Using Personal data before consent I am having an Android App which is going to use some services such as Google Analytics, Firebase etc. I have a thought of having two different consent screens for different region user such as EU Users will have a screen in which the checkbox will be unchecked by default whereas users from other region will have the checkbox prechecked. I would be using the GPS location before taking the consent to find out the users region(Location may not be exact location). Now my question I will use the GPS location to only check the location and WILL NOT STORE IT OR COLLECT IT AT ANY COST. Does the GDPR or any other privacy law stop or disallow me to do that? Any help will be really useful.
Doing this is OK according to the GDPR and other European laws. The relevant bit is GDPRs rules for Lawfulness of processing, and in particular Article 6 (1)b, which says that it is legal to do this if processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; In your particular case, signing up for using your app is "entering into a contract" and it is the data subject who has requested to use your app that is subject to this processing.
You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine. It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.
Yes, your transaction history is your personal data. Personal data is any information relating to an identifiable person. Your transaction history relates to you, and you're definitely identifiable for the bank. You have access to the transaction history to the app, which would probably satisfy Art 15 GDPR. You do also have a right to data portability under Art 20 GDPR which allows you to get your data in a machine-readable format – but strictly speaking this right only applies to data you provided yourself. You could try to explicitly invoke this right. Your GDPR rights must be satisfied without cost. Your bank almost certainly does provide machine-readable API access, in conformance with the open banking mandate from the Revised Payment Services Directive (PSD2, Directive (EU) 2015/2366). The Directive requires your EU member state to have passed a law that gives you “the right to make use of services enabling access to account information”, if you're already using online banking. However, the exact details of that right will depend on the laws in your EU member state. You might already be able to connect to your transaction history via Open Banking software such as GNU Cash.
In the question, you write: The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file). No, it does not. To quote Miss Infogeek: GDPR DOES NOT MAKE CONSENT A MANDATORY REQUIREMENT FOR ALL PROCESSING OF PERSONAL DATA. Consent (Article 6 (1)a) is indeed one of conditions that can be used to comply with the GDPR requirement that processing must be lawful, but it is not the only condition available to the controller to ensure lawful processing &ndash; there are alternatives (before the list of conditions it says that "at least one of the following" must be satisfied). All the conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. One of alternatives are Article 6 (1)f. It says says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) As noted in the question, logging IP addresses for the purpose of security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. It is the default, and most (all?) web-sites do this. I.e. it is legal to do this without consent (if this is not the case, I am pretty sure the outcry had been heard all over the Internet by now).
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
Yes. Article 4 GDPR Definitions (1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Recital 26 Not applicable to anonymous data The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
These are only tangentially related to the GDPR A government entity processing data in accordance with a member state law is ipso facto in compliance with the GDPR. That’s because lawful government data processing is a legitimate reason for processing data under the GDPR. If Germany, for example, passes a law saying German police can record every phone call in Germany, then that would be a lawful basis for processing under the GDPR. There may be constitutional or other legal limitations on such a law but as far as the GDPR is concerned, they’re fine.
Under GDPR Article 6 section 1(f), a lawful basis for processing is: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. It seems that informing a data subject of the availability of a possibly better-focused related site would be a &quot;legitimate interest&quot;, and merely doing a broad geo-locate on the IP does not seem to impact the &quot;interests or fundamental rights and freedoms of the data subject&quot; so it would seem this could be done without specific consent in advance. I don't know of any legal case on this specific point, however.