&quot;Find my device&quot; and GDPR compliance Google and Apple both offer a &quot;Find my Device&quot; service which allows to track or even remotely wipe a stolen device. Yet some companies claim that tracking stolen devices is not a legitimate business reason under GDPR, e.g. TomTom: EU Data Protection legislation states that companies are only allowed to record and keep personally identifiable information (such as GPS tracks and traces linked to a particular device) if there is a valid business reason for doing this. Since TomTom does not have such a business reason, we have made sure that our data processing operation does not maintain information regarding user-, or device locations in identifiable form. That means we cannot track a specific user or a specific device. How is tracking a stolen GPS different from tracking a stolen phone?
It is not different. But one company can decide to approach compliance differently from another. Here, TomTom has chosen a fairly safe/conservative interpretation, whereas Google and Apple decided that more data collection is appropriate. A “find my device” style functionality appears to be entirely unproblematic if the user books that particular service (regardless of whether the service is paid or gratis) and provides consent for the location data collection. The legal basis for such a service could then be Art 6(1)(a) consent or Art 6(1)(b) necessity for performance of a contract to which the data subject is party. Personally, I believe that Google is not sufficiently transparent about how Find My Device works, but that TomTom could provide a compliant service if they wanted to. That TomTom doesn't offer this service primarily shows that they don't think developing this service is worth it. Wiping a remote device is unrelated to this issue and doesn't seem to provide GDPR challenges. At least in a business context, remote wiping may be an appropriate security measure and may then even be mandated by the GDPR (e.g. see Art 24 or Art 32).
a few quick notes that come to mind. As the commenters point out: DSGVO is indeed the German equivalent name to the GDPR (English term) "Imprint" isn't a privacy related topic that much, as such it's not really changed by the upcoming GDPR The GDPR changes many things, but the requirement for up front information isn't one of them - so it would've already been a rule to follow Sometimes the question who is responsible for privacy information might not be that easy to decide when you're on platforms. I take this situation as being pretty clear though. You are basically given a blank slate, you can do with that page whatever you want, and the visitor has no clue whatsoever that it might be hosted by Github. In addition to this, Github would be classified as a data processor (providing the tool) and you as the data controller who is in charge of practically everything except for the provision of the page. I hope this helps. Btw. it's not that hard anymore to write a privacy policy these days.
Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea. If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution? Is it GDPR compliant that their answer to my deletion request is "We will delete the data..." The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”. You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.
There are a number of misconceptions in this question. Firstly, the regulatory environment did not drastically change when the GDPR came into force in 2018. Previously, each EU member state had its own laws implementing the 95/46/EC Data Protection Directive. The GDPR harmonizes these laws, and replaces them with a single EU-wide law. However, the GDPR is largely identical with the DPD. In particular, both laws have the same definition of a controller. Secondly, the data controller is not a position to be designated, like a Data Protection Officer would be. A controller is whoever – alone or jointly with others – determines the purposes and means of processing of personal data. Whether someone can decide the purposes of processing is a matter of fact, not a matter of formalities. There can be more than one controller. Most likely, the institution hosting the research group is the controller. For individual researchers, the important aspect would be to demonstrate that they've fully complied with their institution's procedures at all times – that they acted as agents of the controller, not as controllers of their own. The institution might have a more difficult time mounting the defense if its technical and organizational measures were inadequate. For example, keeping an unattended server running for five years without security updates borders on gross negligence – so there should have been a procedure so that each system has a clear point of contact who is responsible for administrating the system. The controller should also have inventoried its systems and processing activities at the latest in preparation of GDPR, e.g. for an Art 30 record of processing activities. Your question suggests that no one could be at fault because no one did anything, but inaction and failure to fulfil responsibilities can also be a violation of law. If the institution wasn't convinced that this server was GDPR-compliant, the correct approach would have been to shut the server down, not to continue the processing of personal data. Of course, the controller may be able to demonstrate that this breach of GDPR was very minor, for example because the personal data was pseudonymized and because other technical measures (like firewalls) would have prevented unauthorized access.
Of course it is illegal. You are attempting to access somebody's data without their knowledge and certainly without their consent. In the U.K. it is a crime under the Computer Misuse Act 1990, the Police and Justice Act 2006 and the Serious Crimes Act 2015. The clue here should be in the term Serious Crimes. The Human Rights Act, and indeed the ECHR, should never come into it unless it was state sponsored or corporate spying. And even then certain states have given themselves Orwellian totalitarian authority to do as they please.
There is nothing preventing the OP's &quot;subject&quot; from making a Subject Access Request in these circumstances From the British Transport Police's Privacy Notice page, under the heading &quot;How we use personal data&quot;: This privacy notice explains: ... the rights individuals have when we process their personal data. ... Right of Access: You can request access to the personal data we hold about you free of charge. You can request access to the personal data we hold about you using the contact details in this privacy notice. ... We collect personal data from a variety of sources, including: ... sound and visual images (e.g. from body worn cameras, CCTV, or facial recognition software); ... our own CCTV systems and body worn cameras. There's more detail in the link, which I have not replicated here to save space and avoid unnecessary &quot;noise&quot;, but the above should cover the relevant points raised by the OP
The status of any PII (Personally Identifiable Information) is the same in GDPR regardless of location, or who enters it. Its goals are (among others) to stop any actor (company / government or other) from hiding responsibility about their use and practices around people's data. GDPR does even apply to anything offline and on paper. Basically it means you have to validate any entry field is free of PII before processing it. Or make it clear in your privacy statement how you handle this use-case.
First, &quot;I've seen some people say it is legal to do so but I want a second opinion.&quot; This is not a legal opinion. This is only in response to the question &quot;Can you use (TM) on a product that is not Trademarked&quot;? Second, you did not specify a jurisdiction. Since you mentioned Apple, I will assume USA. tl/dr: Yes, you can used the TM mark and no, it is not fraudulent. In the USA, there are three &quot;trademark&quot; symbols, (R), (TM), and (SM). (R) - (Registered) The federal registration symbol. This may be used only once the mark is actually registered in the USPTO. It my not be used while the application is pending. (TM) - (Trademark) / (SM) - (Service Mark) - According to the United States Patent and Trademark Office: If you claim rights to use a mark, you may use the &quot;TM&quot; (trademark) or &quot;SM&quot; (service mark) designation to alert the public to your claim of a &quot;common-law&quot; mark. No registration is necessary to use a &quot;TM&quot; or &quot;SM&quot; symbol and you may continue to use these symbols even if the USPTO refuses to register your mark. Those symbols put people on notice that you claim rights in the mark, although common law doesn't give you all the rights and benefits of federal registration.