What does &quot;structured, commonly used and machine-readable format&quot; look like in practice? I have made a subject access request, and the result included: Statement that their right to process data is from Article 6(1)(b) A series of images, that appear to be photographs of a computer monitor, with my data displayed within some unrecognised application (presumably internal and/or proprietary software) I have requested the data in a structured, commonly used and machine-readable format. They have responded saying screenshots are appropriate and they cannot do otherwise. I am fairly sure what they provide is not consistent with Article 20(1). I note that article 20(2) includes &quot;where technically feasible&quot; but article 20(1) does not. However I am not at all sure what this would look like in practice. Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined? Am I within my rights to insist on this, even if to comply they would have to do some software development? Assuming there is a database underlying the application I would expect it to be a DDL of the database structure, and the relevant insert statements. However this is likely to be very difficult to provide if it is a closed source proprietary application.
Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined? No, the GDPR is based on &quot;general principles&quot; and does not concern itself with implementation details for such matters. It's possible there's EU case law on this, but I can't find any. Am I within my rights to insist on this, even if to comply they would have to do some software development? Yes you can demand it, but they don't have to comply with your demand. The information only has to be provided in a &quot;concise, intelligible and easily accessible form, using clear and plain language.&quot; and they only have to provide the information electronically where &quot;reasonably practical&quot; to do so, and they only have to take &quot;reasonable steps&quot; to do all this per Section 52 of the Data Protection Act 2018 which implements GDPR into UK law. You can complain to the Information Commissioner's Office, and they will decide if Section 52 has been complied with or not. 52 Form of provision of information etc (1) The controller must take reasonable steps to ensure that any information that is required by this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language. (2) Subject to subsection (3), the information may be provided in any form, including electronic form. (3) Where information is provided in response to a request by the data subject under [the Right of access by the data subject], the controller must provide the information in the same form as the request where it is practicable to do so.
Under GDPR Article 6 section 1(f), a lawful basis for processing is: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. It seems that informing a data subject of the availability of a possibly better-focused related site would be a &quot;legitimate interest&quot;, and merely doing a broad geo-locate on the IP does not seem to impact the &quot;interests or fundamental rights and freedoms of the data subject&quot; so it would seem this could be done without specific consent in advance. I don't know of any legal case on this specific point, however.
The Art 15 GDPR Right to Access is pretty absolute, the Art 17 Right to Erasure not so much. Whether you can successfully request erasure of your personal data will depend on the purpose and legal basis for that processing. Short decision schema to check if erasure should be granted: no, if any of the Art 17(3) exception applies yes, if the data is no longer necessary for the purposes for which it is being processed (Art 17(1)(a)) yes, if the legal basis was Art 6(1)(a) consent (Art 17(1)(b)) if the data is being processed pursuant to a legitimate interest, yes, if the data subject successfully objected to the processing (Art 17(1(c)) yes, if the data is being processed for direct marketing purposes (Art 21(2)) yes, if the data subject objects on grounds relating to their particular situation, unless those grounds are overridden by a compelling legitimate interest For example, CCTV recordings on private property are often stored for some time for a legitimate interest to deter crime and to be able to investigate criminal acts if they should occur. A data subject could object to the recording, but would likely be unsuccessful: it doesn't make sense to let individuals opt-out from security measures, otherwise bad actors could use this to destroy evidence. Thus, the objection and consequently the request for erasure should be denied.
Copyright Prominent at the bottom of the page is: © RealClearPolitics 2015 This is nice because it tells you who you have to approach for a licence. If it wasn't there the material would still be copyright you just wouldn't know who owned the copyright. Questions So: If I'm looking to build an app or write a book and I wish to use statistics, am I allowed to basically use their numbers as long as I cite where it is coming from? No, unless what you do constitutes fair use and I don't think it does. If I do make a profit from it, do I owe any royalties to the original scientists/surveyers? No, but you would owe whatever licence fee you negotiated with the copyright holder, ostensibly RealClearPolitics. Must I ask them for permission? Yes, unless you are OK with running the risk of being sued. Commentary I see books reference hundreds of studies all the time This is because they are generally protected by Academic Fair Use public polls should be open information to everyone The only public poll that I know of is an election and that information is available. What you are looking at is a private poll commissioned by and paid for by RealClearPolitics and it is their intellectual property; why should that "be open information to everyone"? commercial interests may be legally entangling Always
This could be covered by point 1(c) of Article 6: Processing shall be lawful only if and to the extent that at least one of the following applies: ... (c) processing is necessary for compliance with a legal obligation to which the controller is subject; ... It might also fall under point 1(f): ... (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. It is difficult to know whether any particular processing of data falls under either of these points because of the lack of relevant court decisions. The latter is particularly slippery, since whether any interest is &quot;legitimate&quot; is at least partly subjective, and whether any interest of the data processor overrides the data subject's interests, rights, or freedoms, is even more so. I should also note that point 1(a) is the point that requires user consent, so the other points explicitly take the place of consent rather than being somehow required alongside consent: (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
The question reads: I see an NDA as a pseudo-public document, something you need to read in detail before you acknowledge and opt-in to limit rights (discussion of topic/tech). Unfortunately for this view, the law normally sees an NDA as a private contract, except when it is alleged that it violates public policy. If an NDA explicitly or implicitly includes itself in the list of things not to be disclosed, then posting it would be a violation of the contract. In such a case the party posting the agreement would be subject to whatever consequence the agreement specifies for violation, unless that person had a valid defense. The operator of a web site where the document might be posted would not normally ne a party to the agreement, and so would not be liable for hosting it, unless some other limitation applies, beyond the NDA itself. An NDA can indeed be a significant limitation on the signer's freedom to discuss certain topics, and a person would be wise to consider it in detail, and perhaps consult a lawyer, before signing one. But that does not mean that the person should post or distribute it publicly, nor that the person is automatically entitled to consult NDAs that others have signed. There are sufficient sample NDA forms available that a person can compare an offered NDA with other possibilities, and get an idea if an offered NDA goes beyond the usual terms.
Yep, you are. You still need to keep the LICENSE and NOTICE files in the repository, if there were any in your copy of the project. These files contain the terms and conditions for the project, and provide attribution to the original developers. If you're trying to attribute in the UI of your application, you probably should. It's considered courteous and in the spirit of open source as well. This is also related: Do I need to include the full text of the MIT license in the UI of my app?
Consent for processing someone's personal data is only one of the possible requirements to process that person's personal data. The options listed in Art. 6.1 are (text in Spanish, with links to other languages): a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; c. processing is necessary for compliance with a legal obligation to which the controller is subject; d. processing is necessary in order to protect the vital interests of the data subject or of another natural person; e. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Obviously, your case meets the criteria for c.1 So, you do not need consent from your hosts, and your hosts do not have to sign any consent and they cannot refuse to provide their data if they want to reside at your dwelling. The moment you ask your hosts any data to which you do not have a legitimate interest, you need the consent. And you cannot refuse hospitality to your hosts if they do not want to provide that piece of data. Anyway, maybe it would be a good idea to print a leaflet explaining why you require their data in case they have any doubts. 1 For the Guardia Civil, it would be c. and maybe a few more cases.