Data deletion requirements I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it. I never provided them my passport data before (as passport section on my profile is empty) and I feel that's quite unreasonable request - if they really want to confirm it's valid request they can just do email verification as most other sites would do. In the end my goal is for them to have less of my data not even more. My question is - can they really require scan of my passport on data deletion request? I'm citizen of Poland living in the UK (as that probably matters for GDPR and similar).
Per Art 12(6), they are allowed to ask for additional identify verification: where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. Additionally, Recital 64: The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. There is no consensus regarding what this means in practice: Must the controller use all measures that they can be reasonably be required to use? Or only those measures to verify the identity to a reasonable level of certainty? I agree with you that asking for a passport is excessive, and that email verification would be sufficient. However, that is just my personal opinion. The GDPR can also be interpreted in a way that asking for a copy of your passport is OK. Where they process a copy of your passport, that is personal data as well. You also have data subject rights with regards to this processing, for example the right to be informed of the purpose of this processing and of when the data will be deleted. If it is only used for the purpose of verifying your identity, the copy of your passport should be deleted immediately afterwards. The data controller may have additional obligations because a passport or ID card is a very sensitive document. E.g. Art 87 allows member states to impose additional rules. Most sensible controllers will therefore want to avoid processing passports, unless they only operate in specific EU member states.
GDPR does not cease to apply because of the location of data storage. It applies based on the location of the data processor, data controller, and data subject. If you are in the EU, you are a data subject covered by GDPR. It does not matter where the data are stored. Note that you are asked to confirm that you're aware that US laws may be less protective, but you're not asked to acknowledge that anything about the arrangement causes the "laws of your country/region" not to apply. The company also does not seem to be claiming that they don't apply, although it seems that they want you to think so, and it's not clear whether they think so. You are correct that GDPR doesn't allow its protections to be waived. A data subject may always consent to certain processing, and some processing may be performed without consent, but it's not possible to waive the right to withhold consent for processing that does require it.
The US doesn't do exit immigration checks, so if your hypothetical Israeli overstayer can board a flight out of the US, they'll most likely be allowed to go without detention or other punishment. The US sees no value in spending government money to detain someone who is ready to leave of their own accord. I'm not sure why such a person should have &quot;no valid documentation&quot;. Maybe you're confused by the common term &quot;undocumented&quot; for people without legal immigration status, but it usually doesn't literally mean they have no documentation at all. Most such people would still have their passport and other identification from their home country, and the passport is enough to board a flight back home. You say your hypothetical Israeli overstayer had a visa; so they must have had an Israeli passport when they entered the US. Under normal circumstances, they've still got it. If it expired, they could have renewed it at an Israeli consulate within the US; the consulate will issue passports to all Israeli citizens without regard to their immigration status in the US. Even if somehow they lost their Israeli passport and all other identity documents, the consulate would have the ability to verify their identity from Israeli government records (e.g. the photo and biometrics from their previous passport, which would still be in the Israeli government's database), and process their application for a replacement passport.
There is a lot going on in this question, so I'll pick out some individual aspects. Last but not least, I'll discuss if GDPR even applies. Does the GDPR require consent for X? Almost always, no. Consent is only one of many legal bases of processing. A common alternative to consent is a “legitimate interest” where a balancing test is performed between this legitimate interest and your interests, rights, and freedoms. Consent is typically only appropriate if this balancing test fails, for example if you would not reasonably expect this processing activity to occur. It's worth noting that it's a reasonably common occurrence that businesses are sold or merged. This is not unexpected. In general, you would not be required to consent to such a transfer. What can a company do with personal data acquired through a merger/acquisition? The GDPR does not provide explicit provisions for this case. But it might be useful to think about the two cases where (a) the new company is a continuation or successor of the original one, and (b) where the data is transferred (“sold”) to an otherwise unrelated company. In case (a) where the business is continued as normal, there is no change. In case (b) where data is transferred to a separate company, things are more complicated. The original company would need a legal basis for transferring the data. But as mentioned above, there might be a legitimate interest. Arguably, such a transfer could also be based on Art 6(1)(b) if the transfer is necessary to continue to provide the service, for example if the original company would otherwise have to terminate service. Of course, activities like data brokering where access to data is granted to unrelated third parties would generally fail to be covered by contractual necessity or a legitimate interest, and would probably need consent – but that doesn't seem to be the case here. When a data controller (such as the new company) acquires your personal data from sources other than directly from you, then they are subject to the notice requirements in Art 14. They have to actively notify you about their processing activities. But because you received emails that mentioned the transfer, this condition might have been met. Of course the new company continues to be bound by the purpose limitation principle as detailed in Art 6(4) – they can only use the data for purposes that are compatible with the purposes for which the data was initially collected. Thus, the new company cannot arbitrarily widen processing purposes, though some change in scope is certainly permissible. How does the GDPR right to object and to restrict processing apply here? The Art 21 GDPR right to object means that if the legal basis for a processing activity is a “legitimate interest”, then you can ask for an opt-out. But in some cases, this objection does not have to be granted. An objection essentially requires the controller to repeat the legitimate interest balancing test, taking into account the “grounds relating to [your] particular situation” that you provided in the objection. The Art 18 GDPR right to restrict processing is an alternative to the right to erasure. It applies only in narrow circumstances, for example while an objection is being checked. It is likely that you were informed about the transfer to a new company about 1 month in advance, so that you would have been able to prevent this transfer by closing your account prior to the deadline. If the new company conducts processing activities based on a legitimate interest, then their presumably GDPR-compliant privacy notice about which you were notified will certainly explain that you have a right to object. Is the new company GDPR-compliant? That is impossible to tell, but nothing you've shown so far indicates that they're non-compliant. My largest issue with this story is that the new company is from Australia, a country with extraordinarily bad privacy protections (as of 2022). However, due to the way how the GDPR treats international transfers of data, this doesn't prevent Australian data controllers from being GDPR-compliant, although it does make it difficult for other companies to use services based in Australia. Does GDPR even apply? Whether GDPR applies to a non-European company depends only on whether they either offer goods or services to people who are in Europe (“targeting criterion”), and whether the monitor people's behavior that takes place in Europe. Factors such as your citizenship would be irrelevant. I'll ignore the monitoring criterion, and focus on the targeting criterion. I'll assume that you are in Europe (EU/EEA or UK). Whether a company is targeting people in Europe depends primarily on the company's intentions. It does not matter whether the service is accessible from Europe. Thus, it is quite possible that the original company was not subject to the GDPR. Then, any questions about GDPR, consent, and data transfers are moot. In contrast, the new company clearly mentions GDPR-compliance, which would only matter if they intend for people in Europe to use their services. So GDPR probably applies to them, giving you the full suite of GDPR data subject rights as (hopefully) outlined in their privacy notice. And as long as they notified you that they acquired your personal data in accordance of Art 14, I don't seen anything that they might have done wrong in respect to this acquisition/merger.
You do not have to prove that you are an EU citizen, because EU citizenship is entirely irrelevant to the GDPR. Have a look at Article 3, which basically says that GDPR applies if you are in the EU or if the company is in the EU. If the company is in the EU, therefore, you do not need to send them anything or prove anything about yourself to invoke GDPR. If the company is outside the EU, you can send proof of address or other evidence that you are in the EU, which might be something that they already have, like your IP address.
No. According to GDPR consent must be: Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement Scrolling down is not a clear, affirmative, specific or unambiguous indication of consent, and therefore does not fulfill the requirements for GDPR.
From ACRO's Subject access - further guidance web page: Why do I need to supply proof of ID? We need to be confident that we provide your personal data to the correct person, which is why we ensure we have sufficient proof of identity before we disclose any information. It also helps us to ensure we make a correct match on the PNC. As for this proof of ID (personal data) provided when submitting a Subject Access Request, ACRO's Privacy policy states: We gather information about site usage to help the development and improvement of services to the public, and to protect the integrity of our systems from malicious users. At the moment this information consists of: Statistical information obtained using Google Analytics. No information collected can be used to identify individual users. For more details about how this affects your privacy please visit the Google Analytics Privacy Centre. If you don’t want to send information to Google Analytics, an Opt-out Browser Add-on is also available or you can configure your browser to let you to choose which, if any, cookies are allowed to be created. Information obtained by our content management system to examine what people are searching for, what they find and occasions where no results are returned. Information collected can’t be used to identify individual users. Information provided by users through online forms; it's held in our UK-based secure data centres and is retained in line with the Data Protection Act 2018, the General Data Protection Regulation (EU) 2016/679, and our retention policies. However, I have not been able to locate publicly available copies of the retention policies referred to in the emboldened text.
It doesn’t make you exempt from the GDPR if that’s what you’re asking The hash you produce is linked to one (or a small number) of computers and it therefore serves as an ID number. Because that ID number is linked to the owner of the computer it is personal information and if you are collecting it, you must comply with the requirements of the GDPR - valid legal reason, deletion when no longer required, deletion on request, data security etc.