Inactive account deleted under GDPR (data retention) laws. Should the credit on it have been refunded to the account holder? I have a situation where a UK utility (mobile phone) account has been inactive for more than 7 years. The account was deleted under data retention laws (GDPR) but had a positive credit balance at the time. No attempt was made to contact the account holder and refund the credit on it. Are the company entitled to do this, or is the account holder entitled to a refund? In the latter case, is there any point in pursuing the case in the absence of verifiable records?
There are two &quot;cancellations&quot; here. There is a contract between the customer and the company. This contract was ended. Also, as part of GDPR obligations, the data of the former customer was removed. Now the &quot;credit&quot; part suggests a pre-paid phone, which are often described as &quot;no contract&quot;. Legally this is incorrect. There is a contractual obligation for the phone company to deliver phone services (typically expressed in minutes of call time, # of text messages and/or MB of data). Now the pre-paid contract with high likelihood had a clause which dealt with inactive accounts. For instance, the minutes of call time may expire after 5 years. A &quot;credit&quot; that has not been converted to minutes, messages, or megabytes may also expire. When this happened, the company might need to keep the customer data on their records for two more years (for legal reasons), so the 7 year period does not sound weird at all. As soon as the legal reason to retain the data has ended, the GDPR indeed states that the data should be removed. That act is not connected to the credit expiring years before.
Maybe, but probably not The geographic location of the organisation is immaterial: under Article 3.2: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ... (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Posts anyone (not just EU citizens) make to Reddit (or anywhere else) while they are physically located in the EU or UK engage the GDPR. Pushift.io is therefore captured by the GDPR and any denial of that is just plain wrong. Given the denial, it is likely right out of the gate that they are non-complient. For example, they are unlikely to provided the required information under Article 14. More importantly, it seems that they have not determined the lawful basis for processing the data under Article 6 - they can possibly rely on the public interest basis (preserving deleted publication is arguably a public interest) or a legitimate interest but that requires a balancing of their interest against the data subject's. That said, the right to be forgotten is not absolute, the reasons that might be applicable here are: The data is being used to exercise the right of freedom of expression and information. The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority. The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
I think the law there is quite clear - you have 14 days to return the goods for a full refund, except for digital content, which you can't return once you started downloading it. That's what it says. The arguments that you try to give were quite obvious to the law makers. I think you can assume they were aware that "digital content does not have a physical form". Now if you purchased, but haven't downloaded or started downloading yet, then obviously you can get your money back. You came up with some theory that this is a "visual vanity item". You can't see it unless you download it. Once you download it, that's it. If you don't download it, you can return it. Let me repeat this: Your fancy analogies mean nothing. There are in the EU laws about being allowed to return goods for a refund. There's the general rule for buying in a store (no right other what the store offers voluntarily), online purchases (some days to return), and online purchases of digital goods (no return once you started downloading). That's the law. Your attempts at redefining the situation are totally pointless. The law says what it says. What you try to redefine doesn't mean one thing. The law clearly distinguishes several situations, and analogies don't count. What happens counts. You bought from a digital item from an online store that needs to be downloaded. And as soon as you start downloading, there is your right to return it gone. And your reasons for wanting to return the goods are completely irrelevant. You don't need any reasons, and having reasons doesn't help you.
Please note that I'm not a lawyer. If you need specific legal advice, please consult a qualified attorney. Every time someone buys an item from someone else, there's at least an implied contract of sale where the seller of the item agrees to give the buyer the item to be purchased in exchange for a sum of money or other object of value which the buyer agrees to pay as consideration. Generally, in an online purchase, a contract of sale is completed when payment is made and the product has shipped. If the seller fails to provide the item you intended to buy after you make your payment, that's a breach of this contract of sale as the seller has failed to execute their end of the contract. I seriously doubt a "no refunds" policy would excuse the vendor for breaching the contract of sale. If you cannot resolve the issue with the vendor, then your best bet is to initiate a dispute through your credit/debit card issuer.
Yes, that might be a violation of data protection law such as the DPA 2018 / UKGDPR, but not necessarily so. It depends on the details, for example on the purpose this camera serves. Background on Fairhurst v Woodard and on legitimate interests Fairhurst v Woodard is a significant case discussing implications of use of video surveillance outside of a commercial context, but it is a complex case due to the multitude of cameras involved and due to the somewhat unrelated privacy and harassment issues. Point 135 is about the Driveway Camera, which only surveilled public property and the claimant's property, but did not view any part of the defendants property. People are free to surveil their own property, and would then be covered by the UKGDPR household exception. But for surveillance outside of their own property, defendant would have to comply with the DPA 2018 and the UKGDPR, for which defendant would have needed a legal basis. The defendant argued that they had a legitimate interest (Art 6(1)(f) UKGDPR): 134. […] The Defendant submits that all his data collection and processing was necessary for the purposes of crime prevention at his property and in the car park However, a legitimate interest always require as balancing test. The legitimate interest can be “overridden by the interests or fundamental rights and freedoms of the data subject” (Art 6(1)(f) UKGDPR). It is not necessary here that these interests, rights, and freedoms are explicitly enumerated in statutory law. Here, a right is claimed without supporting legal basis: 134. […] Claimant submits that her right to privacy in and around her home overrides that purpose. However, a possible basis for this claim would be Art 8(1) of the European Convention on Human Rights, which is part of UK constitutional law: “Everyone has the right to respect for his private and family life, his home and his correspondence.” The court balances these rights and interests very differently for the different cameras. The Ring Doorbell is mainly focused on people who would ring the defendant's doorbell, and only incidentally captures passer-bys. Here, the legitimate interest was found to be valid. On the other hand, the Driveway Camera was mostly trained on claimant's property. Here, claimant's interests, rights, and freedoms override the claimed legitimate interests. Your scenario If the camera records the people living in the Green House when they go to or from their property, then yes, it seems like their rights would be affected. But in your scenario, the context of the camera is not clear: Why was it installed? If the purpose is crime prevention, is there evidence of such crimes in the neighbourhood, or are the cameras intended to counter a speculative threat? What is its field of view? Is it mainly trained on the Yellow House's doorstep and only captures the street as a background, or does it focus on the street? Is the camera's field of view masked off as far as possible to exclude public spaces? Does the camera record continuously, or is it only activated for certain events like when a doorbell is rung or when someone enters the Yellow House property? Does the camera also record audio? All of this is important because it factors into a legitimate interest balancing test. Maybe the Yellow House camera is more like the Ring Doorbell in the above case where the incidental capture of passer-bys was found to be acceptable, maybe it is more like the Driveway Camera that served no legitimate interest. There is no absolute right to be free of all surveillance. Instead, the interests and rights of the Green and Yellow house residents must be balanced appropriately. Where there is surveillance, it must be limited to what is necessary.
"I contacted LG directly over the phone eight days ago, bypassing the retailer because I assumed they were off the hook after two years and ten months, and it should be the manufacturer assuming responsibility." Nope. In the EU (and Britain still is), the retailer is the only party with a legal warranty duty (at least 2 years, national law may deviate to the benefit of the customer). The manufacturer may offer any additional warranty, but even if they do that does not absolve the retailer. The UK does have a longer warranty period than the EU minimum if you can prove the product was faulty, but this is a reversed proof, and it still binds the retailer instead of the manufacturer.
TL;DR In theory there's nothing wrong with your method, it's just a way to authenticate the user, and without authentication a user has no right to request anything anyway. But in practice it looks like your method doesn't have a way to deal with situations where users lose or forget their authentication data and want to be able to recover their account. Failing to deal with that in a modern system might be considered an unacceptable bad practice and so be against the GDPR principles of security and privacy by design. EXTENDED VERSION I might be wrong or not understand the question correctly, but I don't see how this is different from many other common cases where encryption is not involved. Think about it, you aren't able to give the user their own personal data unless they provide the ID and encryption keys. How is this significantly different from the fact you aren't able to (or rather you should not) show a user their own data unless they provide their own username and password, or they convincingly authenticate themselves in any way? Just like you can't ask Facebook to show you all the data collected about Donald Trump only by claiming you are Donald Trump, you can't be required to give a user their own data unless they provide the encryption key. It can be seen as your way to authenticate users (among other things). Edited: multiple IDs/keys I didn't understand your method involved multiple IDs and keys. In theory, the situation is still the same, only with multiple pieces of data for authentication, like the user had to remember multiple usernames and passwords. Failing to provide all IDs and all keys will result in a partial authentication. But with such an approach a potential problem becomes more evident: your authentication scheme might be against the GDPR principles of "security and privacy by design and by default". Basically, your methods might be considered bad practice because they fail to deal with the common issue of lost or forgotten passwords. If a user tells you they have lost a USB drive containing all their IDs and keys and they don't have them anymore, what do you do? You can't delete their data because you aren't able to know what their data is, without another way of authenticating. And their data is now at risk, because somebody else might have their IDs and keys. If you had an email address associated with all the user's IDs and data, then you might be able to confirm their identity (for example sending an email with a link) and delete all their data. As you see, things can get pretty complicated, it all depends on the details of your implementation, and just adding or removing one detail might change the whole scenario.
Contacting a business email about a business matter is usually fine, but in this case we have an unsolicited marketing communication (spam), not really a business matter. The client's jurisdiction likely has more specific rules about spam. Also, it is unusual (read: presumably illegitimate) to contact individual employees rather than the company's official address with the offering. From the GDPR perspective, every processing of personal data (such as email addresses that might identify natural persons) needs a legal basis (Art 6). Let's go through them: consent? No. necessary for performance of a contract involving the data subject? No. legal obligation? No. vital interests? No. public interest? No. legitimate interest? Perhaps. The client has a legitimate interest to conduct their business. However, this legitimate interest must not be overridden by the data subject's interests, rights, and freedoms. Such as the interest in not being disturbed by spam mails. It is the Data Controller's (your client's) responsibility to balance the legitimate interest themselves to determine whether they have a legal basis, but I really don't think that they do. In conclusion, your client's idea is a bad idea: They likely do not have a legal basis for this under the GDPR. They are likely violating more specific anti-spam laws in their jurisdiction. They are working hard to get their domain put on spam filter lists. Note that already the step of collecting employee email addresses is personal data processing and needs a legal basis. Of course, the GDPR does not apply when the client is not established in the EU and only processes the addresses of persons that are not in the EU.