How to &quot;withdraw consent&quot; without implying consent was ever given? Privacy policy often states that one can &quot;withdraw consent&quot; to the collection, use and disclosure of personal data. Unfortunately, it is often the case that consent was given to the collection, use and disclosure of personal data for a particular use case, but somehow the data was used for other unstated use cases. How can I &quot;withdraw consent&quot; without implying consent was ever given, so that I reserve the right to take further action in the future?
You could say something like &quot;I do not consent to [XYZ], and I revoke any consent I may have given in the past.&quot; That makes it clear that you intend to revoke consent, without acknowledging that you ever did consent.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
It is generally legal for a business to ask, but it is not legal for a business to insist that you provide it as a condition of providing goods and services unless a law requires that the SIN be provided. As explained by the relevant Canadian government website: While there is no law barring businesses from asking for the SIN where there is no legal requirement to do so, they do need to make people aware that collection of a SIN is optional and not a condition of service. The Personal Information Protection and Electronic Documents Act (PIPEDA) sets out ground rules for how private sector organizations may handle personal information — including the SIN — in the course of commercial activities. Under the law, organizations cannot require you to consent to the collection, use or disclosure of your personal information unless it is required for a specific and legitimate purpose. This means that, unless an organization can show that your SIN is required by law, you cannot be denied a product or service on the grounds of your refusal to provide your SIN. Of course, the rub is, that an employer is legally required to have your updated SIN for tax purposes, so the employer is allowed to demand, rather than merely request that you provide it. In particular: 7.3 In addition to the circumstances set out in section 7, for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, a federal work, undertaking or business may collect, use and disclose personal information without the consent of the individual if (a) the collection, use or disclosure is necessary to establish, manage or terminate an employment relationship between the federal work, undertaking or business and the individual; and (b) the federal work, undertaking or business has informed the individual that the personal information will be or may be collected, used or disclosed for those purposes. A business is required to do this consistent with Schedule 1 to the Act which provides in the most pertinent part: 4.7 Principle 7 — Safeguards Personal information shall be protected by security safeguards appropriate to the sensitivity of the information. 4.7.1 The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Organizations shall protect personal information regardless of the format in which it is held. 4.7.2 The nature of the safeguards will vary depending on the sensitivity of the information that has been collected, the amount, distribution, and format of the information, and the method of storage. More sensitive information should be safeguarded by a higher level of protection. The concept of sensitivity is discussed in Clause 4.3.4. 4.7.3 The methods of protection should include (a) physical measures, for example, locked filing cabinets and restricted access to offices; (b) organizational measures, for example, security clearances and limiting access on a “need-to-know” basis; and (c) technological measures, for example, the use of passwords and encryption. 4.7.4 Organizations shall make their employees aware of the importance of maintaining the confidentiality of personal information. 4.7.5 Care shall be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information (see Clause 4.5.3). There is really no specific provision allowing you to refuse to provide information via email, but the Safeguards provision does state that appropriate care does need to be taken to avoid disclosure, and you are disputing that their email collection is adequate. Also, while employers are required to collect SIN data from employees, there is nothing that expressly requires them to collect it via email. If you wanted to compromise, one option would be to save the SIN in a password protected word processing document (usually available in the save as window in an obscure little corner), and then you could attach the password protected document to the email and communicate the password itself to the recipient orally via telephone with you calling their number to prevent any phishing scam. It's a bit clunky, but it gets the job done. Also, please recognize that while a SIN number is important to keep confidential to the extent possible, it is hardly the most sensitive personal information in existence. Lots of people have a need to know it for legitimate purposes and it probably wouldn't be hard at all for someone to get it illegitimately by making a request for your credit record or a tax return transcript under false pretenses.
I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to: personal information published on the blog pages personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR) and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains) Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here. About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity". C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog. Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity. Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR). There may be other approaches apart from these 3, but that's a start for your considerations.
No. From here: Organisations must not send marketing texts to individuals without their specific, valid and prior explicit consent. This consent must be recorded and kept as proof of consent. There is a limited exception for previous customers, which is known as the soft opt-in. A soft-opt in only applies if the organisation have obtained the contact details in the course of a sale (or negotiations for a sales) of a product or service to the customer; they are only marketing their own similar products or services; and they gave the customer an opportunity to opt-out of the marketing, both when first collecting the details and in every message thereafter.
The cookie consent requirement comes from the ePrivacy Directive, not from the GDPR. While the GDPR defines consent, cookie consent is required regardless of whether the cookie actually contains personal data. Instead, it says we can access information stored on an end users device under the following circumstances. Technical access to the information is used for the sole purpose of performing a transmission over a network, e.g. using a browser cache. Accessing the information is strictly necessary for providing a service explicitly requested by the user, e.g. session cookies or a consent-declined cookie. The user has given consent to the access, where consent is defined by the GDPR (freely given, informed, specific, …). The first scenario likely doesn't apply because your cookies aren't likely to be “technical storage or access” in the sense of ePrivacy, and because the tracking cookies wouldn't be used for the sole purpose of carrying out a transmission. The second scenario doesn't apply because tracking cookies are not strictly necessary to interact with the webshop, as evidenced by the possibility to opt out. The service explicitly requested by the user is the webshop or website, not the A/B testing. This only leaves consent as possible grounds for storing or accessing information on the user's device. It is already the storing or access that is covered by ePrivacy, not only later use as a persistent identifier. Your suggestion – to first set the cookie and then delete it if it shouldn't have been set – is more compliant than many set-ups I've seen, but is still technically non-compliant. It is also likely to fail in practice under non-ideal network conditions: if the request to see whether GDPR applies times out, or if the user closes the browser tab before the cookie will be deleted, the tracking cookie will remain without consent. I would instead suggest to consider the following points. It seems that by itself, Optimizely Web cannot be used in a compliant manner since it doesn't provide sufficient control over how cookies are managed. Thus, you should avoid loading such tracking scripts unless consent has been given, or unless this processing falls outside of EU/UK law. Currently, you defer loading of tracking scripts until you know if you have to ask for consent. This can be avoided if you always ask for consent :) This can also be avoided if you load the tracking scripts from a server that can independently determine whether the requests comes from the EU. For non-EU requests and for users with opt-in, the server can return the original tracking scripts. Otherwise, the server returns a dummy script. This server can be independent from your website's hosting. By combining the jurisdiction decision with the loading of the script, one roundtrip is saved and latency is reduced. Finally, no one is forcing you to use Shopify, and ePrivacy/GDPR is not required to accommodate their limitations. You do have different choices: use Shopify, at the cost of slow pages and limited A/B tests use a different A/B test provider that can be used without setting cookies use edge computing to do stuff in between of the browser and the original server use a different webshop platform ignore EU laws Well, one of them is clearly unethical. But you do have choices, and which choice you take is a business decision. Slow pageloads and consent banners are likely costing you conversions, but Shopify might be providing massive value that outweighs all that.
In england-and-wales this would fall within the Mental Capacity Act 2005 and depends on whether he lacks the mental not physical, capacity to make the decision for himself. Can he: Understand the information relevant to the decision Retain that information Use or weigh that information as part of the process of making the decision Communicate that decision (whether by talking, using sign language or any other means). If the answer to any of these is&quot;no&quot; then he cannot lawfully give true consent. Although the Act allows for others, such as a power of attorney, to make decisions on behalf of someone lacking the mental capacity, s.27 specifically excludes the decision to marry.
You don't know. You can't know. And you can't force the officer to tell you. Detention Status As a practical matter, you have no way of knowing if you are compelled to follow an officer's order because you are being detained unless the officer volunteers that information (your detention status) which they are not compelled to disclose and have every incentive not to disclose. Consider the situation when the officer does not have reasonable suspicion do detain you. If the officer instantly informs you that you are "free to go" then you are likely to leave and end the encounter immediately. However, if the officer says nothing, then you might stay and inadvertently say or do something that would give the officer reasonable suspicion to detain you from that point forward. Your behavior during that detention could lead to probable cause, arrest, etc. Every officer knows they have nothing to gain by being quick to tell you you are free to go. Deceptive Conduct To compound the issue, police encounters are particularly problematic because police officers have a lawful right to engage in deceptive conduct during an investigation including but not limited to lying. You, on the other hand, can be prosecuted for lying to the police conducting an investigation. (See this article for more information.) Hobson's Choice Therefore, all things considered, police encounters present a Hobson's Choice. Either comply with every order in an effort to end the encounter quickly. Or try to press the officer to determine whether you are "being detained" or "free to go." The former course of action voluntarily cedes some of your rights. The latter risks "provoking" the officer into making your encounter more difficult, painful or costly than it otherwise might be. Never Consent to Searches That said, you are never under any obligation to consent to a warrantless search of your home or vehicle. Typically, saying, "I do not consent to searches." is usually sufficient if asked. Evidence obtained from warrantless searches is barred from being used at trial unless you waive this right by consenting to the search. See this question (and answers) if you are concerned about the officer falsely claiming you gave consent if you didn't. Never Talk to the Police As a legal matter, talking to the police can never help your case in court. Anything you say to the police that might help your case (i.e., exculpatory) is not admissible as evidence because it's hearsay. On the other hand, anything you say to the police can and will be used against you. In fact, even if you are completely innocent of all crimes AND you are completely 100% truthful to the police, you can still give the police all they legally need to convict you of a crime simply by talking to them. Whereas, without your statement, they would not have had sufficient evidence to convict. See this Youtube video for more details and examples of how this can and does happen every day. Practical Matters The above analysis presents the reader with some practical concerns. You don’t want to risk being harmed by an officer in fear for his safety. You don’t want to be handcuffed and taken to the police station if you can avoid it. You must obey all unconditional commands of a peace officer. It does no harm to inform the officer that you are willing to comply with all unconditional legal commands and ask him or her if a given command is, in fact, unconditional. Some attorneys go in the opposite direction from the "never talk to the police" rule and advise that, say in the case of a domestic violence dispute, the best course of action is to answer police questions matter-of-factly, never lie and never admit guilt. That course of behavior can avoid a potential trip to the police station in handcuffs in the back of a police car even if you are never ultimately arrested. TL;DR: Police encounters are tricky. It's difficult to know what to do. The best course of action is to educate yourself about your rights and the law and apply judgment and common sense to guide your behavior to achieve the best outcome. I am not an attorney. I am not your attorney. This answer is not legal advice. Please consult an attorney to obtain proper legal advice.