Under GDPR, can I give permission once to allow everyone to store and process my data? If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.
GDPR rights and obligations cover different things: A duty of the data processor towards the government of the country where they operate to present certain documentation, and to implement technical and organizational measures to protect data. These would be audited by government agencies, not the individual customer. A single data subject cannot waive them. A duty of the data processor to process and store personal data only with a legal justification. User consent is one possible justification, if it is informed, revokable, etc. So a single data subject can waive a &quot;ban&quot; on storing his or her data in a database along with all the other users who waived that &quot;ban,&quot; but the duties towards the government regarding that data would still apply. A duty of the data processor to respond to an Article 15 request by the data subject in a certain way and timeframe. If a data subject writes a letter to the data processor and explicitly states that the letter is not an Article 15 request, then Article 15 does not apply. The data subject would of course have the right to make an Article 15 request at a later time.
The GDPR only require explicit (hard) consent if you use the cookie to store personal data. Given the conditions you cite, the data you store is not personal data, so this cookie does not require consent. In theory, someone having access to both session cookie and "analytics cookie" could relate the two, but that is highly non-trivial. You may have to do DPIA to demonstrate that this is non-trivial, or that you have mitigation in place to mitigate staff abusing such access. But provided things are as you say, the "analytics" cookie does not require consent.
First of all, although the GDPR is stated to apply to any site which processes the data of any person who is in the EU, it is not clear how a site not located in the EU, does not business in the EU, and does not primarily target EU residents as its audience can be required to comply with the GDPR. To the best of my knowledge, no such case has yet been brought, much less decided. There has also been some debate on whether an IP address constitutes Personal Data under the GDPR, and if it always does so, or only under particular conditions. The European Court of Justice (ECJ) held that (under the predecessor Directive 95/46/EC) that a dynamic IP address was personal data. But in that case the web site was run by the German Federal Government, which surely has wider scope for getting info from a German ISP than a small private US web activist does. There is not yet any case law that I know of on the applicability of the GDPR to IP addresses in any case at all similar to the one in the question. Joe would in my view be wise to at least learn that logs are being kept, and post a disclosure of this on the site. Whether Joe needs to do more than that is less than clear at this time.
No. Art. 17(1) GDPR lists conditions when erasure can be requested. None of the listed grounds would apply in this case. However, you might have to explain why you process the data (for moderation purposes as you explained above), and why that is lawfully. In particular Art. 5 and Art. 6 need to be taken into account. In your case, processing will be based on Art. 6(1)(f): (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Even if the data subject would be a 9 year old child, the legitimate interests of you and other forum users outweigh the objection of the data subject. Based on Art. 5, there will be a moment when the data has to be deleted. For example 1 year after the last login attempt.
The GDPR will probably not allow a successful demand for erasure in these circumstances. The company does not need to argue &quot;that they can't delete user information for fear of be liable for.something&quot; because GDPR art 17 1(c), 3(b), and 3(e) already make that case for the company. Lets look at the relevant law. GDPR Article 17 reads in relevant part: (1) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (1) (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (1) (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (1) (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); ... (3) Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (3) (a) for exercising the right of freedom of expression and information; (3) (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; ... (3) (e) for the establishment, exercise or defence of legal claims. Art 17 Par 1 (a) only allows erasure when data are &quot;no longer necessary&quot;. But depending on how the purposes were worded by the Controller, they may well still be necessary Art 17 Par 1 (b) only allows erasure when consent is withdrawn and consent was the legal basis for processing. But a contract with the user is a much more likely basis for processing for a financial service. Art 17 Par 1 (c) requires erasure if the user objects and there is no &quot;overriding legitimate grounds for the processing&quot; but the needs to maintain financial records of a transaction is probably an &quot;overriding legitimate ground&quot;. In any case par 3 alloys erasure to be refused &quot;for compliance with a legal obligation&quot; or &quot;for the establishment, exercise or defence of legal claims&quot;. Financial records may well fall into one or both of these categories, at least as regards transaction data. In short it is far from clear that the GDPR will require erasure in these circumstances.
I live in the EU and Facebook has blocked access to my account unless I accept their privacy rules, which means giving up GDPR protections. Facebook operates in the EU and has EU data subjects, therefore Facebook is subject to GDPR. You should be able to withdraw your consent. Article 7(3) says: The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
No, GDPR does not apply here — but other laws might . The General Data Protection Regulation only concerns itself with the following: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. per Article 2. Furthermore, there is a specific exemption (Art. 2 (2)(c)) which would seem to apply to you (emphasis mine): This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. You are sharing the conversation in a purely personal capacity and are not processing it wholly or partly through automated means nor are you intending it to form part of a filing system. Additionally, depending on the contents of the conversation and what you share, there may not be any personal data involved at all. For example, if you only share the messages themselves (and they don't contain any personal data that could identify someone) and censor/black out any names or photographs/avatars from the senders. Either way, GDPR does not appear to apply to you in this context. However, it appears that Article 18.1 of the Spanish Constitution grants the right to &quot;personal and family privacy&quot;, as does the Organic Act 1/982 on Civil Protection of the Right to Honour, Personal and Family Privacy, and Self-Image. It's possible that, depending on the contents of the conversation, the other party involved in the conversation may have a case for action against you in the civil or criminal courts (for example, if the information invades their privacy or is defamatory in some way) if you share the contents of the conversation with someone else. I am not familiar with Spanish law so cannot comment further on this matter.