What consequences are there to ignoring GDPR rules as a non-EU entity? If a non-EU entity ignores the GDPR rules, including not paying any fines they receive from not following them, what consequences are they subject to? Can a company simply decide to ignore GDPR rules while still providing their services to EU citizens? for clarity: assume the company does not have anything in the EU: No local offices, no support staff, no remote workers, no contact details, nothing that would allow someone to make the case that they fall under EU jurisdictions. However, the products they provide follow relevant non-GDPR regulations that deal with health and safety. They just don't want to deal with GDPR rules because they think those rules are nonsense in their case.
Enforcement against non-EU entities is difficult, and especially digital services would be impossible to shut down. Ultimately, enforcement would depend on judicial assistance between the relevant EU member state and the jurisdictions where the data controller is established or has relevant assets. Your case involves physical goods and other regulations though, so that (some amount of) compliance by the data controller is necessary in order to have continued access to the EU single market. Which instruments for enforcement of fines are available depends on the EU member state, but could e.g. involve confiscation of products or payments. A non-EU B2B service provider would also have economic incentives to comply as EU data controllers cannot share personal data unless an adequate level of protection is ensured. In reality, it is fairly unlikely that non-EU data controllers will get fined anytime soon because data protection authorities tend to prioritize more clear cut cases, and tend to stay within their jurisdiction. Of course, non-EU data controllers are usually required to register an EU representative precisely to subject them to a particular authorities' jurisdiction, but a non-compliant controller is unlikely to do that. A note on the GDPR's territorial scope: it is far less extraterritorial than some people believe. Per GDPR Art 3(2) the regulation applies to non-EU data controllers, (a) to the extent of their processing activities that relate to offering of goods and services (also unpaid services) to data subjects in the EU, or (b) when they monitor/track behaviour of data subjects as far as the behaviour takes place in the EU. For example, a B2C company would have to comply with the GDPR regarding how they handle shipping addresses of their EU customers. The EDPB has issued in-depth analysis as part of their guidelines 3/2018 on the territorial scope. However, the ECJ has found that some of the GDPR's effects are confined to the EU. For example, Google has to hide some results from EU searches in order to comply with the GDPR's Right to Erasure, but cannot currently be forced to hide the results from non-EU searches.
The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed. If the embed-provider acts as your data processor, then things are generally fine. The GDPR does not really distinguish between personal data processing activities that you perform yourself versus activities that you've outsourced to third parties. However, you would remain responsible for compliance. This also means that per Art 28 GDPR, you will need a contract with that embed-provider (sometimes called a “Data Processing Agreement”, DPA). This contract stipulates that the processor will only use the personal data as instructed by you, but not for their own purposes. With the Google Fonts case, it must be highlighted that Google does not act as a processor for this service. Google does not offer a DPA that covers the Fonts CDN. While Google promises that it doesn't use the personal data collected in this context in any nefarious way, there are zero contractual guarantees for website providers. So we have to consider the scenario when the embed-provider is an independent data controller. We as the website provider have no control over what the embed-provider does with the collected data, our control only extends to whether or not we cause the website to disclose data to that third party. But this is still processing as personal data (see also the CJEU Fashion ID case), and we need a legal basis for this data sharing. In the Google Fonts case, the court in Munich found that there was no legal basis for using Google's CDN. There was no consent, no contractual necessity, and no necessity for a legitimate interest. After all, these fonts could all be self-hosted. (Technical remark: and given how modern browsers enforce cache isolation and provide HTTP/2, serving fonts from your main domain is probably faster anyway). Consent management services will typically act as your data processor. You don't need a legal basis for “sharing” data with them, because the processing remains under your control. As far as the GDPR is concerned, loading a script from your processor's servers is equivalent to loading a script from your own servers (which you're probably hosting via a another data processor anyway). Sometimes, the necessary data processing agreement is already part of the standard terms of service, sometimes it's a separate document that has to be signed. Figuring this out is your responsibility as the data controller, before deploying the service. Art 6 GDPR doesn't say that you always need consent. It says that you need a legal basis, for which paragraph 1 enumerates six choices. For a lot of use cases, a “legitimate interest” will be appropriate, though it requires a balancing test. Sometimes, other laws mandate that you use a particular legal basis. For example, the ePrivacy Directive says that you must get GDPR-consent when accessing or storing information on the user's device (such as cookies), unless that access/storage is strictly necessary to provide a service explicitly requested by the user.
Q1. Is there a requirement under GDPR for data processors to disclose sub-processing arrangements and the names of the organisations involved in this? "The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 2 This clearly states that the processor would need to make clear that they are subcontracting the services and get permission for this as part of the contract, but doesn't specify whether the subcontractors must be named and identified. Perhaps there is other prior existing subcontracting legislation that requires them to be named? Some procurement contracts as supplied by controllers may specify a list of nominated (allowed) sub-contractors or require the full identification of sub-contractors though I've not found anything in law that requires they be named other than as part of a specific contractual obligation. Q2. Is there a requirement under GDPR for data processors to disclose the country or countries where data is stored and processed? "Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ... (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. ..." -- EU General Data Protection Regulations (GDPR) Article 28 Paragraph 3(h) This clearly states the data processor must make available to the data controller all details required to demonstrate compliance. It's quite likely larger organisations may choose to make this simple for data controllers by supplying this information in the form of a completed Data Privacy Impact Analysis document. "Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: ... (e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; ..." -- EU General Data Protection Regulations (GDPR) Article 30 Paragraph 1(e) This clearly states the data controller must maintain a record of the country or countries involved if any of these are outside the EU, and so this information must be made available to the controller as stated above.
You don't need to get consent to comply with GDPR Lawfulness of processing Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Sending a http request to a website falls under 6(1)(f).
If a data controller fails to fulfil your data subject rights, lodge a complaint with your data protection authority. In Hamburg, the appropriate form is here. However, they are not required to investigate your complaint. Independently from a complaint, you could consider suing Wordpress for compliance – Automattic has a subsidiary in Ireland so this might actually be feasible. I'm not quite sure though that Automattic is indeed the data controller for wordpress.org, as opposed to the .com domain – the privacy policy isn't quite GDPR compliant. While your GDPR Art 17 Right to Erasure might not apply in this case, there's a definite GDPR violation because the data controller failed to respond to your request within a month as per Art 12(4). That your posts on the bugtracker were deleted doesn't look like an issue in this context, what does matter is that they didn't respond to emails to the addresses mentioned in their privacy policy. Whether you have a right to erasure depends on the legal basis for storing your data. In general, you have a right to erasure if: the data is no longer necessary; processing is based on consent (because you can always withdraw consent); or processing is based on a legitimate interest and they have no overriding legitimate grounds to continue processing despite your objection (Art 21). The data is still necessary to identify you for your actions on the bugtracker, but depending on your particular situation you may be able to object successfully and force them to anonymize your posts.
Companies House itself is exempt from certain GDPR provisions, including Article 17, by virtue of the Data Protection Act 2018, Schedule 2, Part 1, paragraph 5. (That's the Act which implements the GDPR in UK law.) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation. The list is in paragraph 1 of that Part, and has effect under section 15 of the Act. Because the registrar is obliged by an enactment, the Companies Act 2006, to make information available to the public, it's exempt from being asked not to. When Companies House data is processed by somebody else, they do not have this exemption. They are the &quot;data controller&quot; with respect to what they've retrieved (from the API or by scraping) and have freestanding obligations under the GDPR. They may still have other reasons why they are able to retain and process your data, such as a vital interest or a legitimate interest in protecting themselves or others from fraud, and therefore wanting to maintain a list of people associated with insolvent companies. For Article 17 specifically, there are exceptions relating to the public interest, statistics and research which might be invoked. But random websites cannot claim exemption from Article 17 just because the data comes from Companies House. There is nothing in the Companies Act which says that third parties are obliged to mirror Companies House data. This is explained in greater detail in the Companies House Personal Information Charter, which is where I found the citation above. They go on to say: If you have any concerns about company data on third party products and websites, please contact the organisation directly. We’re not able to advise other organisations on UK GDPR compliance, and we cannot advise you on whether other organisations are complying with the law.
The 'right to be forgotten', as currently being applied throughout the European Union (EU), does not come from the General Data Protection Regulation (GDPR), which will come into force 25 May 2018. Rather, the current basis exists in the Data Protection Directive, 95/46/EC, article 12(b): Right of access Member States shall guarantee every data subject the right to obtain from the controller: [...] (b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data; This was one of the main points upon which the Court of Justice of the European Union (CJEU) decided Google Spain v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, the judgement which allowed for individuals to ask for search engines to remove results containing personal data. The CJEU explained that the 'right to be forgotten' was not absolute and should take into account economic considerations as well as other rights (paragraphs 85 - 88). The GDPR, article 17, for purposes of contrast, has a more robust and explicit right of erasure than currently in force: Article 17 Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: [...] Shortened for clarity GDPR, article 17 fleshes out much of the lack of specifics that the Directive's article 12(b). It should be noted that the UK's Data Protection Act 1998 is a transposition of the Data Protection Directive. This means that the full effect of the rights and obligations in the Directive are contained within the Data Protection Act 1998. Furthermore, the interpretation of the rights and obligations of the Data Protection Directive by the CJEU are highly influential on interpretation of the Data Protection Act 1998. This is due to the European Communities Act 1972, s 3(2) which states: Judicial notice shall be taken of the Treaties, of the Official Journal of the Communities and of any decision of, or expression of opinion by, the European Court on any such question as aforesaid; and the Official Journal shall be admissible as evidence of any instrument or other act thereby communicated of any of the Communities or of any Community institution Even without the above provision, it would be extremely likely that British courts would take into account Google Spain, given that the foundation of the Data Protection Act 1998 is the Data Protection Directive. The most likely outcome is for British courts to uphold the interpretation in Google Spain and allow for data subjects to request removal from search engines. Of course, it is not entirely possible to know without a test case, but it is doubtful any major search engine would attempt to deviate from the current situation as there is currently legal certainty. The Data Protection Act 1998 will still be in force after the future Brexit agreement and is certainly not contingent on continued EU membership. Update The current DPA will be repealed when Brexit comes in to play and will be replaced by a new one. Read more about the new data protection bill on the ICOs web site, which is based on the GDPR with certain derogations and additions.
Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE. Is it against the right to erasure mentioned here as a part of GDPR? No, it is not (otherwise StackExchange would be in rather big trouble). The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4): any information relating to an identified or identifiable natural person (‘data subject’) If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data. In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment. So, in summary: A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized. The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit. The StackExchange network, for example, covers this by allowing users to: disassociate posts from their account delete their account entirely (thus effectively disassociating all posts from personal information) asking a moderator for redaction of personal data