Can the GDPR be used to obtain US voting information This grows out of a comment in the question Who Has the Right to Access State Voter Records and How May That Right be Expediently Exercised? If a US citizen is currently resident in the EU, can that person use a GDPR request to the proper government agency (state board or elections or a similar agency) to obtain that person's own voter record and whatever other information about that person the agency may have in its files?
I suspect that US voting records would fall under Article 2(2)(a): Article 2 Material Scope ... This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; I doubt it would be possible to argue successfully that a foreign election is anything other than &quot;an activity which falls outside the scope of Union law.&quot; Even the territorial scope could be questioned. This is set forth in the next article, on &quot;territorial scope,&quot; the second item of which says: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. It is probably arguable whether processing absentee ballots from EU residents constitutes &quot;offering services to data subjects in the Union,&quot; but in this case it's likely to be more difficult to resolve that question than to determine whether the activity falls outside the scope of Union law.
The GDPR has a fairly broad concept of personal data: any information that relates to an identifiable person. This is far more than directly identifiable information! The concept of identifiability is further explained in Recital 26: To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. So indirectly linkable information can still be personal data. In your example, that ID can be easily re-identified with a particular person if you know who the secretary was between 2012 and 2014. It is quite likely that there are members in the club with this knowledge, or that this information can be gained from public sources like newspaper reports. Thus, you should assume that your member IDs are at most pseudonyms, but not anonymous. They are likely still personal data. However, it doesn't necessarily follow that you would have to erase everything. Art 17 comes with lots of caveats and exceptions. For example, if you are processing this personal data under a legitimate interest, and someone requests erasure, you might have overriding grounds to continue processing anyway. E.g. such a legitimate interest could involve security or auditability purposes. There might also be such a legitimate interest for keeping some history for the club, but there would have to be a decision based on the individual circumstances. Furthermore, you can of course retain data e.g. due to a legal obligation, or when this information is necessary for the establishment of or defence against legal claims. I understand your desire to keep some data around. Instead of asking “do I have to delete this?” it might be more productive to consider “under which legal basis can I keep this?”. I think you might have a legitimate interest, but you'd have to carry out a balancing test between the various interests and rights. A really problematic approach would be to hold on to de-identified data in the belief that it no longer were personal data. Such a belief is usually mistaken. True anonymization that meets the GDPR's definition is really hard, in particular because you would also have to prevent indirect identification, also by other actors than yourself. There are theoretical models that can help with anonymization, e.g. with k-anonymization methods you'd ensure that there are no unique records in the DB. But this can be tricky to apply correctly, so I'd recommend to only treat aggregate statistics as truly anonymous. In 2012, the ICO has published an anonymization code of practice (PDF). It is no longer up to date with the current legal environment (in particular since the GDPR has expanded the concept of identifiability), but it provides a good overview of both the difficulties of preventing re-identification and an overview of potential solutions.
a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already been a rule to follow Sometimes the question who is responsible for privacy information might not be that easy to decide when you're on platforms. I take this situation as being pretty clear though. You are basically given a blank slate, you can do with that page whatever you want, and the visitor has no clue whatsoever that it might be hosted by Github. In addition to this, Github would be classified as a data processor (providing the tool) and you as the data controller who is in charge of practically everything except for the provision of the page. I hope this helps. Btw. it's not that hard anymore to write a privacy policy these days.
No, it is not legal. Regardless of their location, the only legal options for companies serving to EU residents are to either deny access altogether or to make consent truly optional1 Recital 42 states (emphasis mine): Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement[...] Recital 43 states: Consent is presumed not to be freely given [...] or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. 1 Of course, remember that consent is only one of several means that allow them to process data. For example, if you were getting a trial account for a limited time, it would be considered a legitimate business need to ensure that you are not just opening new trial accounts when the old ones expire. So, if they wanted some data from you to ensure that you are not a previous user and you refused to provide it, then they could deny giving you that trial account without breaking the GDPR.
Yes, so long as you are still a US citizen, it does not matter if you no longer maintain residence in the United States. If you no longer have any sort of residence that can be claimed as a current residence, you simply register at whatever the last residence you used was when you lived in the United States (even if someone else lives there now). You would then have an absentee ballot mailed to you overseas. However, if you don't maintain any sort of residence in the United States, you will only be eligible to vote for federal offices (president, senate, house). You won't be allowed to vote in state or local elections. The keywords you'll need for voting are: UOCAVA, which is a program that allows for easier voting overseas (in some cases the ballot can actually be emailed to you and you are only responsible for printing it out, filling it out, and mailing it back). FPCA, which is the form you fill out. It actually doubles as a registration and an absentee ballot request, so you only have to fill out one form. The absentee request is good for all elections in the calendar year it is submitted, so you only have to fill it out once for both the primary and the general.
This is a good question, as it raises an issue which places the controller's interest in providing a smoothly functioning customer sign up process against customers' right not to have their data leaked. Note that it is not necessary to consider &quot;enumeration&quot; here. Even just being able to check whether one person has a registered account raises the issue. The relevant provisions of the EU GDPR (or in the UK, the UK GDPR as defined in sections 3(1) and 205(4) of the Data Protection Act 2018) are (emphasis added): Article 4(2): 'processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction So, disclosure of the fact that a user has a registered account amounts to &quot;processing&quot;. Article 6(1): Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Of these, only (a) and (f) are likely to be of any relevance: (a) is not too useful since it isn't feasible to design a sign-up system that depends on the user's consent (which they may not give). That leaves us with (f). As noted by the Information Commissioner's Office, &quot;Legitimate interests is the most flexible lawful basis for processing, but you cannot assume it will always be the most appropriate. It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.&quot;. The legitimate interest here would be that you need a sign up system which prevents duplicate registrations. Remember though that the processing has to be &quot;necessary&quot; for the purposes of the legitimate interest. One might argue that it is not since you could design the system to give the appearance of accepting the duplicate registration followed by sending an email to the account holder to inform them. On the other hand this will result in a less user friendly experience which could itself be a legitimate interest. Ultimately this is a balancing exercise and it is hard to say whether you have struck the right balance until someone complains to the ICO or the court and a decision is issued. The fact that the practice is widespread among well-resourced and large companies would tend to indicate that it is lawful albeit this is not conclusive in the absence of a court decision. I'm not aware of any cases involving this particular issue but would be interested to hear from others on this point. If the processing is unlawful then Article 18 is applicable: The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: [...] (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. In other words, the data subject could ask you not to disclose their registration status via the sign up page, and you would be obliged to comply with the request. Separately from the above points, in order to be lawful you must provide the data subject with certain prescribed information at the time when the data is collected. Of particular relevance here are the following items: Article 13(1): Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: [...] (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; So even if you conclude that the processing will be lawful you will have to give some consideration to the basis so that you can comply with the above provision.
You are processing the users IP address in order to carry out the translation to a physical location (see my comment for the technical issues with that) and an IP address is most certainly considered personal information, so yes under the GDPR you are going to need a published policy because you are both data controller and data processor. You need to inform the user of what you are doing, and you need to tell them of the legal basis for the processing (there are several under the GDPR, of which consent is only one - but in your case its going to be the easiest to justify). If you use a third party service for the location translation, you also need to inform the user of that and make available the third party services data processing policy.
Please note that Google Analytics do not anonymize the data you collect on its behalf unless you configure it to do IP-anonymization. If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) in place with Google in order to comply with the GDPR. This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics. Does data that is anonymized need to be collect in the event of a GDPR Subject Access Request? No. But as the controller, you need to make sure that is is anonymized.