Does GDPR apply to data of users who lied about their country of residence? Imagine a website which requires users to register in order to use all its features. In order to avoid exposure to GDPR complains, would any of the following tactics work? Ask the user for their country of residence, and offer a list with EU countries not in it Ask the user for their country of residence, and display an error message if an EU country is selected Practically, suppose a certain John Smith from Germany registers as John Smith from Arizona, US, and then requests a copy of their personal data under GDPR right of access, or complains about the collected data being excessive. Could his request/complain be dismissed on the ground that the website doesn't have any data concerning John Smith from Germany?
Whether GDPR applies does not depend on the country of residence. Instead, GDPR applies to a non-EU site or service if the data controller offers products or services to people in the EU (see Art 3(2) GDPR). This depends solely on the behaviour and intent of the data controller / the provider of the website – compare also the discussion of the “targeting criterion” in EDPB guidelines 3/2018 on the territorial scope of the GDPR. While your proposed measures might not be entirely ineffective (in that they document an intent to not serve people in the EU), they are both unnecessarily restrictive and overly lax. For example, they would unnecessarily prevent EU tourists in the US from registering but would nevertheless allow US tourists in the EU. For the targeting criterion, it matters whether the data subject is in the EU at the time of the offer, not at all what their residency is. Even if a person who is currently in the EU registers with your service, that doesn't necessarily mean that you are targeting people in the EU. Instead of implementing signup restrictions, a better strategy might be to clarify in the copy on your website that you are only targeting the domestic US market, not the European market with your services. I have discussed this in more detail in an answer to “How can you block GDPR users from US based sites?” If you have a site where GDPR doesn't apply, and you receive a GDPR data subject request, you shouldn't deny it on the basis that the user must have lied – instead you can deny it on the basis that GDPR just doesn't apply to you.
Does GDPR apply if my web app stores personal data on the user's phone only? No. If you are not processing Personally Identifiable Information (PII) then the GDPR does not apply to you. This is what a web browser does when it asks to remember your username and password for this web site. You are providing a tool, the user is using that tool to process their own data. I do offer to back up the user's personal data At this point you are processing the users PII, and the GDPR does apply to you. Even though you do not have enough information to identify an individual, as it can be used with other information to identify an individual it is PII. From the ICO: Can we identify an individual indirectly from the information we have (together with other available information)? Even if you may need additional information to be able to identify someone, they may still be identifiable. That additional information may be information you already hold, or it may be information that you need to obtain from another source. When considering whether individuals can be identified, you may have to assess the means that could be used by an interested and sufficiently determined person.
The 2018 Data Protection Act specifically implemented the GDPR EU Regulation in the UK - while the regulation itself was directly binding it required member states to create their own legislation for implementing the details - setting up the required supervisory and accreditation bodies etc. The various 'opening clauses' in the regulation also provided the means for the members states to implement specifics in local legislation (so long as that legislation exceeded the minimums set out in GDPR). At the end of the Brexit transition period the UK was no longer a member state (and it's citizens were no longer EU citizens), keeping the DPA 2018 as was would have actually meant that UK citizens weren't eligible for the very protections it was intended to provide them! Therefore the basis of the law needed updating (as well as certain minor provisions that no longer made sense) hence the &quot;UK GDPR&quot; provided a substitute. The fundamentals are the same and crucially it also codified the necessary basis for the UK's data protection laws to have what is referred to as &quot;adequacy&quot; - which means that the EU considers the UK GDPR/DPA to provide &quot;essentially equivalent&quot; levels of protection and therefore data is allowed to continue to flow between the UK and the EU.
The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as it has a clear purpose and a legal basis. Here, the purpose would likely be something like “conducting business with my clients” and the legal basis would be a “legitimate interest”. A legitimate interest always requires a balancing test that weighs your interests against the interests and rights of the affected persons. For example, can the affected persons reasonably expect such processing activities? In a professional setting, it can probably expected that business partners keep notes about contact persons so your intended processing could be fine. The GDPR does impose some general constraints. There are general principles like data minimization and storage limitation – you should only collect data that is necessary for your purpose, and shouldn't store it for longer than necessary. You should think about appropriate technical and organizational measures (TOMs) to protect the processing activity, for example about how your CRM is hosted, how backups are made and how security updates are installed, who has access to the personal data, and how the people with access to the personal data can be trained. For example, such training might inform your employees that they can only use the data in the CRM for business purposes, but absolutely not for personal purposes like asking Gina from reception out for a date.
… would face and voice count as personal information under GDPR? Absolutely. Does person B have the right to erasure … No. The right to erasure only applies in certain circumstances. While the initial reason for collecting personal data was consent, once it has been incorporated into a film, the processor now has a legitimate interest in the data. The right to erasure does not apply when there is a legitimate interest.
There are multiple issues with what you are trying to do, including issues with copyright, personality rights, and data protection. You are trying to use other people's content and likeness for your advertisement. Unless you are certain that you can do this in your relevant jurisdictions, without their consent, this sounds like a very bad idea. At least under GDPR, “but they made it public” is not an excuse. Personal data is personal data regardless of how you acquire it. The GDPR also has a very broad concept of identifiability that goes beyond direct identifiers or PII. If you want to use other people's personal data, you need a legal basis, and must provide them notice about your processing. Consent (informed opt-in) is one legal basis, legitimate interest (opt-out) another. You are suggesting to avoid this by blurring PII, but you may also have to blur other content that is indirectly identifiable. Real anonymization that meets the GDPR's definition is a really hard problem. In some cases, a legitimate interest is able to avoid such problems. E.g. if I make a video with commentary about a Tweet, it would likely be OK to show surrounding personal data like the responses including the identities of the various accounts, to the degree that this is relevant to the commentary and/or necessary for proper attribution. However, that commentary likely has strong protections under freedom of expression. At least from an European viewpoint, a tutorial, demo, or advertisement would not have a freedom of expression argument that would shift a GDPR legitimate interest balancing test in your favour. Instead of blurring almost everything in your video or working on GDPR compliance, content licenses, and release forms, you should consider a different solution: create dummy content just for your videos. You can use your own content, and maybe add a dummy profile.
No. As long as you don't see and have no means to access this data, but it is under the control of the user at all times, you are neither the controller or the processor of this personal data, and the GDPR does not apply to you.
It would probably already be illegal based on national laws that comply with Directive 95/46/EC (of the European Parliament and of the Council of 24 October 1995). What's new with GDPR include: the sanctions that can be imposed the accountability i.e. you must be able to provide documented evidence on your practices even before something happens the obligation to report all data breaches. So you'd definitely have more concrete responsibility to follow good security practices under the GDPR.