Required data entry seemingly against GDPR From https://security.stackexchange.com/questions/186327/why-do-some-gdpr-emails-require-me-to-opt-out-and-some-to-opt-in : As a consequence the "G29", the group of national data protection authorities in the EU, affirmed that if a user has no real choice, feels constrained, or will face negative consequences for refusing consent, then the consent given is not valid. The G29 therefore affirmed that GDPR guarantees that giving consent to processing personal data cannot be the counterpart of providing services. Spanish law demands that anyone providing hospitality enter personal data into a database on every guest within 24 hours. Seems like we would have to start asking guests to sign a stupid consent form, and not let them stay if they don't. But that would violate what's quoted above. If we let them stay and don't enter their data, https://www.vacaciones-espana.es/rentalbuzz/policia-explica-el-proceso-de-identificacion-de-viajeros-en-vft says we are subject to huge penalties. If we enter their data without their consent, we AND the Guardia Civil are violating the law. At least that's my untrained interpretation. What am I missing?
Consent for processing someone's personal data is only one of the possible requirements to process that person's personal data. The options listed in Art. 6.1 are (text in Spanish, with links to other languages): a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; c. processing is necessary for compliance with a legal obligation to which the controller is subject; d. processing is necessary in order to protect the vital interests of the data subject or of another natural person; e. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Obviously, your case meets the criteria for c.1 So, you do not need consent from your hosts, and your hosts do not have to sign any consent and they cannot refuse to provide their data if they want to reside at your dwelling. The moment you ask your hosts any data to which you do not have a legitimate interest, you need the consent. And you cannot refuse hospitality to your hosts if they do not want to provide that piece of data. Anyway, maybe it would be a good idea to print a leaflet explaining why you require their data in case they have any doubts. 1 For the Guardia Civil, it would be c. and maybe a few more cases.
The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data. GDPR does even apply to anything offline and on paper. Basically it means you have to validate any entry field is free of PII before processing it. Or make it clear in your privacy statement how you handle this use-case.
There is nothing extraterritorial about these laws. If a company sells a good or provides a service to individuals based in the EU, then this good or service has to comply with EU laws. This concept is self-evident for physical goods that are produced anywhere in the world and then sold in the EU and the GDPR just applies this concept to services provided over the internet. The same legal concept also holds in all other major jurisdictions. The only thing that makes this more complicated for the GDPR is the actual enforcability of these laws but that is a technical issue not a legal one.
Per Art 3(2), GDPR only applies to non-European companies when their processing activities relate to the offering of goods or services to people in Europe, or when the processing activities relate to monitoring people in Europe. However, the word “offer” of this targeting criterion requires some level of intent. It is not enough for GDPR to apply that they're marketing to someone who happens to be in Europe, but GDPR would apply if they are intentionally marketing to people who are in Europe. I don't know what they are marketing, so I don't know if that would be the case here. Even if GDPR were to apply, it would not be the most appropriate law. Yes, there's the GDPR right to erasure, which applies under some conditions (though there's a pretty absolute right to opt-out from marketing). The EU's ePrivacy Directive provides more specific rules though, in particular that every such marketing email must offer a way to unsubscribe. Other countries have comparable anti-spam laws, potentially also the home country for this online service.
Whether GDPR applies does not depend on the country of residence. Instead, GDPR applies to a non-EU site or service if the data controller offers products or services to people in the EU (see Art 3(2) GDPR). This depends solely on the behaviour and intent of the data controller / the provider of the website – compare also the discussion of the “targeting criterion” in EDPB guidelines 3/2018 on the territorial scope of the GDPR. While your proposed measures might not be entirely ineffective (in that they document an intent to not serve people in the EU), they are both unnecessarily restrictive and overly lax. For example, they would unnecessarily prevent EU tourists in the US from registering but would nevertheless allow US tourists in the EU. For the targeting criterion, it matters whether the data subject is in the EU at the time of the offer, not at all what their residency is. Even if a person who is currently in the EU registers with your service, that doesn't necessarily mean that you are targeting people in the EU. Instead of implementing signup restrictions, a better strategy might be to clarify in the copy on your website that you are only targeting the domestic US market, not the European market with your services. I have discussed this in more detail in an answer to “How can you block GDPR users from US based sites?” If you have a site where GDPR doesn't apply, and you receive a GDPR data subject request, you shouldn't deny it on the basis that the user must have lied – instead you can deny it on the basis that GDPR just doesn't apply to you.
These documents constitute personal data and - in principle - you, as the subject, have the right to get a copy of them by issuing a "subject access request". The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (Art. 15 (3) GDPR) GDPR applies to controllers of any kind, including government organisations. The subject access request can usually be a simple email. The ICO has a template for this: https://ico.org.uk/your-data-matters/your-right-of-access/ (but keep it simple, you can literally just ask for "all personal data" they have on you; no need to speculate on what kind of data they may have). The subject access request is sent to the actual controller, but if you don't get a response to your request after 30 days, you can file a complaint with the supervisory authority (see here for Germany; note that federal institutions are supervised by the BFDI, not the data protection authorities of the Länder). Also note that you may have to go through some trouble to be properly authenticated by the controller. They do need to be certain that you are the data subject. There are also reasons why a controller can refuse to provide some or all of the information (e.g. if your request is clearly excessive or unfounded, if it's impossible to comply without violating another data subject's rights), but I would be surprised if any of those applied in your case. Your rights can also be restricted depending on the legal basis for processing. This includes rights that are illogical as well as some that provide special protection for processors: You can't object to processing based on consent (but you can revoke your consent), fulfilment of contract (but you can cancel your contract), a legal obligation on the part of the processor, or a vital interest (but you still have the right to erasure) Your right to portability and right to erasure does not apply if processing is based on a legal obligation or a public task (justice, parliamentary or government functions, statutory functions etc.) your right to portability also doesn't apply if processing is based on vital interest (e.g to protect someone's life) or legitimate interest of the processor. It is possible that processing all or some of your data was based on the performance of a public task, in which case they will refuse your request.
In short, no. Article 20 of the GDPR covers the “Right to data portability”, which essentially says two main things: The data subject had the right to an exported copy of their personal data in a common format And The data subject has the right to have this data transmitted directly from one controller to another where technically feasible. Neither of these rights as stated in the GDPR require the data controller to provide a button to initiate either a data export or a transfer to another controller.
GDPR defines the responsibility of Companies to ensure that Personal Data in their possession is maintained Secure ensuring Confidentiality and Privacy towards the Data Subjects to whom it pertains. Prior to the Articles themselves, there are notes and over (49) one may read that companies must have in place (where applicable) mechanisms like CERT and any other SECURITY assuring tools/ processes. (83) again is all about ensuring Security. (94) reads that if the Controller (company) find it cannot ensure Security it must stop processing activities and report to the Supervisory Authority for guidance and support. Then we have Article 3 (f) establishing that it is the company responsibility to "... ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’)..." Bottom line... T&amp;C Companies must ensure that Personal Data is processed by them (and that includes communications) are Secure while ensuring Confidentiality and Pricavy towards the Data Subjects. The wording "...commercially reasonable efforts..." is wrong, because it is not something that may be a legal requirement or not depending on "cost"; it is a Legal Obligation. Then "... the Internet is not an inherently secure environment and so we cannot guarantee the security of your Personal Information..."; this is just "poor legal advice" for GDPR does expect companies to make the Internet safe, it expects companies to maintain their IT Landscape safe... an analogy can be made about going through a group of sharks in the ocean while just swimming or on board of a big boat... the ocean is dangerous due to the sharks, yet if you are in a big boat, you won't even notice them. Then the "cherry on top"; "... e assume no liability for any disclosure of data due to errors in transmission, unauthorized third-party access or other acts of third parties, or acts or omissions beyond our reasonable control..."; now i really do not know which lawyer has written this, but it basically reads something like: "the law obliges me to ensure you are safe... however I am not able to". Now, I have seen similar "statements", but I must confess it was like 2 or 3 years ago... most companies have corrected them over time and since they become aware that penalties were for real. Just a final disclaimer It is a fact that while in transit (over the Internet) a message being delivered through a T&amp;C Company Services will travel through 3rd party infrastructure contexts, rendering it at risk ... however, if it is properly encrypted (as it should) the transition time will not be sufficient for a successful breach attempt. So, yes they are capable of ensuring all they have stated they can not.