Is hyperlinking legal in Europe? This is why I am asking such a strange question: Europe has a law called GDPR which imposes responsibility of processing on the person who decides the means of processing of personal data. Now, if someone posts a link, and the website on the link violates GDPR, the person who posted the link will be liable because they determined the means and processing of data.
Of course it's legal. Hyperlinking to an unaffiliated website in no way &quot;determine[s] the means and processing of data.&quot; The person who makes these determinations is the person running the website. If I link to Microsoft's website, that doesn't give me any control over how Microsoft processes data on the website.
european-union (germany, spain, uk) The cookie consent law is the ePrivacy directive, which was implemented as national laws by all EU member states (including, at the time, the UK). Later, GDPR changed the applicable definition of consent so that implicit consent is no longer allowed. A notice in fine print as in the given example is not sufficient to meet this definition of consent, so any non-necessary cookies set in that context would be a violation. But it would be the national ePrivacy implementation that would be violated, not the GDPR. Thus, the GDPR's famous 4%/EUR 20M fines are not relevant here. Instead, each country can set its own fines. In Germany, this would probably be up to EUR 50k (§16 TMG) though German law doesn't implement this aspect of ePrivacy correctly. In the UK, PECR penalties are determined by more general data protection penalty legislation. Notable instances of cookie consent enforcement include the Planet 49 (ECJ judgement, German BGH verdict) case which basically affirmed that yes, the GDPR's definition of consent applies. Thus, any case law regarding GDPR consent is also applicable to the issue of cookies. Furthermore, the Spanish AEPD has issued an interesting fine due to insufficient cookie consent, but due to much more subtle violations than the outright disregard in the given example. E.g. in the Vueling action (decision (Spanish, PDF), summary, listing on enforcementtracker), the Vueling airline's website had a consent banner but ultimately told the user to reject cookies via their browser settings. This violates the requirement that consent must be specific/granular, since the browser settings are all-or-nothing if they're available at all. The airline was fined EUR 30k, the maximum possible under applicable Spanish data protection law. But what kind of risks would some blog run into that just sets cookies without appropriate consent? If the service is outside of the EU, enforcement is difficult. I am not aware of cookie consent enforcement against non-EU services. National data protection authorities can investigate the violation and issue fines, subject to their respective national data protection laws. They generally only do this when there are lots of complaints. Some authorities like the UK ICO have indicated that cookie consent enforcement isn't a priority for them. Independently, individuals can generally sue the service for damages. Some lawyers might send out cease and desist letters to non-compliant websites in the hopes of collecting fees. So aside from the last point, the risk is likely somewhat low, especially for a smaller site. At this point, it is worth reminding that ePrivacy/GDPR doesn't require consent for all cookies, and is not just limited to cookies. It is more generally about access to and storage of information on a user's device, unless that access is strictly necessary to provide the service explicitly requested by the user. Thus, functional cookies can be set without consent. However, consent does become necessary when cookies or similar mechanisms are used for analytics, tracking, or ads. Even though GDPR is involved, the cookie consent requirements apply regardless of whether the cookies involve any personal data.
Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing. What if you're asked to delete data that is needed to bill customers, information that may be relevant to a legal case or information that needs by law to be retained for the purposes of audit? GDPR does not make it illegal to carry personal information, it simply needs you to justify why you are keeping the information - inform the named person about this and provide them with a timescale for deletion. For example if you are required by law to store a record of emails to document the work done, but the user asks you to delete that information. You would be entitled to keep that information but only for the purposes of maintaining that audit trail. You would delete all associated customer data that was unnecessary such as CRM info, payment details etc.. but could keep the audit trail. The proper way to respond to the user's deletion request would be "your data will be kept in a secure server for the purposes of maintaining an audit trail for x amount of time. Once this time has elapsed it will be deleted. If you are unhappy with our use of this data please contact our data officer". GDPR isn't designed to catch you out - if you have a legitimate reason to keep that information then you are entitled to. The law was designed to stop marketers and advertisers hoarding huge amounts of information, as well as undermine Google/Facebook's duopoly on our personal information.
GDPR rights and obligations cover different things: A duty of the data processor towards the government of the country where they operate to present certain documentation, and to implement technical and organizational measures to protect data. These would be audited by government agencies, not the individual customer. A single data subject cannot waive them. A duty of the data processor to process and store personal data only with a legal justification. User consent is one possible justification, if it is informed, revokable, etc. So a single data subject can waive a &quot;ban&quot; on storing his or her data in a database along with all the other users who waived that &quot;ban,&quot; but the duties towards the government regarding that data would still apply. A duty of the data processor to respond to an Article 15 request by the data subject in a certain way and timeframe. If a data subject writes a letter to the data processor and explicitly states that the letter is not an Article 15 request, then Article 15 does not apply. The data subject would of course have the right to make an Article 15 request at a later time.
No. Art. 17(1) GDPR lists conditions when erasure can be requested. None of the listed grounds would apply in this case. However, you might have to explain why you process the data (for moderation purposes as you explained above), and why that is lawfully. In particular Art. 5 and Art. 6 need to be taken into account. In your case, processing will be based on Art. 6(1)(f): (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Even if the data subject would be a 9 year old child, the legitimate interests of you and other forum users outweigh the objection of the data subject. Based on Art. 5, there will be a moment when the data has to be deleted. For example 1 year after the last login attempt.
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.
Contacting a business email about a business matter is usually fine, but in this case we have an unsolicited marketing communication (spam), not really a business matter. The client's jurisdiction likely has more specific rules about spam. Also, it is unusual (read: presumably illegitimate) to contact individual employees rather than the company's official address with the offering. From the GDPR perspective, every processing of personal data (such as email addresses that might identify natural persons) needs a legal basis (Art 6). Let's go through them: consent? No. necessary for performance of a contract involving the data subject? No. legal obligation? No. vital interests? No. public interest? No. legitimate interest? Perhaps. The client has a legitimate interest to conduct their business. However, this legitimate interest must not be overridden by the data subject's interests, rights, and freedoms. Such as the interest in not being disturbed by spam mails. It is the Data Controller's (your client's) responsibility to balance the legitimate interest themselves to determine whether they have a legal basis, but I really don't think that they do. In conclusion, your client's idea is a bad idea: They likely do not have a legal basis for this under the GDPR. They are likely violating more specific anti-spam laws in their jurisdiction. They are working hard to get their domain put on spam filter lists. Note that already the step of collecting employee email addresses is personal data processing and needs a legal basis. Of course, the GDPR does not apply when the client is not established in the EU and only processes the addresses of persons that are not in the EU.
The GDPR actually does require you to follow DNT in Article 21: In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. I think this is quite explicit.