Californian resident travelling in EU - which privacy law applies? If a Californian resident is travelling within the EU, it seems both European GDPR and Californian CCPA privacy laws will apply. Sometimes businesses have single privacy emails, so if a deleting request is sent how is it responded to? As a CCPA request or GDPR request? CCPA has some differences with GDPR; probably records kept for CCPA requests will be different from those of GDPR. So which law will be applied? (Though not a part of the question, what if this person has dual citizenship of a third country that has different privacy laws? It would be helpful if someone could answer this last question too; it is not required but will be helpful.) This is in response to a comment seeking differences: Firstly a difference would be records for accountability . Obviously records to be maintained for ccpa should be separate given the format and laws . Secondly for gdpr there is an obligation tell about E.U. authorities that in my non lawyer knowledge is not required for ccpa .
It is not an either–or. You may have certain rights under both CCPA and GDPR, but they have rather different mechanisms for determining their scope. When does the CCPA apply? CCPA applies to certain businesses and consumers. It covers any business (regardless of legal structure) that that does business in the State of California and has a certain scale. A consumer means a natural person who is a California resident. These aspects are not influenced by your current location. When you as a California resident travel to the EU, you still have all your CCPA rights against businesses that do business in California. You do not have any CCPA rights against businesses that don't do business in California, for example a national rail company in the EU you've bought a train ticket for. When does the GDPR apply? Whereas the location of the user/data subject can be a factor in the GDPR context, their residency or nationality does not. The GDPR applies to all processing activities by data controllers who are established in the EU, including any businesses, non-profits, and individuals. This includes processing activities in the context of an EU establishment of a non-EU company. For example, GDPR would apply with respect to processing of personal data by a hotel you're staying at in the EU. The GDPR also applies to non-EU data controllers in the context of (a) offering goods or services to people who are in the EU, or (b) monitoring behaviour of people who are in the EU. Here, “offering” does not mean “doing business”, but “targeting or marketing”. For example, you might have installed a smartphone app that assists with sightseeing while in Paris. If this app monitors your behaviour while you are in the EU (such as by tracking your GPS position to alert you to nearby points of interest), that would fall under the GDPR while you are in the EU. The app may also fall under the GDPR per case (a) if it is marketed to / targeted at people who are currently in Paris. That the GDPR applies in such cases comes from the offering/monitoring while you are in the EU, not from your continued presence in the EU. You would be able to exercise your GDPR rights relating to this processing even after leaving the EU. Note that some service or processing activity can fall under CCPA and GDPR simultaneously. For example, this app would also fall under CCPA if the company also does business in California, e.g. if it also provides sightseeing information for Los Angeles or San Francisco. And both CCPA and GDPR could apply when an EU company does business in California. Under which privacy law would a deletion request be dealt with? In practice, most companies don't have this sorted out properly and results are unpredictable. Ideally, a company would just comply with both laws simultaneously, thus making it unnecessary to determine which law applies. Information that is only required under on law can be provided with conditional statements, e.g. “If this processing activity is covered by GDPR, you have the right to lodge a complaint with the supervisory authority in your country”. As mentioned above, both laws can apply simultaneously. Whether GDPR applies and whether CCPA applies are independent questions. However, the answer to neither of these depends on your current location at the time of making the request. In this answer, any statement about the EU applies equivalently to the UK.
Yes, phone numbers would generally qualify as Personal Data under GDPR. It would be so irrespective of whether you have also stored other information along with the phone numbers or not, since also information that indirectly could identify a natural person is Personal Data (provided that there are, somewhere else, public or not public, a register of who holds the specific phone number). See Article 4(1) GDPR. (One could possibly argue that the phone numbers would not be considered personal data if there is no actual register of who owns a specific phone number with any other party. Or if such register is in practice not available for anyone. It might be so in some cases, although I would not rely on it.) Whether you have the right to process the phone numbers must be assessed based on its lawfulness (see Article 6 GDPR). It could be based on consent, performance of contract, legitimate interest or any other ground set out therein.
I understand that storing any hash or IP that can identify &quot;user uniquely&quot; is against GDPR. That is not correct. However any data which is identifiably associated with a an individual human, including any data which could be used to identify that human, is generally &quot;Personal data&quot;, and may not be processed (which includes storing it) without a lawful basis, if the GDPR applies. Any of the six lawful bases allowed by the GDPR may be used, including consent, and the legitimate interest of the data controller. The GDPR does not generally specify that particular technological solutions are permitted or forbidden. If this usage pattern could reasonably be used to identify a particular person, or to single out a person from among a group of people, it is probably personal data, and a lawful basis would be required. Otherwise, not. As for whether such a person is &quot;identifiable&quot; if use of this technique permits the Data Controller to identify two visits at separate times as having been made by the same person, when the later visit is still in progress or is recent, the IP for that visit will still be available, and thus could be associated with the first visit as well. And even if that is not done, such a technique could permit building a profile of such a person, including the actions taken on different visits. I think that would be enough to make this &quot;personal data&quot;.
GDPR compliance is a matter between every customer and the business, not between different customers. How did you get the other customer's contact details? If they were provided or leaked by the business, that might be a failure of the business's obligation as a data controller to protect the personal data they are processing, possibly even a data breach in the sense of the GDPR. When you contacted the other person this was presumably a purely private or household activity, just like contacting any other personal acquaintance. In that case, the GDPR simply does not apply to any “processing” you may have done (compare Art 2(2)(c)). Things would be very different if you were promoting your own business, but that doesn't seem to have been the case. If the matter really is as plain as you described, then you can effectively ignore their references to the GDPR until you are contacted by your data protection authority, by their lawyer, or are served with court papers. None of these should happen: even if you were a “data controller” and your processing were subject to the GDPR – only the other customer and not the business would be the data subject, and only a data subject has a right for remedies like making complaints to the data protection agency and only the data subject would have standing to sue you in court for GDPR violations.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
You do not have to prove that you are an EU citizen, because EU citizenship is entirely irrelevant to the GDPR. Have a look at Article 3, which basically says that GDPR applies if you are in the EU or if the company is in the EU. If the company is in the EU, therefore, you do not need to send them anything or prove anything about yourself to invoke GDPR. If the company is outside the EU, you can send proof of address or other evidence that you are in the EU, which might be something that they already have, like your IP address.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
There are two relevant bodies of EU law to consider here. The GDPR covers processing of personal data. Personal data is any data where the data subject can be identified directly or indirectly. The ePrivacy directive is also relevant, and covers how you may access and store information on the user's device. Directives are not directly applicable law. Instead every member state translates the directive into national law. In the UK, ePrivacy is implemented by PECR. Is the data you collect personal data in the sense of the GDPR? Yes: that hashed unique device ID or a system-provided advertising ID likely is personal data, and any linked data would then be personal data as well. This is going to be the case in particular if you store user accounts on your server and can connect these bug reports to a user. Consider also whether the game save could include personal data, and whether the video clip could be analyzed to identify the data subject. Does this mean collecting this information in bug reports is forbidden? No, the GDPR doesn't forbid or allow anything outright. Instead, you should go through the compliance process. In a nutshell: determine the purpose of this processing, e.g. “fixing bugs” find an Art 6 legal basis for this purpose, e.g. “Art 6(1)(f) legitimate interest” or “Art 6(1)(a) consent” if the legal basis is legitimate interest, you must balance that interest against the data subject's interests determine whether your compliance requirements include creating/updating your Records of Processing, or whether you have to write a Data Protection Impact Assessment implement the processing in a manner that respects GDPR principles such as Transparency and Data Minimization if the legal basis is legitimate interest you must implement an opt-out solution if the legal basis is consent, you must request consent first in a manner that satisfies the Art 7 conditions for consent – and allow consent to be revoked easily prepare to satisfy data subject rights: information requirements per Art 13, usually done in the privacy policy right to access, rectification, erasure, and data portability right to object (opt-out) and to restrict processing be aware of your general requirements a data controller to process this data securely, e.g. use HTTPS connections to transmit bug reports, take steps to protect your own accounts (e.g. 2FA), and ensure you have a suitable contract with any data processors that act on your behalf, e.g. cloud providers or contractors I would question whether your bug reports really need to include a device ID. That isn't forbidden, it just complicates compliance a bit. And what about ePrivacy? The ePrivacy directive is known for its cookie consent requirements. But these consent requirements apply when accessing any information on the user's device, or when applying equivalent fingerprinting techniques. Your game save is not an issue because it is necessary for the game. But that device ID and other system information is more difficult. So what to do? Compliance isn't trivial, but certainly possible. You will likely process the bug reports under your legitimate interest, but might still have to collect consent for accessing a system ID due to ePrivacy. Such a screen might look like this: Oh no, the game crashed! Do you want to send a bug report to the developers? Your bug report will be protected as per our privacy policy (link). Your bug report will contain the following information: … Yes, collect system information and send bug report No, do not send bug report You could make an argument that a bug report can be sent in any case, and that you just need ePrivacy consent to collect useful system information. For example: Oh no, the game crashed! When sending a bug report to developers, do you want to include extra system information (link to details) that helps fixing the problem? In any case, your bug report will be protected as per our privacy policy (link). Your bug report will contain the following information: … Yes, send bug report with extra system information No, send anonymous report