4 ms·

The owner of the store does have the right to record the sales transaction data. But that was never under dispute even with GDPR. GDPR specifically says that yo

The owner of the store does have the right to record the sales transaction data. But that was never under dispute even with GDPR. GDPR specifically says that you do not have the right to be forgotten in the information is important for legal compliance (e.g. tax records), free speech, and a couple of other things. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-the-general-da... See “when does [it] not apply?” GDPR already applies to governments. What makes you think it is not? https://www2.deloitte.com/nl/nl/pages/risk/articles/gdpr-in-the-public-sector.html# https://www2.deloitte.com/nl/nl/pages/risk/articles/gdpr-in-... > Starting May 25th 2018, all organisations, including those in the public sector, need to comply with the GDPR. Government agencies have been working their asses off to become GDPR compliant. If you have a problem with the way your shipping info is handled, file a complaint against that government agency at the French data protection authority. Please stop the FUD. The right to be forgotten has never been absolute and applies to both companies and government.

mirimir 8y ago
> GDPR already applies to governments. What makes you think it is not? This, for example: > Germany's spy agency can monitor major internet hubs if Berlin deems it necessary for strategic security interests, a federal court has ruled. > In a ruling late on Wednesday, the Federal Administrative Court threw out a challenge by the world's largest internet hub, the De-Cix exchange, against the tapping of its data flows by the BND foreign intelligence service. > The operator had argued the agency was breaking the law by capturing German domestic communications along with international data. > However, the court in the eastern city of Leipzig ruled that internet hubs "can be required by the federal interior ministry to assist with strategic communications surveillance by the BND". https://www.yahoo.com/news/german-spy-agency-keep-tabs-internet-hubs-court-092618037.html https://www.yahoo.com/news/german-spy-agency-keep-tabs-inter...
- bigbugbag 8y ago
  Since when Germany's spy agency has been a government ? Also see the much controversed "legitimate interests" exemption to GDPR that has been carried over from the 1995 EU directive.
  - mirimir 8y ago
    If it's not part of the German government, they have a larger problem. My point is that Europeans overall are more comfortable with government snooping, and less comfortable with snooping by private interests, than Americans are. In practice, of course, American government agencies snoop far more than European ones do, but the American ones must be more covert about it.
- SiempreViernes 8y ago
  GDPR has national security exemptions dude...
  - mirimir 8y ago
    I know that. So it doesn't necessarily apply to governments.
zerostar07 8y ago
> GDPR already applies to governments. What makes you think it is not? It doesnt apply to security-related services, and the governements are allowed to override it for most purposes as outlined in article https://gdpr-info.eu/art-23-gdpr/ https://gdpr-info.eu/art-23-gdpr/
- DanBC 8y ago
  For an example that gets a bit meta: https://twitter.com/bainesy1969/status/1001902266620764160?s=20 https://twitter.com/bainesy1969/status/1001902266620764160?s... > ICO rules that ICO failed to comply with timescales laid down in the FOI law that ICO regulates link: https://ico.org.uk/media/action-weve-taken/decision-notices/2018/2259051/fs50741317.pdf https://ico.org.uk/media/action-weve-taken/decision-notices/...
- M2Ys4U 8y ago
  There are three related reasons for this: 1. Each EU member state has a different legal framework and so a Regulation (which has direct effect, meaning it applies as-is and does not have to be "transposed" into national law) would not be appropriate when dealing with criminal investigations; 2. The EU can only act in areas where it has been given "competence" to do so under the Treaty on the European Union and Treaty on the Functioning of the European Union. Member states are reluctant to give the EU broad competence to establish criminal offences or to regulate the investigation and prosecution of offences; 3. The treaties explicitly exclude almost all activities related to national security because that is a fundamental feature of being sovereign, which EU member states are and the EU is not. Due to points 1 and 2, the EU passed the Law Enforcement Directive (2016/680/EC) which regulates processing of personal data in a law enforcement context. Being a Directive (and not a Regulation) means that each member state has latitude to adapt it to their respective legal frameworks when transposing it into national law. Incidentally, point 3 will cause huge problems for the UK when we eventually leave the EU. The Court of Justice of the European Union - the EU's highest court - cannot take in to account laws of a member state relating to national security (insofar as they _only_ relate to national security) due to their exclusion by the treaties, but they can take in to account laws of a third country.
sunir 8y ago
I read the ICO article and discovered the GDPR applies unless it doesn’t and I can refuse to act unless I can’t and I can charge fees unless they don’t want me to. I still have no idea what to do exactly. I don’t really think it is my responsibility but I live in a country and operate in another country where laws this vague are unenforceable.

mirimir 8y ago

> GDPR already applies to governments. What makes you think it is not? This, for example: > Germany's spy agency can monitor major internet hubs if Berlin deems it necessary for strategic security interests, a federal court has ruled. > In a ruling late on Wednesday, the Federal Administrative Court threw out a challenge by the world's largest internet hub, the De-Cix exchange, against the tapping of its data flows by the BND foreign intelligence service. > The operator had argued the agency was breaking the law by capturing German domestic communications along with international data. > However, the court in the eastern city of Leipzig ruled that internet hubs "can be required by the federal interior ministry to assist with strategic communications surveillance by the BND". https://www.yahoo.com/news/german-spy-agency-keep-tabs-internet-hubs-court-092618037.html https://www.yahoo.com/news/german-spy-agency-keep-tabs-inter...

bigbugbag 8y ago
Since when Germany's spy agency has been a government ? Also see the much controversed "legitimate interests" exemption to GDPR that has been carried over from the 1995 EU directive.
- mirimir 8y ago
  If it's not part of the German government, they have a larger problem. My point is that Europeans overall are more comfortable with government snooping, and less comfortable with snooping by private interests, than Americans are. In practice, of course, American government agencies snoop far more than European ones do, but the American ones must be more covert about it.
SiempreViernes 8y ago
GDPR has national security exemptions dude...
- mirimir 8y ago
  I know that. So it doesn't necessarily apply to governments.

zerostar07 8y ago

> GDPR already applies to governments. What makes you think it is not? It doesnt apply to security-related services, and the governements are allowed to override it for most purposes as outlined in article https://gdpr-info.eu/art-23-gdpr/ https://gdpr-info.eu/art-23-gdpr/

DanBC 8y ago
For an example that gets a bit meta: https://twitter.com/bainesy1969/status/1001902266620764160?s=20 https://twitter.com/bainesy1969/status/1001902266620764160?s... > ICO rules that ICO failed to comply with timescales laid down in the FOI law that ICO regulates link: https://ico.org.uk/media/action-weve-taken/decision-notices/2018/2259051/fs50741317.pdf https://ico.org.uk/media/action-weve-taken/decision-notices/...
M2Ys4U 8y ago
There are three related reasons for this: 1. Each EU member state has a different legal framework and so a Regulation (which has direct effect, meaning it applies as-is and does not have to be "transposed" into national law) would not be appropriate when dealing with criminal investigations; 2. The EU can only act in areas where it has been given "competence" to do so under the Treaty on the European Union and Treaty on the Functioning of the European Union. Member states are reluctant to give the EU broad competence to establish criminal offences or to regulate the investigation and prosecution of offences; 3. The treaties explicitly exclude almost all activities related to national security because that is a fundamental feature of being sovereign, which EU member states are and the EU is not. Due to points 1 and 2, the EU passed the Law Enforcement Directive (2016/680/EC) which regulates processing of personal data in a law enforcement context. Being a Directive (and not a Regulation) means that each member state has latitude to adapt it to their respective legal frameworks when transposing it into national law. Incidentally, point 3 will cause huge problems for the UK when we eventually leave the EU. The Court of Justice of the European Union - the EU's highest court - cannot take in to account laws of a member state relating to national security (insofar as they _only_ relate to national security) due to their exclusion by the treaties, but they can take in to account laws of a third country.

sunir 8y ago

I read the ICO article and discovered the GDPR applies unless it doesn’t and I can refuse to act unless I can’t and I can charge fees unless they don’t want me to. I still have no idea what to do exactly. I don’t really think it is my responsibility but I live in a country and operate in another country where laws this vague are unenforceable.