On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent? I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in the app. Now if GDPR applies, I would need to get explicit consent from the user before showing personalized ads. However, here is my problem: In order to know if GDPR applies to my user, I have to determine whether they are in the EU. I can do this by using a location API based on the user IP or by accessing some device settings. If I understand correctly, both ways would require prior GDPR consent of my user. Can I access a user's location before they gave their GDPR consent? If not, how do I even know that I need their consent before asking them for it? It seems a bit like a chicken - egg problem to me.
Since you are from Europe, GDPR applies to all your processing activities per Art 3(1) GDPR, regardless of where the users are located. If you would like to avoid GDPR compliance, you would have to manage your business from abroad so that you no longer have an European establishment, and would have to avoid offering your services to people who are in Europe. So let's assume that you have no European establishment. Then, GDPR can only apply per Art 3(2) to those processing activities that relate to offering goods or services to people who are in Europe. For determining this, IP-based geolocation is indeed common. Very likely, you do not need consent for this. GDPR does not require consent for everything, just a legal basis. There are six potential legal bases in Art 6(1), though the relevant ones are consent, necessity for performing a contract, legal obligations, and necessity for a legitimate interest. For things like security checks, it would be common to claim a legitimate interest. Complying with GDPR can hurt revenue. However, data subjects have a right to data protection, but you do not have a right to a particular business model. Similarly, paying taxes can &quot;hurt revenue&quot;, but it's not really optional. If your business model can't deal with GDPR compliance (or with taxes), it might not be a sound business model. In Europe, many newspapers have since moved from advertising-only to a consent-or-pay model. That is, the user is given a choice: You can read articles without tracking if you buy a subscription. You can access articles for free if you consent to tracking. The legality of this is hotly debated. In principle, such an approach can be compliant, but the details are problematic, for example that you can only buy subscriptions rather than individual articles, and that these subscriptions are often orders of magnitude more expensive than what would be earned through ads. But this might actually be easier to solve for a mobile application than for a website, due to the availability of in-app payment and micropayment infrastructure. In any case, GDPR limits how much you can &quot;encourage&quot; consent – per Art 7(4), you cannot make access to your service conditional on consent. There must be a way to use your app without consenting to anything, unless that consent is actually necessary for the app to work. For example, consenting to camera access is necessary for a QR code reader app to work. It is extremely unlikely that ads would be necessary in this sense. Users also must not suffer detriment for declining or withdrawing consent. From this, the EDPB has developed the concept of &quot;permissible incentive&quot; in their guidelines on consent. In this post, &quot;Europe&quot; means EU/EEA/UK as appropriate.
GDPR definitely applies. Your scenario seems to raise two questions: What is the legal basis for processing? Are the security measures appropriate? Legal basis Every processing activity of personal data requires a legal basis. Most well-known is consent, but there are six categories in Art 6(1) GDPR including legitimate interests and necessity for performing a contract with the data subject. Conditions on consent are laid out in Art 7 GDPR. You say that data subjects “explicitly agree to the website's privacy policy and GDPR”. The GDPR does not generally expect “agreement” to a privacy policy, as information per Art 13 is an unilateral notice. Such general agreement also cannot constitute valid consent. In the context of certifications, the legal basis would likely be necessity for performing a contract with the data subject: You were contracted to provide this validation service to the data subjects. You should however make it clear which information will be displayed on the validation page (other than a valid/not valid) response. For example, I am concerned that showing the email address would not be strictly necessary for providing the validation service. You should also consider whether this validation service is a core component of your certification service, or whether there should be an opt-in or opt-out here. Security Measures The GDPR requires that you implement appropriate security measures, “taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms” of the data subjects (see Art 32 GDPR). This gives you a lot of leeway to determine what measures are appropriate, but also criteria that you must consider in your determination. A number of security measures are explicitly suggested and must also be considered: pseudonymization and encryption ensuring confidentiality, integrity, availability, and resilience of your systems ability to restore the service (e.g. backups) processes for regularly testing and evaluating your measures Aside from generic IT security measures like backups and providing the service over a HTTPS connection, I would be concerned about “insecure direct object reference” style attacks on the database. If I know that certification no 1234 exists, I could try to get the information for other numbers like no 1233 and so on. This would leak personal data. Basic defenses could include requiring additional information such as the data subject's name to be provided, or using anti-bot measures such as captchas and rate limits. However, the real solution is to avoid sequential IDs, and to generate sufficiently large tokens with a cryptographically secure random number generator. Instead of a “certification number”, it would be better to view this as a “validation code”.
Article 32 of the GDPR requires companies to adequately secure their data when handling data belonging to EU citizens. This also applies to cross border scenarios where data is transferred between countries. Technically speaking, the GDPR doesn't set a standard for security: you don't have to encrypt your data, use AES or RSA encryption, or hash and salt passwords. It is your choice on how to secure your data, though the GDPR does mandate specific ways to secure data. However, not doing so opens yourself up to two consequences: The European data protection supervisor is tasked with the enforcement of regulations. A company can be forced to increase their level security if a valid complaint alleging that inadequate security measures are in place is made There is a significant amount of security risk, and if a data breach occurs, the GDPR allows authorities to levy heavy fines. Especially heavy fines may occur if it is found that the data was not securely stored. So the answer is: A complaint to relevant authorities can force the company to take action, or they will lose access to the European market.
Under European rules (GDPR, ePrivacy), you only need consent here if you both access or store information on the user's device (such as cookies), and this access/storage is not strictly necessary for a service explicitly requested by the user. A session cookie is strictly necessary for providing a log-in functionality, so such cookies are unlikely to require consent. In contrast, cookies for measuring ad impressions are not strictly necessary for showing the website content. Necessity must always be thought from the user's perspective, not from the provider's economic needs. If you use one cookie for multiple purposes, you should analyze each purpose separately. Maybe setting a cookie does not require consent under one purpose, but accessing the same information for a different purpose could require consent. If you have to ask for consent, this consent must be in line with the GDPR's requirements in Art 7. Consent must be freely given, i.e. there must actually be a way to decline the consent without suffering detriment. Consent must be informed, i.e. the user must be told directly for what consent is being sought, without having to click through to a long privacy policy. Consent must be specific, so it must be possible to consent for one purpose while declining consent for another. An &quot;I agree to the terms of service and privacy policy&quot; checkbox cannot constitute valid GDPR consent because it fails all these criteria: I cannot use the service without agreeing, I'm not told essential information up front (you cannot expect users to actually read long privacy policies), and this is an all-or-nothing bundle that does not allow specific choices. If you do not have to ask for consent, you should still be transparent about your use of cookies, for example by providing a paragraph on this topic in your privacy notice. I think showing a cookie banner would be a bad idea in that scenario, since it could be confused with an invalid consent banner (no way to decline the cookies).
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
Yes, your transaction history is your personal data. Personal data is any information relating to an identifiable person. Your transaction history relates to you, and you're definitely identifiable for the bank. You have access to the transaction history to the app, which would probably satisfy Art 15 GDPR. You do also have a right to data portability under Art 20 GDPR which allows you to get your data in a machine-readable format – but strictly speaking this right only applies to data you provided yourself. You could try to explicitly invoke this right. Your GDPR rights must be satisfied without cost. Your bank almost certainly does provide machine-readable API access, in conformance with the open banking mandate from the Revised Payment Services Directive (PSD2, Directive (EU) 2015/2366). The Directive requires your EU member state to have passed a law that gives you “the right to make use of services enabling access to account information”, if you're already using online banking. However, the exact details of that right will depend on the laws in your EU member state. You might already be able to connect to your transaction history via Open Banking software such as GNU Cash.
It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. If the website terms which you agreed to don't include this data matching, then that processing is not lawful. The rest of Recital 50 is relevant and worth quoting in full: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. It seems to me that an anonymous account could reasonably expect that the &quot;further processing&quot; of data matching is not in the public interest, an exercise of official authority, scientific or historical research or statistical. There is no link between the data matching exercise and the purpose for which IP addresses are normally collected: the operation and physical security of the website. Now, it may well be that the website terms do allow this data matching to discover links between accounts, or in any case prohibit having two accounts and allow reasonable methods to discover such links. It's also possible that a court has ordered the processing (as Iñaki Viggers has mentioned. We don't have that information; but ostensibly one wouldn't normally expect a personal account to be examined in this way, and certainly wouldn't expect any link discovered to be relayed to a third party.
The obligation to notify the supervisory authority (CNIL in your case) no longer exists. It was part of the previous regulatory framework, but it is not part of GDPR (which takes affect tomorrow). If you use CCTV that may monitor employees (i.e. they sometimes enter the HQ to consult with the owner), your obligations under the GDPR is basically to inform the employees that the CCTV cameras are there. I.e. Data subjects are entitled to understand when their personal data is being processed, covering the transparency aspect of processing. The use of CCTV must be communicated via signage which indicates the areas covered and instructions for further information.