How shall I handle user consent &quot;remember&quot; option I get consent from user for some operation. While consenting user can check &quot;remember consent&quot; option and this is handled as below: Consent is saved to db Some action is done and consent is deleted from db But problem is at step 2. If user cancel HTTP request that give us consent after the consent is saved in db, then consent isn't deleted from db. So at another request this consent this consent will be used. Is it legal behavior?
The GDPR does not prescribe how exactly consent must be managed, as long as consent was obtained in line with the GDPR's principles. Similarly, the EDPB does not provide concrete recommendations in its guidelines on consent, mainly noting that Controllers are free to develop methods to comply with this provision in a way that is fitting in their daily operations. I would not be too concerned with edge cases like failing HTTP requests, at least not any more than for other HTTP endpoints. If the user indicated consent, and you act on that indication of consent in good faith, that's probably fine. However, remember that you must provide a equally easy way for the user to revoke consent later. If the user changes their mind, they can use the mechanism that you offer to inspect their consent status, and revoke it if they want. But again, how to do that is largely up to you.
They must comply with your restrictions, via the principle that consent can be withdrawn. One relevant Supreme Court case is Walter v. US 447 US 649, which declares that When an official search is properly authorized—whether by consent or by the issuance of a valid warrant—the scope of the search is limited by the terms of its authorization Likewise in Florida v. Jimeno, 500 U.S. 248, A suspect may, of course, delimit as he chooses the scope of the search to which he consents. In US v. Williams, No. 16-3547, 2018 U.S. App. LEXIS 21304 (3d Cir.), the court elaborated that a consensual search satisfies the mandates of the Constitution only if conducted within the boundaries of the consent given. This recognition establishes that it is the subject of a consensual search who decides the terms of the search. and furthermore, That a party may terminate a search by withdrawing his consent is a corollary of the recognition that the subject of a consensual search determines the parameters of that search. Bear in mind that you have to be crystal clear on any limits on the scope of a search. If this is more of a business call (the electrical inspector) and not a search, they don't have any special powers to enter your house. If the inspector enters your basement study without permission, that is trespassing, but you can't sue him because of that unless there was actual damage done. You can complain to his superior.
Assuming that the police have a warrant to seize your cell phone, the scope of what can be seized is specified in the warrant. It is not automatic that seizing a phone entails seizure of some or all online accounts (e.g. automatic backups, collections of passwords in a Google account) and it does not automatically &quot;freeze&quot; or block a person's access to their accounts including phone accounts. It's not that it is impossible to seize an account, it's that it is not automatic: it has to be in the scope of the warrant. Here is a collection of petition templates, asking the court to allow the seizure of various things for various reasons (mostly electronic), including access to bank accounts. If the police suspect that information might be available online after it has been deleted from a phone, they would need to include online accounts in the scope of the petition(s). There is even a template for &quot;give me everything&quot;, called &quot;Frankenstein&quot;.
The territorial scope of the GDPR is defined in Article 3. It covers "personal data of data subjects who are in the Union", whether they are EU citizens or not. So to answer your questions: 1) are EU users, but moved to USA a few years ago, and signed-up on my website? They are not in the EU, so are not covered. You don't need to know if someone is an EU citizen, just if they are currently in the EU. 2) went for holidays in USA, signed-up on my website, and then came back to EU? (note - potentially skipped any Consent questions at sign-up, because IP was from USA) If someone moves into the EU while using your service then they fall under the GDPR for the time they are in the EU. If their home address is in the EU then that is covered, and monitoring of their behaviour while in the EU is also covered. Your other two questions are about VPNs. If a VPN is used to evade IP address geolocation and you have no other clue about where someone is then you can't be blamed for not knowing where they are (although I'm not aware of any actual case law on this topic). But if someone with a USA IP address gives a home address in the EU then you should probably treat them as being in the EU to be on the safe side. Basically, if you don’t know if they are in the EU or not, you should treat them as if they were.
someone I spoke with said "there is to be no recording of this or any other calls". Must I follow this instruction? Although, in Canada, there is no requirement on you to obtain consent to make recording, this explicit objection creates a hurdle. If you simply ignore the objection and record the conversation anyway without letting the objecting party know, you may give them a ground for a claim under the breach of confidence doctrine. The safest move would be to reply: No. There will be recording of this and any other calls. It will be then up to them to hang up. If they don't, they lose all grounds for any claims.
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. That's not exactly true, consent is merely one of six possible legal basis for processing (article 6). For example, processing of personal data can also be lawful if it necessary to perform a contract, legally mandatory, or in the public interest. The court decision acknowledges that but rules out another basis in this case because it considers that it is possible to serve fonts without relying on a third-party ([…] der Einsatz der Schriftarten auch möglich ist, ohne dass eine Verbindung von Besuchern zu externen Servern hergestellt werden muss). Confusingly, it only refers to article 6(1)(f) when it seems to me that (b) would also be plausible but maybe this wasn't raised during the proceedings? If the data controller cannot invoke any other basis for the lawfulness of the processing then yes, the only thing left is asking for consent, i.e. invoking article 6(1)(a). But that doesn't mean that you should expect to be asked for consent each and every time your personal information is being used. The consent form on the site also implicitly assumes consent, which I thought was also a violation. Yes, implying consent doesn't really make sense under the GDPR definition (article 4, see also article 7): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action European data protection authorities have issued guidelines that detail what that means and clearly reject “bundling” different data processing. The regulation also makes it clear that data subjects should be able to withdraw consent at any time, which does not seem possible with the fonts on golem.de My reading of all this is that assuming consent because you are using a service (or even created an account or checked a box at some point) simply isn't valid consent. Either you don't need consent at all in the first place or what you need is freely given, specific consent and “implying” consent or bundling it with a registration process achieves exactly nothing. But this is still extremely common and it might take some time before enforcement and case law definitively settle this question. Smart data controllers trying to avoid collecting consent (like Meta) have abandoned any claim that signing up to the their services would constitute consent (because that's transparently not the case) and try to bypass the issue entirely using another basis like contractual necessity. This is also being litigated. I know that a EU regulation can be implemented and interpreted differently from country to country, and that a single court ruling in Germany doesn't even mean that the national law was correctly applied. From what I've read, I get the impression that this particular ruling was not unlikely to be overturned by a higher instance, if it came down to it. So my question probably both pertains to German law specifically and the EU regulation itself. That sounds more like the way EU directives work. Regulations are supposed to be immediately applicable (no implementation in national law necessary) with minimal differences between countries (except when they explicitely provide for that). Of course, enforcement would still mostly be in the hands of national court systems and (in Germany) provincial data protection authorities but there are mechanisms to ensure consistency (the European Data Protection Board, prejudicial questions to the CJEU, infringement proceedings from the European Commission…).
Yes, it triggers the GDPR obligations Considerations: Can you surely identify those residing in Europe? In that case you should ask them to sign up again and confirm the consent. A lot of mailing lists are doing just that. Did they previously give consent and you can document it? If so, then you can argue that you have the required consent. Do you have business in Europe? If not then I don't think they would bother to go after you. You could just walk away from the fine. What other personal informastion are you storing? If you know who reside in Europe then you already have more info than just the email. The email address itself wouldn't be much of a documentation issue, SAR or Portability task.
Your title is not necessarily consistent with your example. Can a website demand acceptance of non-essential cookies to allow access? As you have found, GDPR prohibits conditioning the provision of service on consent to the processing of personal data. Cookie walls without alternative means of access are generally considered violations of the GDPR. Can a website demand acceptance of non-essential cookies to allow free access? The situation of a &quot;consent or pay&quot; scheme (or &quot;cookie paywalls&quot;) is more uncertain and has not been clearly settled at the EU level. There are data protection authorities that do not consider such scheme necessarily a GDPR violation (Austria, France) if a reasonable alternative access, without requiring non-essential cookies, is provided. For what it is worth, the French data protection authority (CNIL) held initially that all cookie walls are illegal, but on appeal from publishers and advertisers, the French supreme administrative court annulled CNIL's initial guidelines for being too absolute. German and Italian authorities are still examining the validity of such scheme. More reading: Consent or Pay: Privacy Considerations with Cookiewall-Paywall Hybrid Solution, https://securiti.ai/blog/cookie-paywall/ Is the use of a cookie wall allowed in European Countries, https://www.iubenda.com/en/help/24487-cookie-walls-gdpr