Tenancies and the GDPR If Tim the tenant and Larry the landlord enter into a tenancy, then do either of them become a data controller of the others name and address? Does the landlord as the &quot;provider&quot; of the housing have greater burdens of propriety in handling tenants' personal data than vice versa? More broadly, do any two parties entering into mutual contract assume compliance burdens under the GDPR, and is the case especially so with respect to something so ubiquitous as tenancies?
Anyone who processes personal data using electronic means or with some filing system is a data controller, as long as they fall within the GDPR's territorial scope, they're not doing the processing on behalf of another data controller, and they're not only doing the processing for purely personal or household purposes. In todays world, it's almost certain that electronic means are involved. And establishing a rental contract generally involves some personal data. We can also assume that both parties are in the UK, and that both are acting on their own behalf. So this leaves the household exception. Larry the landlord will not be covered by the household exception since they're using the personal data for a business purpose. Larry is a data controller. If Tim the tenant is renting a place to live in himself, he's probably acting for purely personal or household purposes and would not be a data controller. If Tim the tenant is renting space for his office, for a church, or for a chessclub in which he is a member, he's no longer acting for purely personal or household means. Depending on context, Tim or Tim's organization may be a data controller. The ICO's guidance on controllers and processors has a checklist “Are we a controller?” that lists common factors establishing controllership. On another page, they write: Wherever personal data is used for purposes other than personal or household processing, the organisation behind it is a controller. Personal or household processing means the personal data you’d usually have in your home, such as family photo albums, friends’ addresses and notes on the fridge, none of which would be covered by data protection laws unless there was another connection to a professional or commercial activity.
The bouncer is employed (or (sub)contracted) by the owner/lessee of premises - someone with the right to evict persons from their private property per the common law rights to exclusive use of one's property. When the bouncer evicts you, they are exercising this right on behalf of and as the agent for the owner, who could do it, but instead has assigned limited agency to the bouncer to do that for them. Entrance to (and remaining on) a property may be authorised and revoked at any time - at the time that consent is not given or is withdrawn, you become a trespasser and the police may be called upon to forcibly remove you from the premises. For example, I can have a party at my house, but if I don't like someone, I'm entitled to ask them to leave. I could also ask a friend to ask that person to leave, if I didn't want to do it myself. Note that bouncers aren't empowered to physically evict anyone except for the general right to use reasonable and proportionate force. For instance, someone that was just standing around in the nightclub probably couldn't be physically thrown out, but someone who was causing harm to themselves or others could be restrained or repelled as appropriate (and if restrained, you'd need to be very careful to do so in the course of effecting a citizen's arrest, otherwise you'd probably be committing false imprisonment). There may be statutory provisions that bestow additional rights and responsibilities upon bouncers, but this is the basic premise. I'm fairly certain that this would apply in all Australian jurisdictions; probably in all common law jurisdictions.
Not legal advice - you should consult an attorney who knows your local jurisdiction. That's a general statement, but especially true here because the GDPR does not include personal liability for directors (or others) in the event of a data breach, but domestic laws may indeed do just that. The UK is one example where certain circumstances can lead to criminal liability for directors of a firm in the event of a breach. That said, your company should care. The fines for knowingly allowing a breach or not reporting it properly in a timely manner have been made more significant than the prior Directive. There are things you could do to potentially mitigate consequences in the event of a breach and a fine being levied on the company, such as aligning with best practices and getting certifications. In sum, the actual punishments for noncompliance will vary by jurisdiction, but any business that handles data in the EU should undoubtedly be ensuring it is aware of what, if any, obligations it has and taking steps to comply before May's deadline.
My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good clause to have in your privacy policy is to basically state if the user submits information about another natural person that they have consent from that natural person for that data and what it would be used for. The internet is the internet. People have been trolling it for years. People have also submitted false information for years. The best a business can do is simply outline what their site does, what data is collected and what it will be used for. That along with what legal basis it’s processed for and following it makes you GDPR compliant in that regard. As to withdrawing consent and the rights given by the GDPR that’s all specific to what infustructure a business has in place. As a developer I know the headaches of the GDPR. Most of it resides in the fact data is not centralized and thus can’t easily be retrieved, modified, or removed. Once you’ve tackled that aspect providing the user their rights under GDPR isn’t to far off.
The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed. If the embed-provider acts as your data processor, then things are generally fine. The GDPR does not really distinguish between personal data processing activities that you perform yourself versus activities that you've outsourced to third parties. However, you would remain responsible for compliance. This also means that per Art 28 GDPR, you will need a contract with that embed-provider (sometimes called a “Data Processing Agreement”, DPA). This contract stipulates that the processor will only use the personal data as instructed by you, but not for their own purposes. With the Google Fonts case, it must be highlighted that Google does not act as a processor for this service. Google does not offer a DPA that covers the Fonts CDN. While Google promises that it doesn't use the personal data collected in this context in any nefarious way, there are zero contractual guarantees for website providers. So we have to consider the scenario when the embed-provider is an independent data controller. We as the website provider have no control over what the embed-provider does with the collected data, our control only extends to whether or not we cause the website to disclose data to that third party. But this is still processing as personal data (see also the CJEU Fashion ID case), and we need a legal basis for this data sharing. In the Google Fonts case, the court in Munich found that there was no legal basis for using Google's CDN. There was no consent, no contractual necessity, and no necessity for a legitimate interest. After all, these fonts could all be self-hosted. (Technical remark: and given how modern browsers enforce cache isolation and provide HTTP/2, serving fonts from your main domain is probably faster anyway). Consent management services will typically act as your data processor. You don't need a legal basis for “sharing” data with them, because the processing remains under your control. As far as the GDPR is concerned, loading a script from your processor's servers is equivalent to loading a script from your own servers (which you're probably hosting via a another data processor anyway). Sometimes, the necessary data processing agreement is already part of the standard terms of service, sometimes it's a separate document that has to be signed. Figuring this out is your responsibility as the data controller, before deploying the service. Art 6 GDPR doesn't say that you always need consent. It says that you need a legal basis, for which paragraph 1 enumerates six choices. For a lot of use cases, a “legitimate interest” will be appropriate, though it requires a balancing test. Sometimes, other laws mandate that you use a particular legal basis. For example, the ePrivacy Directive says that you must get GDPR-consent when accessing or storing information on the user's device (such as cookies), unless that access/storage is strictly necessary to provide a service explicitly requested by the user.
It seems that A is the data controller and X is a data processor who processes personal data on behalf of A, and will only use the data as instructed by A. This will be formalized by a contract/data processing agreement per Art 28 GDPR, which is probably meant here by a “order processing contract”. The Art 33 GDPR responsibility to notify the supervisory authority in the event of a data breach lies solely with the data controller A, not the processor X. However, the processor X is required to notify the controller A “without undue delay”.
No GDPR applies to people (not just citizens) who are in the EU. It has no applicability if both parties are not in the EU.
Is this even legal? Yes, it is lawful. The Ontario Tenancy Act does not seem to outlaw that type of clauses. But the clause (or lease) will be binding only if you agree to it. Also note that the clause refers to reasonable costs, which implies that those costs must be for a reasonable cause. In other words, the landlord would be barred from recovery of legal expenses if you persuade the Board that the landlord's complaint is frivolous or vexatious. Notwithstanding that the clause is lawful, I would personally discourage you from agreeing to pay the adversary's attorney fees. Note that the clause may apply in the event that neither party fully prevails, whence it is in your best interest to preclude the risk of having to reimburse the landlord in that scenario.