Talent consent withdrawal in film in Europe Consider the following scenario of right to erasure in film-making in Europe. Person A makes amateur live-action films, for example theater performances. Person B is in one of those performances and consents to recording and publication verbally or in writing. Later, for whatever personal or professional reason, person B would like to withdraw consent under the GDPR right to be forgotten. Does person B have the right to erasure and would face and voice count as personal information under GDPR? Does person A have to edit the film to remove, blur, or distort the voice of person B?
… would face and voice count as personal information under GDPR? Absolutely. Does person B have the right to erasure … No. The right to erasure only applies in certain circumstances. While the initial reason for collecting personal data was consent, once it has been incorporated into a film, the processor now has a legitimate interest in the data. The right to erasure does not apply when there is a legitimate interest.
It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside, if both parties agree on that. But compulsory laws cannot be set aside. Of course laws can also be partly compulsory. For example provisions which cannot be changed in disadvantage of a consumer. So there is freedom of contract, but it's freedom is reduced by law for the common good or for example to avoid misuse of bargaining power. In particular consumer related laws are often compulsory because it has little power against the other parties. Companies can have their negotiations done by lawyers, so they can make a well informed an well negotiated decision. As an extreme example, you cannot kill someone, even if that person has given you written permission. See also "Peremptory norm" on wikipedia for international law examples.
These documents constitute personal data and - in principle - you, as the subject, have the right to get a copy of them by issuing a "subject access request". The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (Art. 15 (3) GDPR) GDPR applies to controllers of any kind, including government organisations. The subject access request can usually be a simple email. The ICO has a template for this: https://ico.org.uk/your-data-matters/your-right-of-access/ (but keep it simple, you can literally just ask for "all personal data" they have on you; no need to speculate on what kind of data they may have). The subject access request is sent to the actual controller, but if you don't get a response to your request after 30 days, you can file a complaint with the supervisory authority (see here for Germany; note that federal institutions are supervised by the BFDI, not the data protection authorities of the Länder). Also note that you may have to go through some trouble to be properly authenticated by the controller. They do need to be certain that you are the data subject. There are also reasons why a controller can refuse to provide some or all of the information (e.g. if your request is clearly excessive or unfounded, if it's impossible to comply without violating another data subject's rights), but I would be surprised if any of those applied in your case. Your rights can also be restricted depending on the legal basis for processing. This includes rights that are illogical as well as some that provide special protection for processors: You can't object to processing based on consent (but you can revoke your consent), fulfilment of contract (but you can cancel your contract), a legal obligation on the part of the processor, or a vital interest (but you still have the right to erasure) Your right to portability and right to erasure does not apply if processing is based on a legal obligation or a public task (justice, parliamentary or government functions, statutory functions etc.) your right to portability also doesn't apply if processing is based on vital interest (e.g to protect someone's life) or legitimate interest of the processor. It is possible that processing all or some of your data was based on the performance of a public task, in which case they will refuse your request.
No, GDPR does not apply here — but other laws might . The General Data Protection Regulation only concerns itself with the following: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. per Article 2. Furthermore, there is a specific exemption (Art. 2 (2)(c)) which would seem to apply to you (emphasis mine): This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. You are sharing the conversation in a purely personal capacity and are not processing it wholly or partly through automated means nor are you intending it to form part of a filing system. Additionally, depending on the contents of the conversation and what you share, there may not be any personal data involved at all. For example, if you only share the messages themselves (and they don't contain any personal data that could identify someone) and censor/black out any names or photographs/avatars from the senders. Either way, GDPR does not appear to apply to you in this context. However, it appears that Article 18.1 of the Spanish Constitution grants the right to &quot;personal and family privacy&quot;, as does the Organic Act 1/982 on Civil Protection of the Right to Honour, Personal and Family Privacy, and Self-Image. It's possible that, depending on the contents of the conversation, the other party involved in the conversation may have a case for action against you in the civil or criminal courts (for example, if the information invades their privacy or is defamatory in some way) if you share the contents of the conversation with someone else. I am not familiar with Spanish law so cannot comment further on this matter.
Do I need to inform the user about storing the score locally? No, there is no need as long as you don't transmit, store or process any personal info. It's doubtful that the score could be considered personal info, but you're not sending it to your servers in any way, so you don't seem to be processing it anyway. Do I need consent for using non-personal AdMob? You have to check this with AdMob, but usually, if it is non-personal, they shouldn't be processing any PI, so you're clear without informing. Do I need to ask for the age? How should I handle kids? Again, you're not processing any PI, so regarding GDPR there isn't any problem. Can I disallow a user from using the app if consent is not given? If you needed consent, no, it would be unlawful to block a user for not giving consent, unless it is impossible to provide the service without it. See recital 43: Consent is presumed not to be freely given if [...] the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
In the question, you write: The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file). No, it does not. To quote Miss Infogeek: GDPR DOES NOT MAKE CONSENT A MANDATORY REQUIREMENT FOR ALL PROCESSING OF PERSONAL DATA. Consent (Article 6 (1)a) is indeed one of conditions that can be used to comply with the GDPR requirement that processing must be lawful, but it is not the only condition available to the controller to ensure lawful processing &ndash; there are alternatives (before the list of conditions it says that "at least one of the following" must be satisfied). All the conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. One of alternatives are Article 6 (1)f. It says says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) As noted in the question, logging IP addresses for the purpose of security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. It is the default, and most (all?) web-sites do this. I.e. it is legal to do this without consent (if this is not the case, I am pretty sure the outcry had been heard all over the Internet by now).
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. That's not exactly true, consent is merely one of six possible legal basis for processing (article 6). For example, processing of personal data can also be lawful if it necessary to perform a contract, legally mandatory, or in the public interest. The court decision acknowledges that but rules out another basis in this case because it considers that it is possible to serve fonts without relying on a third-party ([…] der Einsatz der Schriftarten auch möglich ist, ohne dass eine Verbindung von Besuchern zu externen Servern hergestellt werden muss). Confusingly, it only refers to article 6(1)(f) when it seems to me that (b) would also be plausible but maybe this wasn't raised during the proceedings? If the data controller cannot invoke any other basis for the lawfulness of the processing then yes, the only thing left is asking for consent, i.e. invoking article 6(1)(a). But that doesn't mean that you should expect to be asked for consent each and every time your personal information is being used. The consent form on the site also implicitly assumes consent, which I thought was also a violation. Yes, implying consent doesn't really make sense under the GDPR definition (article 4, see also article 7): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action European data protection authorities have issued guidelines that detail what that means and clearly reject “bundling” different data processing. The regulation also makes it clear that data subjects should be able to withdraw consent at any time, which does not seem possible with the fonts on golem.de My reading of all this is that assuming consent because you are using a service (or even created an account or checked a box at some point) simply isn't valid consent. Either you don't need consent at all in the first place or what you need is freely given, specific consent and “implying” consent or bundling it with a registration process achieves exactly nothing. But this is still extremely common and it might take some time before enforcement and case law definitively settle this question. Smart data controllers trying to avoid collecting consent (like Meta) have abandoned any claim that signing up to the their services would constitute consent (because that's transparently not the case) and try to bypass the issue entirely using another basis like contractual necessity. This is also being litigated. I know that a EU regulation can be implemented and interpreted differently from country to country, and that a single court ruling in Germany doesn't even mean that the national law was correctly applied. From what I've read, I get the impression that this particular ruling was not unlikely to be overturned by a higher instance, if it came down to it. So my question probably both pertains to German law specifically and the EU regulation itself. That sounds more like the way EU directives work. Regulations are supposed to be immediately applicable (no implementation in national law necessary) with minimal differences between countries (except when they explicitely provide for that). Of course, enforcement would still mostly be in the hands of national court systems and (in Germany) provincial data protection authorities but there are mechanisms to ensure consistency (the European Data Protection Board, prejudicial questions to the CJEU, infringement proceedings from the European Commission…).
You've tagged this as both united-states and european-union, so this answer is about the United States. Before you can &quot;license&quot; someone to do something, you must first have the legal right to prevent them from doing it. Otherwise, your purported &quot;license&quot; is just a worthless piece of paper (technically, you might be able to sell those pieces of paper notwithstanding their lack of validity, so I suppose they wouldn't be completely worthless). If we imagine that the subject of a biography or autobiography wants to control the publication of that biography, there are a number of legal grounds that might be cited, depending on the circumstances: Copyright: The person who actually wrote the biography (who may or may not be the subject!) can prevent others from making copies or derivative works of it, as well as several other rights enumerated in 17 USC 106. Most publication agreements involve signing an exclusive license with the publisher. If the author has not signed such a license, then the biography is not going to be published in the first place. Regardless, copyright only exists once the work is &quot;fixed in a tangible medium&quot; (e.g. saved to a hard drive, written down on a piece of paper, etc.). If it's still &quot;in your head,&quot; then you don't own anything. If the subject and author are different people, then the subject does not have any rights here at all; copyright belongs exclusively to the author. Furthermore, copyright only protects the individual work. It does not prevent someone else from writing a different biography from scratch, so long as this second biography is original and does not reuse any content from the first biography. The underlying facts belong to no one. Privacy rights are generally handled as a tort under state law. If the subject is a public figure (i.e. the sort of person who's likely to have a biography written about them) then privacy rights tend to be rather limited. However, they are not nonexistent, and invasion-of-privacy claims are occasionally raised, usually in cases where highly personal, sensitive information is disclosed against the will of the subject. This may also become relevant if the author of the biography obtains information in an illegal fashion such as by hacking or physical trespass. However, in most cases, the content would need to be pretty far beyond the pale before this would have a realistic chance of succeeding. Personality rights are usually considered an extension or variety of privacy rights. In general, they allow the subject to prevent their name from being associated with a commercial endeavor without their permission. However, it is likely that the First Amendment would bar the application of personality rights to a biography, unless the publisher tried to misrepresent a ghostwritten work as an autobiography without the consent of the subject. Libel is a tort under state law. Libel laws in the US are extremely limited, and the subject would need to establish at least all of the following in order to succeed (or else the claim is barred by the First Amendment): The defendant published a statement. A reasonable person would interpret that statement as factual (and not an opinion, puffery, etc.). The statement is materially false (i.e. the &quot;gist or sting&quot; of the statement is false, regardless of whether it is technically 100% accurate). The statement harmed the reputation of the plaintiff. The defendant knew the statement was false, or made no serious effort to verify it (&quot;actual malice&quot;). Not required unless the plaintiff is a public figure, but the subject of a biography probably will be a public figure. There may be additional requirements depending on the state, and the defendant will probably try to file an anti-SLAPP motion if state law allows for it. Of these four rights, copyright is by far the most commonly &quot;licensed,&quot; followed by personality rights. Nobody gives out licenses to commit libel or invade their privacy. That leaves us with two ways of licensing your (auto)biography: Actually write it yourself, and sell it to a publishing company. You will give them a copyright license as part of the process (in exchange for royalties and an advance). Convince a publishing company to hire a ghostwriter for you, and then license your likeness to them. The public will be told that you &quot;wrote&quot; the book, and you will promote it in exactly the same way as if you did write it. Neither of these options will prevent someone else from coming along and writing their own biography about you, of course.