Does a user have the right to request their forum posts deleted? Forum posts and similar stuff: chat messages from chatlogs, etc. According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered personal data under GDPR. In this case, does a person have the right to request permanent removal of their posts from an Internet forum or from chatlogs? This breaks the flow of the archived conversation and makes it difficult for readers to understand posts of other people that are not removed. Does a person have the right to request removal of certain posts without removing their account? Moderation problem; a person may request removal of posts that are stored as evidence of their past problematic behavior, in an effort to keep bordering the forum's rules without ever crossing the line to getting suspended. If a person requests all their data deleted, is anonymizing their contributions enough? I've seen an EU-based Internet forum that, on account deletion request, anonymizes all posts from this account (repleaces the author's nick with 'account deleted'), but leaves them in the archives. This still damages the flow of a past converstation, but not as badly as if the post was outright removed. Other posts may contain the nick of the author of an anonymized post ('what @username said, ...'), making such anonymization questionably effective IMO? Bottom line: If a user requests all their posts on an Internet forum deleted under GDPR, do I have to comply? Do I have to also censor other users' posts, which may contain this user's nickname and / or quotations of their posts?
Earlier this year, the Internet lawyer Arnoud Engelfriet wrote a blog post about exactly this topic. As it is written in Dutch, I will summarize it here: As you also said, deleting posts breaks the flow of the archived conversation and it makes your archive incomplete. This is a problem for the freedom of expression and information. But Art. 17(3) GDPR includes an exception to the right of erasure for this situation. So posts do not need to be deleted. However, profiles are not included in this exception. So they must be removed, but they can be pseudonymized. For example replace the username with user89432, and remove all details from the profile. If other posts contain the nick of the author of an anonymized post, that is considered an journalistic, academic artistic or literary expression, so Art. 85 GDPR would apply, so the right of erasure does not apply to that. Bottom line: you only have to pseudonymize the account, if that person wants to be removed from the forum.
These are only tangentially related to the GDPR A government entity processing data in accordance with a member state law is ipso facto in compliance with the GDPR. That’s because lawful government data processing is a legitimate reason for processing data under the GDPR. If Germany, for example, passes a law saying German police can record every phone call in Germany, then that would be a lawful basis for processing under the GDPR. There may be constitutional or other legal limitations on such a law but as far as the GDPR is concerned, they’re fine.
Yes, this violates the GDPR if the user is in Europe. Data which is tied to a personal device can be tied to the person who owns it. From "What Is Personal Data" by the UK Information Commissioner's Office (ICO) (emphasis added): Personal data is information that relates to an identified or identifiable individual. What identifies an individual could be as simple as a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors. If it is possible to identify an individual directly from the information you are processing, then that information may be personal data. If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual. The bit about "all means reasonably likely" in the last bullet includes the kind of de-anonymisation tactics described in the NYT article. There are 6 lawful bases for data processing in the GDPR, and all processing must fall under at least one of them. (a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. (b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. (c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). (d) Vital interests: the processing is necessary to protect someone’s life. (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. (f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) Selling data isn't covered by any of the others, so consent must be obtained. Permission must be clear and positive, and you cannot predicate delivery of a service on the processing of data that isn't necessary for that service. So for instance you cannot say "You can use this service as long as we are allowed to collect and sell your data" because selling the data isn't necessary to the provision of the service. From "Consent" by the ICO: Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. Explicit consent requires a very clear and specific statement of consent. Keep your consent requests separate from other terms and conditions. Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough. [...] Avoid making consent to processing a precondition of a service. This applies to any processing of data about individuals within the EU, so just being an American company doesn't get you a free pass to ignore the GDPR if your app gets used by Europeans. The "Legitimate interests" basis is more problematic, in that the company collecting the data has to conduct a vague "balancing test" to determine if this basis applies. For direct marketing the ICO has written this, which says that direct marketing may be a legitimate interest, especially if you can show that the user has expressed interest in such adverts. For instance a location service which promises to tell you about nearby special offers would fall into this category. Against this, the impact on the user's privacy has to be considered, and location data is "special category data" because it can reveal medical information (e.g. hospital attendance) or religious affiliation (e.g. which church you go to). So unless the relationship between the recorded location data and the service is very direct its not going to pass the balancing test. The company would also need to distinguish between knowing the current location and keeping a record of historical locations; the two need separate justification. And of course nothing about this covers the sale of the data; this is considering a company which sells advertising space in it's app, not one that sells the data itself.
It is any law protecting me from the people that distrubute a video of me falling the stairs and shared without my permision? No. Your permission is not necessary for distributing or watching that video. The recording was from your workplace, where your entitlement to privacy is quite limited unlike few settings such as (1) your attorney's office in the course of obtaining legal advice for which the disclosure was needed, or (2) your home. Even if such an entitlement existed, your decision to share that recording with the person who was with you generally constitutes a waiver of your right to privacy regarding that incident. The waiver would apply even if California had some legislation akin to the EU's GDPR. Your description nowhere indicates that that person had a statutory or equitable duty of confidentiality. It is also highly doubtful that you would wish to block the distribution of the video if people instead of mocking you expressed something pleasant or encouraging to you. people who I don't even know their names come to me to comment about the video and joke about not falling again. That is not unlawful in and of itself. Since the matter does not involve a protected category such as sex, race, religion, or disability, pursuing a claim of hostile work environment would be quite a stretch. It would also be futile because any relief would not cover outsiders who watch the video and feel like joking about it. The notion of harassment entails a pattern of conduct (meaning that a person engages twice or more in that conduct) that causes a reasonable person to feel annoyed or concerned for his safety. Even if someone engages makes a few jokes that cause you to get annoyed, any petition for restraining orders seems unlikely to succeed. Sooner rather than later, the jokes will get old and people will move on.
You have the right to request anything you want, but there is a very limited set of things that you can have a legal expectation of them doing. The service provider has no obligation to block a user. You can likewise request a report, and from a pirate site I would expect no response. There is no legal requirement that a pirate site block an offending user after a certain number of offenses. There is no direct way to compel a pirate site to ban a user. Indirectly you might accomplish that end if you take legal action against the site, which causes them to ban a user in order to protect themselves If a DMCA request was not "proper" (the correct legal form) they will not perform a takedown, and may not inform you that they won't. Make sure your takedown request is legally correct and actually delivered to the correct person. If they still ignore your request, they will have lost the "safe harbor" provisions, and you can theoretically sue them. Since the pirate site presumably only hosts a link to elsewhere, their making public such a link is not itself copyright infringement, so you need to be going after the ISPs who manage the actual host sites. The pirate site might still be a contributor to infringement, along MGM v. Grokster lines. A standard defense against infringement would be "We had no idea", and ignoring DMCA takedown notices is clear proof that they did have an idea. That's basically what DMCA takedown is about: saying what it takes to use the "We had no idea" defense.
I think there are a couple of different ways to look at this. Deduplication is a technical detail that's irrelevant here While the data may be deduplicated on a technical level, the files remain logically distinct. If users 1 and 2 upload identical files, and then one user edits or deletes their file, this will not affect the other user's data. Users cannot tell whether their files are duplicates of someone else. From the user's perspective, it makes no difference whether or not the storage uses deduplication, except perhaps via the cost of the service. Because there is no user-perceptible difference, it would be difficult to interpret some GDPR significance into this scenario. Whose personal data is it anyway? Personal data is any information that relates to an identifiable data subject. The files here are likely to be their uploader's personal data. Thus, the uploaders would also have a right to have their uploaded files erased. In case of deduplicated storage, this would affect their logical copy. The contents of the uploaded files might also be personal data relating to a third party. Then that third party might have a right to get the file contents erased. But this right must be invoked with the data controller for that processing activity, which might be company A, company B, or the uploaders, depending on context. Which leads us to the next aspect: Company A is not responsible for handling erasures From your description, it sounds like company A is a data processor providing services on behalf of company B. In turn, B might be a processor acting on behalf of the uploaders. In any case, it seems that A would not be the data controller for these processing activities. Data subject rights like erasure must be invoked against the controller, as only the controller can understand whether such a request should be granted. The right to erasure is not absolute, and depends a lot on why that data is being processed. In particular: Personal data need not be erased if it is still necessary For example, a person might very well be the data subject of some of these files, and might then ask for erasure. But if the files are being stored because they are going to be needed as evidence in legal proceedings, the data subject can't use this GDPR right to destroy evidence. The data controller would be allowed to refuse a request in such cases. It could now happen that two different users of this deduplicated storage are storing the same file, but for entirely different purposes. Blanket deletion of all copies of a file could be quite problematic. Note that deletion is also a &quot;processing activity&quot; and needs a legal basis under the GDPR. Unexpected data loss could be a data breach. One user's erasure could be another user's reportable data breach incident. Thus, I would strongly expect such requests to be handled on a logical file level, not on the deduplicated storage level. Caveat: public access and cloned files If the (logical) file is made available to the public who can then clone or copy this file, and if the &quot;original&quot; is taken down due to an erasure request (or copyright takedown notice), it might be appropriate to remove logical clones as well. Again, this might not involve deleting the contents on the deduplicated storage level, but it might affect other users' copies. In a GDPR context, the grounds for this would be the Art 17(2) right to be forgotten: Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. But this depends crucially on who those other controllers are. If A is the sole controller, the logical files could probably be deleted directly. If B or the end users are controllers, it could be more appropriate to forward the erasure request to them.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
It is not possible for someone to forfeit their rights because the GDPR is compulsory law. In the EU, laws can be regulatory or compulsory. In case of an agreement, regulatory laws can be set aside, if both parties agree on that. But compulsory laws cannot be set aside. Of course laws can also be partly compulsory. For example provisions which cannot be changed in disadvantage of a consumer. So there is freedom of contract, but it's freedom is reduced by law for the common good or for example to avoid misuse of bargaining power. In particular consumer related laws are often compulsory because it has little power against the other parties. Companies can have their negotiations done by lawyers, so they can make a well informed an well negotiated decision. As an extreme example, you cannot kill someone, even if that person has given you written permission. See also "Peremptory norm" on wikipedia for international law examples.