Is Google obliged to obtain consent for the processing of searches for anonymous searches under the GDPR? If you do not register a personal account for Google, thereby not giving specific and informed consent for the processing of your personal data, are Google still obliged to obtain consent for the processing of your searches for uses outside the scope of performing the search itself for searches under the scope of the GDPR? For example, the search and subsequent search results clicked could be used by Google to improve future search results, or improve ads personalization.
Whether consent is necessary depends on the specific processing purposes. For example, general usage statistics about search terms or about the usage of the site likely fall under a legitimate interest. Outside of the GDPR, there can be consent requirements for the use of specific technologies. Per the ePrivacy directive, consent is required for accessing or setting cookies on a user device, unless the cookie is strictly necessary for the service requested by the user (“functional cookie”). This consent requirement also extends to other storage and fingerprinting technologies. A functional cookie could e.g. be used to store a history of search terms on the user device itself. However, ad personalization is not strictly necessary for the search functionality, so setting cookies (or using similar technologies) for ad personalization requires consent, regardless of whether ad personalization itself would require consent. To determine whether a processing purpose falls under a legitimate interest, the data controller must weight the interest against the data subject's rights and freedoms. There are no objective guidelines on this, and ultimately a court would have to decide. However, I would assume that the tracking necessary for ad personalization is an inappropriate infringement on the data subject's rights and freedoms, so that ad personalization cannot fall under a legitimate interest. The data controller would have to choose a different legal basis, which effectively only leaves consent.
Don't collect or process personal data Many (though of course not all) websites can easily be run without collecting or otherwise processing any personal data. The position of GDPR is that if you are not able to fulfil the basic, simplest core conditions for processing personal data (understanding what you're processing and why and why it's allowed, describing it in a privacy policy, having a non-underage person who's responsible for that) then you are not allowed to process personal data of other people. So don't. Build your website so that any personal data are not collected.
Under GDPR article 6 paragraph 1 item (c) one lawful basis for processing personal information (PI) is: processing is necessary for compliance with a legal obligation to which the controller is subject; The obligation to attribute a reused work under a CC license is such an obligation. Moreover, the licensor has the option under any CC license to specify a pseudonym for attribution of that work, or to waive attribution totally. Not doing that while releasing content under a CC license that requires attribution could reasonably be considered consent to publish that name along with each re-released copy of the work, so there are at least two lawful bases for processing that name and making it public. In some jurisdictions the license has the status of a contract, which imposes an obligation to attribute the author properly under GDPR Article 6 paragraph 3, as described in more detail in the answer by amon. Also, usernames are PI if and only if it is reasonably possible to associate them with a specific natural person. If a person chose a user name for a single site, not used for any other, and did not post any info that allows the person's identity to be determined, it is not PI. Often, of course, the person can be determined.
GDPR rights and obligations cover different things: A duty of the data processor towards the government of the country where they operate to present certain documentation, and to implement technical and organizational measures to protect data. These would be audited by government agencies, not the individual customer. A single data subject cannot waive them. A duty of the data processor to process and store personal data only with a legal justification. User consent is one possible justification, if it is informed, revokable, etc. So a single data subject can waive a &quot;ban&quot; on storing his or her data in a database along with all the other users who waived that &quot;ban,&quot; but the duties towards the government regarding that data would still apply. A duty of the data processor to respond to an Article 15 request by the data subject in a certain way and timeframe. If a data subject writes a letter to the data processor and explicitly states that the letter is not an Article 15 request, then Article 15 does not apply. The data subject would of course have the right to make an Article 15 request at a later time.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
Your analysis so far seems correct. You must comply with all applicable laws. The GDPR's Art 6(1)(c) legal basis clarifies that having to provide personal data is no excuse: that legal obligation is all the legal basis you need for sharing the personal data in accordance with your obligations. However, that legal basis doesn't generally excuse you from your other data controller obligations. For example, you should still inform the data subjects about the processing as per Art 13(3).
IANAL. (1) GDPR is certainly relevant. (2) This is certainly "personal data" under the definition in GDPR article 4. (3) Maintaining this data is probably lawful under article 6 sections 1(a) (consent) - provided that the Terms and Conditions of the site make clear that the user by signing up is consenting to this information being held (3) There is certainly an obligation under article 14 to disclose that the information exists, and to say how it used. (4) Article 15 says that data subjects are entitled to see the information and know what recipients or categories of recipient have access to the information (I don't know whether it's enough to just say "moderators", or whether the moderators need to be identified). (5) I can't see any reasons why the obligations under articles 16, 17, and 18 regarding rectification, erasure, and restriction of processing aren't relevant. This is exactly the kind of situation that GDPR is designed to address. If you're restricting the service available to particular users based on a record of their behaviour or on judgements made by moderators, then they absolutely have a right to know, and a right of redress.
From the GDPR's definitions: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; This blurred image would be &quot;information relating to an identified ... natural person (‘data subject’).&quot; It does not matter whether the person can be identified using the information in question. Therefore, the answer to your question Under GDPR, does blurhash of a profile picture count as personal data is yes.