Shoud a company send to customers of its clients notice when getting data about them under GDPR Article 14? A SaaS company (A) provides services, (e.g. web hosting) for its clients, (e.g. web agency B). The clients can create websites for their customers (C) and host them using the web hosting. Web agencies can also create child accounts for their clients in the hosting dashboard (user management). Child user accounts or hosted websites may contain personal data. According to GDPR Article 14, should A send notice about private data to C when B creates child account for C or hosts site of C?
No, The SaaS company should strive to be a Data Processor for the web agency, and the web agency will likely want to be a Data Processor for its customers in turn. A Data Processor processes the personal data only as instructed by the Controller. The SaaS company should not be a Data Controller itself. Being a Data Processor requires a contract that fulfils the condition in Art 28 GDPR. It is the Data Controller's responsibility to provide transparent information to Data Subjects. However, some of the involved tasks can be outsourced to a Data Processor. If the SaaS company deals with customers directly, the company might be a Controller for some and a Processor for others, or possibly both but for different processing activities. This depends on whether the customer is a Data Controller, Data Subject, or both in this context. If the SaaS company receives data from third parties in its capacity as a Controller, then yes, it must inform the data subjects as required per Art 14. But the mere creation of an account would likely not mean that personal data was obtained from a third party. This ultimately depends on the details of the account creation process, though.
GDPR definitely applies. Your scenario seems to raise two questions: What is the legal basis for processing? Are the security measures appropriate? Legal basis Every processing activity of personal data requires a legal basis. Most well-known is consent, but there are six categories in Art 6(1) GDPR including legitimate interests and necessity for performing a contract with the data subject. Conditions on consent are laid out in Art 7 GDPR. You say that data subjects “explicitly agree to the website's privacy policy and GDPR”. The GDPR does not generally expect “agreement” to a privacy policy, as information per Art 13 is an unilateral notice. Such general agreement also cannot constitute valid consent. In the context of certifications, the legal basis would likely be necessity for performing a contract with the data subject: You were contracted to provide this validation service to the data subjects. You should however make it clear which information will be displayed on the validation page (other than a valid/not valid) response. For example, I am concerned that showing the email address would not be strictly necessary for providing the validation service. You should also consider whether this validation service is a core component of your certification service, or whether there should be an opt-in or opt-out here. Security Measures The GDPR requires that you implement appropriate security measures, “taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms” of the data subjects (see Art 32 GDPR). This gives you a lot of leeway to determine what measures are appropriate, but also criteria that you must consider in your determination. A number of security measures are explicitly suggested and must also be considered: pseudonymization and encryption ensuring confidentiality, integrity, availability, and resilience of your systems ability to restore the service (e.g. backups) processes for regularly testing and evaluating your measures Aside from generic IT security measures like backups and providing the service over a HTTPS connection, I would be concerned about “insecure direct object reference” style attacks on the database. If I know that certification no 1234 exists, I could try to get the information for other numbers like no 1233 and so on. This would leak personal data. Basic defenses could include requiring additional information such as the data subject's name to be provided, or using anti-bot measures such as captchas and rate limits. However, the real solution is to avoid sequential IDs, and to generate sufficiently large tokens with a cryptographically secure random number generator. Instead of a “certification number”, it would be better to view this as a “validation code”.
In Germany it's not so clear: https://www.lfd.niedersachsen.de/themen/datenschutz_im_kfz/kfz-und-datenschutz-148981.html The situation is different with regard to personal data collected in connection with the vehicle. Data is personal if it relates to a "specific person" or at least to an "identifiable person". A person is "identifiable" if, for example, he or she can be identified via the vehicle identification number or other additional knowledge. The Federal Data Protection Act (BDSG) therefore applies in these cases. The BDSG in turn contains a clear statement: the data "belong" to the data subject. Related to the motor vehicle: The data "belong" to the driver or owner of the vehicle.
No, it's not legal. The General Data Protection Regulations (GDPR) apply given that you are in the UK (regardless of where the Data Processor is based). The UK GDPR is slightly modified due to Brexit, but the same principles apply. The only plausible legal basis for this actions would be that you consent to it, and you're entitled to withdraw that consent at any time. Some may claim that Article 6.1(b) applies, i.e. that it's necessary to send marketing email in order to fulfil the contract, but GDPR is clear that bundling such consent into a contract for service simply to permit the data processor additional actions isn't allowed, as I'll demonstrate. UK GDPR requires that consent to use your personal information (in this case, your email address) for the stated purpose be freely given. Consent to use your information for direct marketing is not freely given if it's inseparable from the consent to use it for some other service, as per para 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. And Article 7.4 backs this up with When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. The intent of Article 6.1(b) is that only the processing required for the service you have bought is allowed (e.g. if you supply your address for delivery of stuff you've bought, the data processor can use that address to send you the stuff, but is not allowed to add a contract term that allows them to send you unwanted stuff). Examples of emails that Article 6.1(b) would allow (in my assessment) include things such as notification of upcoming downtime, or a reminder that subscriptions are due, but not unsolicited advertisements for other products. There's a grey area that's open to interpretation, where adverts are piggybacked onto actual service messages.
The tricky bit from a GDPR standpoint is that the US has a law that says a US-based company must hand over data to US government agencies even if the data is stored outside the US. This is US specific and a case where the US government gives itself jurisdiction outside the US but the EU can't directly do anything against it (outside of international negotiations). As you noticed this means if you store data at a US data processor there is no real difference whether the data is physically stored in the US or the EU. So to avoid transferring EU consumer data to the US several steps are needed. First the servers have to be physically located in the EU and second the company needs to be non-US based, EU based seems the obvious choice. AFAIK constructions of a US-based company creating a fully owned EU-based subsidary are currently used to achieve the second part. Whether this is sufficient may have to be decided in court.
Term 1 isn't going to hold up, but that is not a GDPR matter. It's just a matter of basic consumer protection law in the EU. You can't offload responsibility for your mistakes. Looking at 2, Dale M. already pointer out that it's now how the GDPR works. You are the Data Controller. X,Y and Z are Data Processors. Article 28(1) of the GDPR is in direct conflict with your disclaimer. You accept zero responsibility, the GDPR says you are fully responsible. That's the exact opposite.
Under GDPR article 6 paragraph 1 item (c) one lawful basis for processing personal information (PI) is: processing is necessary for compliance with a legal obligation to which the controller is subject; The obligation to attribute a reused work under a CC license is such an obligation. Moreover, the licensor has the option under any CC license to specify a pseudonym for attribution of that work, or to waive attribution totally. Not doing that while releasing content under a CC license that requires attribution could reasonably be considered consent to publish that name along with each re-released copy of the work, so there are at least two lawful bases for processing that name and making it public. In some jurisdictions the license has the status of a contract, which imposes an obligation to attribute the author properly under GDPR Article 6 paragraph 3, as described in more detail in the answer by amon. Also, usernames are PI if and only if it is reasonably possible to associate them with a specific natural person. If a person chose a user name for a single site, not used for any other, and did not post any info that allows the person's identity to be determined, it is not PI. Often, of course, the person can be determined.
You're misreading the law. You need to keep reading the section you referenced (emphasis added): The disclosure...shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business Thus, the option to have the disclosure sent by mail only applies to consumers who do not have an account with the business. Since presumably a large number of sites only maintain personal information for users with accounts, such sites need not provide a mail option. Further, it doesn't say there needs to be a button: you just need the ability to say you'd like it mailed to you in the request somehow, and then they need to comply when you do.