GDPR and hotlinked images: are they allowed? By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent: Your IP A cookie The URL you are visiting (the URL of this question) Your user-agent (typically including OS version, browser version, etc.) The time when you first saw this picture (header: if-modified-since) This can definitely be personal data according to the GDPR, and in practice in most cases it is. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; That data is sent somewhere automatically. Did you see any privacy policies? Did you accept anything? No, you don't know how that data will be used. Of course it could be sent to a stupid random website, that will never use it for anything. Or it could be sent to a big corporation, or to a content delivery network, or any website that is big enough to be able to track you with this data, because they have a lot of services (or just hotlinked images) around spread all over the web. Note: the data is actually sent to Imgur, which I believe would definitely be able to track you, given the huge amount of pictures on the internet that link to them. I've always seen people mainly worried about third-party assets (Google Analytics or Facebook buttons, etc.), some also began to worry about Google Fonts (that's a third-party asset too actually), but I don't think anybody ever brought up the issue of hotlinked images. That's third-party stuff. And communities like this one are basically allowing users to embed third party assets. Who's responsible for this? Is it the user's fault, because they should always make sure the image source complies with the GDPR? I doubt it. The website owner's fault (Stackexchange), because they should not allow hotlinking? I'd say yeah, probably. Or the third-party website's fault, for not complying with the GDPR? I'd say no, for all we know they could be based in a country that doesn't even know what the GDPR is. So my conclusion is that hotlinking should be treated like loading a third-party asset, and if the website owner cannot check the privacy policies of every hotlinked image (for example because it would be impossible in a community like this one), then unsupervised hotlinking should be disabled because the GDPR does not allow it. Am I wrong?
You don't need to get consent to comply with GDPR Lawfulness of processing Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Sending a http request to a website falls under 6(1)(f).
The site would combine the data in novel ways, which is processing the data. Processing personal data which is publicly available is still processing personal data. You would have to take GDPR into account. That does not mean the processing is forbidden, but you need a legal basis for doing it. In many ways, having the informed consent is the easiest legal basis, but there are others. The data subject would have the right to demand information about the data you hold, and to demand the correction of wrong data. There is not necessarily a right to demand deletion, but if consent is withdrawn and you have no other basis for data processing, you have to delete. Note also that the consent basis would mean you have to actively contact the people whose consent you seek before the processing starts, and document how you do it. That makes pay-per-request models difficult. But consider that the news media can process some data about some people without the consent of the subjects of their activities. They just need to balance privacy and other legitimate interests all the time.
Yes, you can use such eye tracking if you obtain consent in a suitable manner. But obtaining consent is going to be very difficult for you. The processing activity in question occurs within the context of an EU establishment of the data controller. Thus, GDPR applies regardless of where the data subjects are located. Under GDPR, any processing activity needs a clear purpose and a legal basis. Typical legal bases are necessity for performing a contract with the data subject, legal obligations, a legitimate interest, or consent. Conditions for consent are listed in Art 7 GDPR. Once your have a purpose that is covered by a legal basis, you can collect the minimum data necessary to achieve the purpose. For example, let's assume that the purpose is a scientific study for which gaze tracking is necessary. The study's subjects can be informed about the context of the study, about how the data will be used, and can then be asked for consent for proceeding. Of course, participation in the study is only possible when consent is given. This is perfectly fine as far as the GDPR is concerned. But things might be more difficult when data is used for a different purpose, for example in order to track user interests in a web shop. You do have a legitimate interest in optimizing the website, but this interest likely doesn't outweigh the user's privacy interests. Legitimate interest always requires a careful balancing test. If the user cannot reasonably expect the data collection to happen, that is an indication that consent would be a better legal basis than legitimate interest. Accessing a camera feed means accessing information stored on the end user's device. Per the ePrivacy directive, this requires consent regardless of whether the information in question is personal data. Cookies, mouse pointer tracking, or eye tracking with a camera are all equivalent in this regard. Consent must be specific, informed, and freely given. It is an unambiguous indication of the data subject's wishes, and must involve some clear statement or affirmative action. Prior to starting the eye tracking, you must provide sufficient information about what is happening, and must make it possible to easily decline consent. You cannot bundle unrelated consent together (e.g. eye tracking consent + cookie consent). You cannot make access to a service conditional on unrelated consent. E.g. a web shop does not need camera access, but an augmented reality does. Still, consent must be specific so consent for AR purposes can probably not be used to authorize eye tracking, which might need separate consent. Browsers do not grant camera access by default, and instead show a permission dialogue where the user can allow access or block further requests. This permission dialogue cannot replace your compliance obligations such as providing the necessary information so that the user can make an informed choice. Since GDPR requires that consent is freely given and can be declined, you might find it difficult to convince anyone to give consent to this fairly invasive tracking procedure. You might be able to incentivize consent e.g. with small discounts on a web shop, but the incentive must remain small enough that there really is a free choice between giving or declining consent. The EDPB has issued guidelines that are relevant to your scenario. These guidelines are not law, but are well-reasoned official interpretations that are frequently cited by courts. Guidelines 05/2020 on consent Guidelines 3/2019 on processing of personal data through video devices Practically speaking, I doubt you will find eye tracking to be useful. First, you can likely achieve your purposes through less invasive means. Recall that the GDPR only allows you to process the minimum data necessary to achieve a purpose. Second, eye tracking is difficult for technical reasons. Bad lighting and weird angles make it difficult to obtain a useful feed. Cameras might be in different positions relative to the browser window, so that the eye tracking would have to be calibrated before acquiring data. Eye tracking typically involves processing the video feed on the user's device, but this is computationally expensive that will make the website unusable on lower-end devices, in particular mobile devices. And of course, many PCs don't have a camera in the first place.
First of all, although the GDPR is stated to apply to any site which processes the data of any person who is in the EU, it is not clear how a site not located in the EU, does not business in the EU, and does not primarily target EU residents as its audience can be required to comply with the GDPR. To the best of my knowledge, no such case has yet been brought, much less decided. There has also been some debate on whether an IP address constitutes Personal Data under the GDPR, and if it always does so, or only under particular conditions. The European Court of Justice (ECJ) held that (under the predecessor Directive 95/46/EC) that a dynamic IP address was personal data. But in that case the web site was run by the German Federal Government, which surely has wider scope for getting info from a German ISP than a small private US web activist does. There is not yet any case law that I know of on the applicability of the GDPR to IP addresses in any case at all similar to the one in the question. Joe would in my view be wise to at least learn that logs are being kept, and post a disclosure of this on the site. Whether Joe needs to do more than that is less than clear at this time.
Simply use a cookie to store consent. First consider the opposite. If a user does not agree to store cookies, a cookie is the only way to remember this, as you want to avoid a new pop-up on every page-load. Because this use of a cookie is functional, you don't need permission to store that cookie. You seem have the impression that you have to prove towards the ICO if someone has provided consent. However I think it would be sufficient if you can demonstrate how your website works technically. In particular whether consent is handled properly. You might need to create screenshots or a screencast to do so. Add new proof after each major update of your website. Storing consent server-side would violate the data minimization principle of the GDPR I think. In particular because you would need to do something to be able to identify users. That would violate Art. 11(1) GDPR: If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. Notice it is possible to configure google analytics in a way so you don't need any consent. See my answer to this question. Just IP anonymization is not sufficient.
Can you anonymise people It is valid to anonymise the data of people, instead of deleting all of the records. The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. Source As long as the person is not identifiable, then you do not need to treat the data as personal under the GDPR. You do have to inform a person once they are no longer identifiable, and be able to identify them if they provide the missing information: If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification. Source The articles covered by this are: 15 - Right of Access 16 - Right to rectification 17 - Right to erasure 18 - Right to restrict processing 19 - Right to be informed 20 - Right to data portability
First of all, in a GDPR contest, the process described is not strong anonymization. It may be hard for an outsider to go from the stored record to any PII, it is much easier for an outsider to &quot;single out&quot; an individual. This means that given a known individual, one can determine whether that person is among those listed in the records, or can determine this to a significant degree of probability. For this only the algorithm and the rotating salts are needed, one need not break the hash. Note also that the GDPR specifies that if a person can be singled out with the assistance of the site operator the data is not considered anonymized. Thus this data needs a lawful basis under the GDPR, and the various other GDPR requirement all apply. However, even if the data were totally anonymized, and say just added to a count of users with this or that User Agent, the process of reading local data (including but not limited to cookies) itself requires informed consent, and so a cookie banner or other interaction with similar info under the e-Privacy directive (EPD). The EPD, being a directive and not a regulation, must be implemented by national laws, and the exact provisions in those laws may differ somewhat from country to country. But I believe that all of them require consent before any local data is read.
Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea. If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution? Is it GDPR compliant that their answer to my deletion request is "We will delete the data..." The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”. You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.