Does any host provider currently comply with GDPR? According to Rec.81; Art.28(1)-(3) of the GDPR regulation, "The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller" A controller that wishes to appoint a processor must only use processors that guarantee compliance with the GDPR. The controller must appoint the processor in the form of a binding written agreement, which states that the processor must: only act on the controller's documented instructions; impose confidentiality obligations on all personnel who process the relevant data; must ensure the security of the personal data that it processes; abide by the rules regarding appointment of sub-processors; implement measures to assist the controller in complying with the rights of data subjects; assist the controller in obtaining approval from DPAs where required; at the controller's election, either return or destroy the personal data at the end of the relationship (except as required by EU or Member State law); and provide the controller with all information necessary to demonstrate compliance with the GDPR. I've checked every major host provider there is and none offers such guarantees. So question is, how do I as a controller comply with GDPR if there's no host provider (aka processor) who'll sign a contract addressing all 8 points required by the GDPR? The regulation clearly states that controller is responsible for this.
Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time. Microsoft was one of the first (if not the first) to communicate openly about the GDPR and the changes that follow. From the blog post: If your organization collects, hosts or analyzes personal data of EU residents, GDPR provisions require you to use third-party data processors who guarantee their ability to implement the technical and organizational requirements of the GDPR. To further earn your trust, we are making contractual commitments available to you that provide key GDPR-related assurances about our services. Our contractual commitments guarantee that you can: Respond to requests to correct, amend or delete personal data. Detect and report personal data breaches. Demonstrate your compliance with the GDPR. Microsoft is the first global cloud services provider to publicly offer you these contractual commitments. We believe privacy is a fundamental right. The GDPR is an important step forward to further clarify and enable individual privacy rights and look forward to sharing additional updates how we can help you comply with this new regulation and, in the process, advance personal privacy protections. Microsoft has set up an informational site on GDPR here. If your eyes are on any other provider, I think the only way to learn more is getting in touch and inquiring about their progress and process. Hope this helps.
Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real world identity. Serving them with a lawsuit will be difficult, especially if they are from outside the EU. GDPR lets you sue data controllers, but it's not worth it. You can sue for compliance (e.g. to compel fulfillment of your access request), and you can sue for damages stemming from GDPR violations. Compared to the damages you have suffered, a lawsuit is very expensive.
The consent presented in the question is a text-book example on how to not secure consent under the GDPR. The GDPR requires concent to be explicit, specific, freely given, and informed. This particular privacy policy does not measure up to any of these requirements. The GDPR goes to great lengths to regulate consent. For instance, in Article 7 (2) is says: Any part of such a declaration [of consent] which constitutes an infringement of this Regulation shall not be binding. So if the consent obtained is not explicit, specific, freely given, and informed, and the company relies on consent to ensure lawfulness of processing, it is breaking the law (and may be fined under the GDPR). The big problem with this privacy policy is this sentence: Your continued access to or use of any of the Services shall be deemed your acceptance of the Privacy Policy. As you've noted, the GDPR requires consent to be explicit. What "explicit" means is spelled out in Recital 32, which (among other things) says: Silence, pre-ticked boxes or inactivity should not therefore constitute consent. And Recital 32 goes on state that consent must be specific: When the processing has multiple purposes, consent should be given for all of them. The full privacy policy lists 16 different purposes for which personal data is collected, but do not seek specific consent for any of them. Consent under GDPR must also be freely given. Recital 42 says (among other things): Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Here the company states that continued use of the service "shall be deemed your acceptance". The only way the data subject can refuse consent is to not use the service, which is to the detriment of the data subject. This also makes the consent invalid. Finally, the GDPR also requires consent to be informed. What this means is spelled out in Recital 42, which (among other things say): For consent to be informed, the data subject should be aware at least [...] the purposes of the processing for which the personal data are intended. Here the data subject is supposed to consent to some unknown, future change which may be to allow different purposes of the processing. This also invalidates the consent.
No, it is not legal. Regardless of their location, the only legal options for companies serving to EU residents are to either deny access altogether or to make consent truly optional1 Recital 42 states (emphasis mine): Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement[...] Recital 43 states: Consent is presumed not to be freely given [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. 1 Of course, remember that consent is only one of several means that allow them to process data. For example, if you were getting a trial account for a limited time, it would be considered a legitimate business need to ensure that you are not just opening new trial accounts when the old ones expire. So, if they wanted some data from you to ensure that you are not a previous user and you refused to provide it, then they could deny giving you that trial account without breaking the GDPR.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
GDPR gives you a lot of flexibility here to choose either DPA. From Art 77: Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. However, the DPA from the company's country would be designated the lead supervisory authority for this investigation. If multiple DPAs are involved, they would coordinate with each other. There is no EU body that you could contact directly. But if the different DPAs have a dispute regarding this investigation, the EDPB would provide a consistency mechanism. This mechanism has been used in the past e.g. to force the Irish DPA to correctly apply the GDPR against companies from the Meta group, like WhatsApp and Instagram. Though it might slow things down, it could be advantageous to have multiple DPAs involved, precisely so that the investigation is double-checked. If the lead supervisory authority declines the case, this would also enable the other DPA to do its own investigation. So, it would be a good idea to lodge a complaint with the DPA of your home country, and let it forward the issue to other DPAs as needed. However, contacting the DPA in the company's country would also be fine, especially if you are fluent in the relevant official language, and/or if you live in Ireland.
As stated by GDPR article 3 you are required to follow it under the following circumstance: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union. You can read the recourse better at What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?, but in short the US will allow the EU court to press it's rulings due to wanting to keep its trades, treaties and other similar things in place.
Under GDPR article 6 paragraph 1 item (c) one lawful basis for processing personal information (PI) is: processing is necessary for compliance with a legal obligation to which the controller is subject; The obligation to attribute a reused work under a CC license is such an obligation. Moreover, the licensor has the option under any CC license to specify a pseudonym for attribution of that work, or to waive attribution totally. Not doing that while releasing content under a CC license that requires attribution could reasonably be considered consent to publish that name along with each re-released copy of the work, so there are at least two lawful bases for processing that name and making it public. In some jurisdictions the license has the status of a contract, which imposes an obligation to attribute the author properly under GDPR Article 6 paragraph 3, as described in more detail in the answer by amon. Also, usernames are PI if and only if it is reasonably possible to associate them with a specific natural person. If a person chose a user name for a single site, not used for any other, and did not post any info that allows the person's identity to be determined, it is not PI. Often, of course, the person can be determined.