy level by then. You do not have Facebook-style money to spend on lawyers and endless rounds of appeals, so you should avoid legally risky things such as outsourcing data processing activities to companies in the US (this doesn't mean you can't be compliant if you are a US entity). I mentioned adequacy decision previously. There is a list of countries that the EU considers to be sufficiently safe. Currently, the more notable countries involve Canada, Israel, Japan, New Zealand, Republic of Korea, Switzerland, and the United Kingdom, in addition to EU/EEA countries of course. If you want to process data in a location that is OK for both the UK and the US, then looking at companies in one of these countries is a good idea. For example, if most of your users are in the US but you would like your servers to be in a country with an EU adequacy decision, then looking at Canada could make sense. Even outside of this list, you can process data if you implement additional safeguards via SCCs. However, this requires a case by case analysis of the legal environment in that country. One problem with the US is that it has national security laws that impose requirements on companies in a manner that is incompatible with SCCs. A company bound by these US laws cannot enter into such a contract where it guarantees the privacy of your user's data. Countries other than the EU have much more tedious data residency laws. The GDPR does not impose any data residency requirements in the sense that data must not leave a particular country – you just have to ensure that the data is properly protected. In contrast, Russia and China have real data residency requirements that are fundamentally incompatible with the GDPR.
Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea. If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution? Is it GDPR compliant that their answer to my deletion request is "We will delete the data..." The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”. You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.
The GDPR does not provide specific rules about password resets. However, the GDPR contains a general obligation for the data controller to implement “appropriate technical and organisational measures” (TOMs), see Art 24 + 32 GDPR. What is appropriate depends on the “state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity”. A password reset functionality is complicated from a security perspective. On one hand, such functionality is really good because it ensures availability of the service for the user. On the other hand, such features can provide a backdoor to the service, undermining security goals such as confidentiality and integrity. These aspects must be balanced, and there is not necessarily one correct balance for every scenario. What the one-person IT department of a small company does can reasonably be different from what a multi-million user social network does. TOMs do not have to be purely technical – they can also include organisational aspects, for example training for customer service employees, and occasional checks to ensure that customer service staff doesn't abuse their access. But nevertheless, TOMs must be measured against the state of the art. Password reset by sending a time-limited one-time reset link with a cryptographically secure nonce to an email address is a state of the art method, assuming that no 2FA/MFA is involved. In some contexts, having customer service staff assign a new, random, one-time password could also be appropriate, for example if implementing a more secure workflow would be prohibitively expensive. Then, organizational measures would be more important. Failing to notify the account holder that someone requested a password reset is not state of the art, and represents a possible security risk. The data controller is required to defend against such risks! Resetting the password to a fixed default value is a very grave security risk, since it could aid unauthorized account takeover by a third party. It is unlikely that such a password reset approach could be GDPR-compliant.
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
Can you anonymise people It is valid to anonymise the data of people, instead of deleting all of the records. The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. Source As long as the person is not identifiable, then you do not need to treat the data as personal under the GDPR. You do have to inform a person once they are no longer identifiable, and be able to identify them if they provide the missing information: If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification. Source The articles covered by this are: 15 - Right of Access 16 - Right to rectification 17 - Right to erasure 18 - Right to restrict processing 19 - Right to be informed 20 - Right to data portability
Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service? For your scenario a common answer seems to be that websites ask for the users first and last name during account creation. The reason is that they need this information to confirm the identity of the account creator. But the public profile only displays a user name that the user can pick freely. In general there is no good reason to publically show the legal names of users so websites don't do it. So for your website ask yourself, why do you want to publically show the names of your users? If you have a good reason to do that specify it in the user terms and go ahead. If you don't have a good reason don't do it.
The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data. GDPR does even apply to anything offline and on paper. Basically it means you have to validate any entry field is free of PII before processing it. Or make it clear in your privacy statement how you handle this use-case.
Let's assume that I created a mobile app for iPhone that is tracking rides on a bike [...] So the app is processing that data in the way I programmed it but I as a person do not have access to that data. I assume in such case I am not the data controller according to GDPR because I do not have access to that data is that correct? Yes, as far as I can see that is correct. The GDPR defines a data controller as someone who "determines the purposes and means of the processing of personal data" - you just provide a tool, you don't control for what purposes your customers use their ride data. This is also discussed in this question: How does the GDPR apply to software developed by one company and used by another? What if additionally to that I will program my app for example in such way that it will sometimes send current GPS coordinate to an online service controlled by external company such as Apple [...] But still my app would send this data directly to Apple server so I will still not have any access to that data. Does this change anything and does GDPR now apply to me? Yes, and yes. In that case, you are telling Apple to process data for you, so you would become the data controller (because you "determine[s] the purposes and means of the processing of personal data"), and Apple is a data processor for you. That means also the usual mechanisms kick in - you need to inform your users about this processing, you need to make sure Apple plays by the rules, etc. etc. I also do not know if Apple save this request on their servers or if they just automatically convert received gps coordinates to a name and return the answer without saving the request. This is exactly the kind of situation the GDPR is meant to address. Under GDPR, saying "I do not know what X does with the data" is not an option. This is something many companies tried in the past, that is why GDPR explicitly assigns responsibility to the data controller (i.e., you). As explained in a EU document, What is a data controller or a data processor?: The duties of the processor towards the controller must be specified in a contract or another legal act. For example, the contract must indicate what happens to the personal data once the contract is terminated. A typical activity of processors is offering IT solutions, including cloud storage. [...] So, no, you cannot just say "I do not know if Apple saves this request". Instead, you must make a contract with Apple which says whether (and how, and for how long...) they save the request, and you must inform your users about this in your privacy policy. And if Apple refuse to make such a contract with you, you must find a different company to work with.