Are internet forum posts considered personal data under GDPR? GDPR defines "personal data" as any information relating to an identified or identifiable natural person. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; By that definition, it sounds like anything a user writes on a website that requires registration (even if with only an email and a password) is to be considered personal data, even if that data is meant to be public like in the case of internet forum posts, even if the post content is just a simple opinion, thought, or story. Is this correct? Or are there any specific cases where forum posts might not be treated as personal data?
In the general case, it seems unlikely, based on the wording (which is convoluted). In certain cases, if the president of Russia posts "My name is Vladimir Putin", that post is personal data. On the other hand, you might, based on my writing, conclude that I am from the US, and you might even conclude that I'm in Washington state, but that doesn't distinguish me from 7.5 million others, so on those grounds that is not personal data. Eventually, though, you might identify me specifically from other things that I may have said on SE. The definition depends on two parts. First, personal data is "information relating to an identified or identifiable natural person". Any "information" provided by a natural person is "related to" that person (as is any "information" that is about such a person). The second part defines "identifiable natural person", that is, who is an "identifiable person"? Every person can, in principle, be identified by reference to some label or description of fact about them, so every person is an identifiable person, under this definition. This means that every piece of text that refers to an individual (not even text which can identify the person) is "personal data". Obviously, any individual can be uniquely identified by some collection of identifiers; the problem is that the wording of the law does not explicitly say "using that supposed personal data". If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is. Another term that the regulation defines and uses in a few places is "pseudonymization", which is defined as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person The point of interest here is that this says that "personal data" which cannot be attributed to an individual is, nevertheless, still personal data. I think the most important part of the regulation is art. 6, which defines lawfulness of processing, especially para 4., which allows consideration to be given to safeguards such as pseudonymization.
The California CCPA, Virginia Consumer Data Protection Act (CDPA), and the Colorado Privacy Act (CPA) all use definitions of &quot;personal information&quot; (PI) very similar to that used by the GDPR, and the arguments which have been applied to classify an IP address as Personal Data under the GDPR could logically be used under each of those laws. For example this official page gives the CCPA definition as: Personal information is information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics. Note that IP addresses are not specifically mentioned, nor are &quot;online identifiers&quot; a key term under the GDPR. But an IP address often provides geolocation data, which is mentioned. The April 2020 article &quot;Are IP addresses 'personal information' under CCPA?&quot; from The Privacy Advisor by IAPP says: For many businesses, the collection of IP addresses provides multiple benefits from monitoring website traffic to advertising, tracking and deterring malicious activity. But are IP addresses “reasonably capable” of being associated with or “linked” to an individual or household? If not, do they still “relate[] to” or “describe” a consumer or household? These questions are critical to address, because if IP addresses are considered to be “personal information,” then businesses may find themselves subject to additional obligations under the CCPA or forced to rethink how they handle IP addresses as part of their online business. ... The CCPA’s definition of personal information expressly contemplates including IP addresses. An IP address alone may not allow a business to identify a particular consumer or household; however, in many — if not most — cases, an ISP can link an IP address with a name, home address, phone number, email address and even payment information. ... ... On Feb. 10, the California attorney general issued its first set of modifications to its proposed CCPA regulations. These modifications included the following guidance: [I]f a business collects the IP addresses of visitors to its websites but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be ‘personal information. The article goes on to explore the implications of that proposed regulation, saying: In other words, if the business did not link the IP address to a consumer or household, and the business could not reasonably link the IP address with a particular consumer or household, the IP address would not be personal information. This interpretation aligns with the reality that even if businesses wished to link IP addresses to individuals or households, many would lack the information needed to do so themselves and would be unlikely to succeed in compelling an ISP to do so for them However, the regulation quoted above was removed in the March 2020 draft of the proposed regulations and did not appear in the (PDF) Final Regulations, issued in August 2020. The IAPP article goes on to discuss the ECJ case Breyer v. Bundesrepublik Deutschland in which the Court held that IP addresses were personal information in that instance. The article mentions that: Ultimately, the court held the website provider had the means likely reasonably to tie dynamic IP addresses back to individuals because it had legal means for compelling ISPs to do so. Therefore, it held that dynamic IP addresses collected by a publicly accessible website constituted personal data “in relation to that provider.” What the article does not specifically mention, and several other published comments relying on the Breyer decision do not discuss was that in that particular case the website was operated by the government of Germany, which has legal powers to require any ISP operating in Germany to disclose IP assignments. That means that in that particular case IP addresses were potentially linkable by the Data Controller of the site, in ways which would not be available to a non-government site. There does not seem to have been an official decision under any of these laws, including the GDPR, as to whether an IP address is PI for an ordinary business site. The downloadable Privacy Law Comparison matrix compares various aspects of the CCPA, CDPA, CPA, and the GDPR, including their definitions of PI. In short it is not clear to what extant any of the other privacy laws mentioned in the question or in this answer treat an IP address as personal information (PI), particularly when the site is not operated by a government agency, and has no right to compel an ISP to provide data linking an IP address to a specific user. Future litigation may well clarify this.
If you merely provide software for your client to use, you are not processing personal data on behalf of the client. But if you have access to systems that store personal data, then you must consider the GDPR. Or more accurately: your client must consider the GDPR. Under what legal basis can they give you access to the data in these systems? The easiest way to solve this is indeed if you act as the client's processor. Processor status is never the default, but requires a binding contract with the data controller. This contract will require you to only process personal data as explicitly instructed by the client, and may require you to take certain security measures as a precaution. Without such a contract you aren't a data processor, but possibly a data controller of your own (with all the compliance obligations that implies).
The GDPR doesn't generally distinguish public from non-public personal data. If you have a good reason to contact the professor, do send them an email. GDPR does not prevent this. If you're sending this email for “purely personal or household purposes”, then GDPR doesn't apply anyway. There are rules in the ePrivacy Directive against unsolicited emails, but these specifically relate to emails for direct marketing purposes. A company is not allowed to send out spam marketing, regardless of whether they obtained the email address from a public data source. Companies can send email marketing to their own existing customers, or to people who have given consent. Consent is defined in a fairly restrictive way (as a specific, informed, freely given, and unambiguous indication of the data subject's wishes), so that mere publication of an email address cannot be interpreted as consent to receive marketing from a particular company.
Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea. If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution? Is it GDPR compliant that their answer to my deletion request is "We will delete the data..." The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”. You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.
No, GDPR does not apply here — but other laws might . The General Data Protection Regulation only concerns itself with the following: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. per Article 2. Furthermore, there is a specific exemption (Art. 2 (2)(c)) which would seem to apply to you (emphasis mine): This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. You are sharing the conversation in a purely personal capacity and are not processing it wholly or partly through automated means nor are you intending it to form part of a filing system. Additionally, depending on the contents of the conversation and what you share, there may not be any personal data involved at all. For example, if you only share the messages themselves (and they don't contain any personal data that could identify someone) and censor/black out any names or photographs/avatars from the senders. Either way, GDPR does not appear to apply to you in this context. However, it appears that Article 18.1 of the Spanish Constitution grants the right to &quot;personal and family privacy&quot;, as does the Organic Act 1/982 on Civil Protection of the Right to Honour, Personal and Family Privacy, and Self-Image. It's possible that, depending on the contents of the conversation, the other party involved in the conversation may have a case for action against you in the civil or criminal courts (for example, if the information invades their privacy or is defamatory in some way) if you share the contents of the conversation with someone else. I am not familiar with Spanish law so cannot comment further on this matter.
Generating a list of all possible numbers doesn't sound like it would constitute personal data any more than listing all dates for the last hundred years as a "possible date of birth" would. However, the moment anyone linked even one of the numbers with any other personal data - for example a name - they would be bound by GDPR and would need to show a Lawful Basis for processing the data. [If you linked your own name you could presumably argue Consent, but anyone else's would need to have an associated Lawful Basis.]
There is no requirement about "data" in the GDPR, so provided this is just "data", no. An empty form with fields for personal data contains no personal data. On the other hand, if the form is filled in by the user with personal data (as defined in GDPR article 4), and you receive a copy of the filled in form and process these personal data (as defined in GDPR article 4) - then the answer is: Yes. However, if you do not process the personal data (i.e. the form is just printed out on paper and filled in with a pen, and nobody except the data subject has access to the piece of paper with the filled in form - then the answer again is "no").