Hot answers tagged

110

It is not clear that the first kind of email is legal. A French association, la Quadrature du Net, is planning to launch a class action against five big tech companies (the famous "GAFAM") on May 28th about just this practice. Here is a summary of their arguments: Article 6 §1 of GDPR lists six cases for processing personal data legally, one of these is ...


39

The goal of GDPR is about protecting personally identifiable information (PII) as much as possible. The interaction of a specific user with your application are pretty sure such PII. If you really need to log this information you should inform your user about this process, i.e. the purpose of the data collection, how long the information gets stored and ...


36

MD5 or SHA is not the concern. Hashes can be used for pseudonymization. The problem is that the hash would need to be salted (or peppered) so that data from other sources could not be used to identify the person. My email is the same everywhere. A hash of it would also be the same. So that means that, in this case, the hash and my email become synonymous. ...


27

Logging data is not the issue under GDPR. The part that matters is what happens to the log, who can see it, how long it is stored, what the log is used for, and if you can satisfy the rights of the data subject once you process and store the data. If you need to log the email in order to provide your service, then there is no problem to log it. But if you ...


22

The definition of personal data as mentioned in the GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, ...


19

Some quotes from the GDPR law: [...] Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ...


11

The 1st category are the big companies (like large e-mail providers) that will do what they want anyway and since you want to use their service you will have accept their conditions. Not doing that will prevent you from using their services. The 2nd category are the more fair ones that ask you if you want to receive from them information or not. Usually, ...


10

Firstly, there's no case law yet, and different lawyers are interpreting the rules in different ways: some are playing very safe, others are sailing closer to the wind. Some probably reckon that they are unlikely to be high on the list of people worth prosecuting. (Let's face it, no-one's going to prosecute a sports club for keeping a note of who last fixed ...


8

Assuming GDPR apply to your organization, yes you should worry about GDPR. PCI-DSS compliance doesn't imply GDPR compliance. There are many concept present in GDPR and not in PCI-DSS or not with the same scope/expectations. For me you will have to take a close look of some principle of the GDPR like : Admissibility of the user for the processing of his ...


8

TLDR: Possible From https://www.seobyrvc.com/what-is-personally-identifiable-information-pii/: The following are examples of “potentially personally-identifiable information”. That is, the data elements by themselves cannot be linked to a specific person but when combined with other information (such as items 1 through 11, above), they can be. A ...


7

Article 5 of GDPR specified the basic principles for processing data. Article 5 "Principles relating to processing of personal data" (1) Personal data shall be: ... (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving ...


6

As other answers have stated, GDPR requires explicit, informed, unambiguous consent. Plus, according to the accountability principle, data controllers shall be able to demonstrate that. In theory: Organisations that are sending opt-out e-mails did already have your explicit consent properly recorded (e.g. when you subscribed to a newsletter, or signed a ...


6

In the GDPR regulation (Article 39, on page 7), it says Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing. So this is down to the controller. If the ...


5

On Compliance I'm only loosely familiar with the specifics of the legislation, but as I understand it, there's nothing to indicate that database encryption is required to hold personal information and be in compliance with the General Data Protection Regulation (GDPR). On the other hand, using appropriate encryption measures will somewhat lessen the ...


5

IANAL, but GDPR does not make encryption mandatory for personal data. Read this article to understand the complexity around encryption and GDPR better. In the GDPR encryption is explicitly mentioned as one of the security and personal data protection measures in a few Articles. Although under the GDPR encryption is not mandatory, it is certainly ...


5

On top of the areas already mentioned here, there's a section of GDPR relating to data retention. A lot of the e-mails which are asking people (or at least the ones I am getting) to opt in are also stating that they haven't had any interaction with (or rather, from) me for a few years, and therefore if I want to continue to receive their e-mails still, then ...


5

There is no binary answer to be 'GDPR compliant'. There are however some steps you can take to be compliant to some extend. Key element to the GDPR is that you need either explicit permission from your users (or visitors) to collect, store and use their data or another legal basis (such as required by law). The request to use their data must use clear ...


4

Yes, it introduces risk, but might be required, depending on what you're doing with the data. Imagine a database of lots of people. Perhaps it includes names, addresses, and dates of birth, but the dates of birth aren't encrypted or tokenised, to allow for easy sending out birthday reminders. If an attacker who steals the database can identify the name ...


4

Technically, the Data Controller is responsible for making sure all processes are GDPR compliant. That means that whoever uses your service needs to make sure that they are being compliant. If they need you to be compliant, then they need to engage you. You can decline to become compliant if that does not meet your goals. But, if you knowingly process ...


4

It is exactly the right thing to have a deletion request management system. In fact, given the importance of this function, the timeframes for response, the workflows to coordinate, it is almost certainly necessary. GDPR does not prevent companies from storing personal details of their users/customers/etc for legitimate purposes. Instead it is intended to ...


4

The law is about what you are allowed to store and targets your infrastructure. And the law is intended to give the user control over his data. The client cache belongs to the client's infrastructure in any reasonable definition and already is under control of the user. This may be interpreted differently when you try things like supercookies which stay ...


4

GDPR is more restrictive than the US definition of PII, in which, non-PII that allow any inference to the identities is also under GDPR jurisdiction. I doubt given masking examples will withstand GDPR audit. Replace the email address with an obvious placeholder (e.g. redacted@redacted.invalid), that is what everyone is doing. Partial masking is weak in ...


3

If you are selling goods or services to EU residents then YES. GDRP regulation is different to PCI-DSS. Even if you are complaint to PCI-DSS that doesn't mean you are complaint to GPPR. However, GDPR doesn't apply to those organisations whose target audience isn't EU residents. Do we need to do anything additional to make sure we are consistent with GDPR ...


3

Realistically, pseudonymization is any method of obfuscating someone's PII/NPI so that it can't be reasonably traced back to one certain individual. GDPR doesn't necessarily dictate what hashing algorithm you are required to use in order to comply with it's standard, and to be honest - it's best that it doesn't, because if you consider the fact that if ...


3

The problem with the GDPR lies in the remark: "without even notifying this software is being installed". In that case: no it is not compliant. If you dig a little deeper, you will find that in almost all cases there has been some form of communication about this, either in the contract or via the work council and publication to all employees. In general, ...


2

GDPR relates specifically to personally identifiable information, that is information that could be reasonably used to identify a person, like address, email address, user names, IP address. If the password dump contains only a password and no username, account details or IP address, it is likely that they would not be considered PII for the purposes of ...


2

GDPR says what to do, not how to do it. There are various tokenization technologies out there. I wouldn't store the lookup table in the same database, as if the token data can be compromised, it's likely the other table can as well. The conversion code book, or transform key, should be stored elsewhere. Here are some links which may be of use. My former ...


2

Article 32 states "the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk". If a regulator looked at what you were doing and concluded that you hadn't done this, they could certainly impose a penalty on your organisation. Their conclusion - and the penalty - would of course be ...


2

If you're providing services to European citizens, you need to obey the corresponding European laws. That's why some big news sites build GDPR-walls (because they did not start early enough to prepare for data protection). But please read about what GDPR really says about technologies like cookies: There are two types of cookies (and related technologies, ...


2

they are built into the web! No they are not. The WWW defines functionality - but its use is optional. It is a convenient and well understood mechanism for supporting sessions over a stateless protocol, but are a cornerstone of monetization. Are there legal implications [arising from the GDPR] for a publicly available website For a website run by EU ...


Only top voted, non community-wiki answers of a minimum length are eligible