Hiding order invoice information, GDPR I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like: Name Surname Address 11 Germany as example I want to hide this data and show it as: N*** S****** A****** ** G****** I think that showing the exact number of letters and numbers by just replacing them with asterisks is not quite safe, but I want to make sure if it's not breaking the laws of GDPR.
The GDPR is wide in scope, and flexible in application. Therefore it is not possible to give an absolute yes/no as to whether masking text with asterisks is or is not lawful. We can gain a deeper insight by looking at the GDPR itself. Firstly, the definition of processing (Art. 4 lit. 2): any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction As mentioned by amon, the principles relating to processing of personal data (Art. 5) are highly relevant, insofar as the activity constitutes processing. In particular, purpose limitation: [Personal data shall be] collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes ...and data minimisation: [Personal data shall be] adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed I would argue that making available the personal data on an invoice is processing. There are two separate operations: Making the data available to authenticated users; and Making the data available to non-authenticated users The purpose of making it available to authenticated users may be different to the purpose of making it available to non-authenticated users. Again acknowledging amon, the necessity of making the data available to non-authenticated users must be examined, as too must the means by which a non-authenticated user gains access to an invoice: are they using a URL that contains a token of some kind? Is this unique in some way? It could be that the presentation of a token itself constitutes authentication and thus authorisation to view the entire invoice, in which case further redaction may not be necessary if there is a clear necessity to disclose the entire contents to such a user. Whether the token expires or is limited to a certain referrer would be part of complying with the integrity and confidentiality principle and Art. 32 (Security of processing) by implementation of technical measures. When considering pseudonymisation and anonymisation, you will note that the redaction of name and address data from a certain view of the invoice, while nevertheless displaying the invoice number, constitutes pseudonymisation, since it would be possible with unfettered access to the remaining data, to determine the name and address from the invoice number, but not for the non-authenticated user whose view is redacted. In such a case, I fail to see how or why the replacement of a string with the same number of asterisks, or starting with the real character is secure or even practical, when the entire field could simply be replaced with a fixed-width string of asterisks or other filler, thus providing the user with no right or necessity to view the personal data with no further insight into what the personal data may or may not be.
These are only tangentially related to the GDPR A government entity processing data in accordance with a member state law is ipso facto in compliance with the GDPR. That’s because lawful government data processing is a legitimate reason for processing data under the GDPR. If Germany, for example, passes a law saying German police can record every phone call in Germany, then that would be a lawful basis for processing under the GDPR. There may be constitutional or other legal limitations on such a law but as far as the GDPR is concerned, they’re fine.
[I'm not so well-versed on US and Russian law, thus I will limit my answer to EU law.] Your specific use of a user identifier, as I understood from your question, can be classified as personal data, so in your case, the GDPR seems to apply. This means that you need to have a) legitimate purposes to process that personal data (e.g. crash reporting) and b) a legal justification for each purpose of processing: it could be based on consent or another legitimate purpose (inc. your own legitimate interests). Consent might not be the best option for you, but it's up to you to decide. In any case, you need to assess the risks to the data subjects (your users) before you decide. How likely is it that you will get breached, and what potential harm will that cause to your users? These are some guidelines; my recommendation is that you read the law and the guidelines by the Article 29 Working Group and European Data Protection Board, or hire some good experts on this. There is no easy answer, or one size fits all solution. The GDPR isn't so hard to understand or implement, but it does require some change in mindset. With the new law, processing personal data carries a higher risk of penalties, so you should do it only when it's absolutely necessary, and with respect to the rights of your users.
Yes. Art 13 requires you to provide “the identity and the contact details of the controller”. You are the data controller. Your name and address are necessary to establish your identity. Using AdSense means you're offering an internet society service commercially. In that case, there's also probably some EU fair competition directive that was implemented in your countries national law and will provide equivalent requirements. For example, my country Germany has a far-reaching Impressumspflicht. Not sure if this is the most relevant EU law, but Art 22 of Directive 2006/123 requires that your country passed laws to ensure that you make available “the name of the provider, his legal status and form, the geographic address at which he is established and details enabling him to be contacted rapidly and communicated with directly and, as the case may be, by electronic means”. I think you would be in scope of this directive since you're acting commercially. This legally mandated self-doxxing is unfortunate for private bloggers, but it's also essential for making it possible to enforce data subject rights: if you were to violate someone's privacy rights, how could they sue you if they don't know where to serve you with a lawsuit? However, all things are a balancing act. These requirements are not intended to limit freedom of expression. If you're just trying to communicate something to the public without jeopardizing your anonymity, then paradoxically social media services can be more attractive.
The European Convention on Human Rights has an article about privacy (article 8). Note that this is from the Council of Europe, which is not the same as the European Union: non-EU member states such as Russia, Turkey, and Azerbaijan are also part of the Council of Europe and therefore the ECHR. I'm not sure if you first have to go to a lower court, but the European Court of Human Rights is the authority on this (commonly mistaken for the European Court of Justice, but they are distinct entities). According to this ruling of the ECtHR, it is not illegal to monitor your employees' communications per se. However, the monitoring has to be: for legitimate purposes ("the employer had only accessed the account in the sincere belief that it contained only messages of a professional, not personal, nature"), proportionate ("it was the only possible way available"), and communicated to the employee (or, if the monitoring is not announced, at least the restriction on personal use should be communicated, for example through company policy). In the European Union, there is also the GDPR, but this does not change much. It applies to your employer the same as any other organisation and basically says that they have to be reasonable about it: collect only what they need, for a legitimate purpose, and tell you about it. I think you should be able to request a copy of any data they collected about you, ask a human to review an automated decision, and your other usual rights. They don't need your consent to start collecting data, as Esa Jokinen already commented: "GDPR doesn't even require consent to handle PII data, but the consent is just the last option when there's no other legitimate reason to process the data." In fact, your employer probably cannot ask you for consent: because of the employer–employee imbalance of power, the consent would probably not be considered to be freely given (where this article mentions "The GDPR states", I think they are referring to recital 43).
You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.
To do so I used some images and Gifs which may be under copyright but since I don't earn money for myself and there is no company backing me I was hoping that there is some protection for private persons like me who just want to showcase the project. Sorry. If your website is public facing (i.e. not password protected and available only to family and close friends), you need to follow copyright law. There is no exception to copyright just because a project is run by an individual for non-commercial purposes. I am also insecure about the GDPR regulations since I give users the ability to create an account and try it out. Your profile says you're in the EU. Then you need to comply with the GDPR. Is there any way to protect me against greedy lawyers and companies? Could I write something like: "This website is a peace of art" and save myself with arguments like "artistic freedom" or "free speech"? Nope. A controversial website run by Peter Sunde had at one point a "free speech" disclaimer (similar to the one you propose) posted. However, Sunde did never use this defense in court: Finnish court slaps Peter Sunde with €350k fine. If he had shown up in court, I am pretty sure the court would have told him that such a disclaimer has no legal merit. The only protection that will make you completely safe is to adhere to the law.
GDPR forces companies and employees to keep personal data confidential and to use it only for its allowed uses. That obligation continues after the work contract ends. If the employee breaches confidentiality, it does not matter if he provides the data as a file in an USB-drive or if he provides it from memory; it is a breach of confidentiality. Access logs will help to determine which employees have had access to your data, in case a leak is suspected. The part of the question about human memory seems to come from a deep misunderstanding of how human memory works1. I can remember tomorrow something that I have totally forgotten now. Even worse, there is no telling of what can make me remember you; your name might not ring a bell but I may remember you by seeing someone walking a dog. And nobody will ever be able to tell if I have complied with any of your requests or if I am just lying. And of course, there is only one proven way to erase memories, and I am pretty sure the GDPR does not allow for the execution of employees (Disclaimer: IANAL and IANYL, check with a lawyer before murdering anyone if you have doubts). 1 The classical example: You can certainly delete a file from a disk. But just try to stop thinking about white bears