5 ms·

> GDPR From the article: > ...have exercised our discretion under our Terms of Service to disable your account(s) The language here implies that the account

by gnode 8y ago

> GDPR From the article: > ...have exercised our discretion under our Terms of Service to disable your account(s) The language here implies that the account still exists in a suspended state, and is not deleted. If you're a european, under the GDPR they must give you all your data if you ask for it. Maybe this would include the reason they banned the account. Otherwise, you can at least demand that they erase the data they're holding only to your disadvantage.

gwright 8y ago
It isn't clear to me that the GDPR requires disclosure of data that is related to a person but was not created by or provided by that person. So complaints from user1 about user2 or customer service notes about user2 wouldn't be considered personal data of user2 and thus wouldn't fall under GDPR rules. If this isn't the correct interpretation, I would appreciate a pointer to something in the GDPR that elaborates on this.
- M2Ys4U 8y ago
  >It isn't clear to me that the GDPR requires disclosure of data that is related to a person but was not created by or provided by that person. Why wouldn't it? If it's data about an identifiable individual then - by definition - it is personal data. Furthermore, in the ICO's recent report into political parties' use of personal data[0], they expressed the following view: "Our investigation found that political parties did not regard inferred data as personal information as it was not factual information. However, the ICO’s view is that as this information is based on assumptions about individuals’ interests and preferences and can be attributed to specific individuals, then it is personal information and the requirements of data protection law apply to it." [0] https://ico.org.uk/media/action-weve-taken/2259369/democracy-disrupted-110718.pdf https://ico.org.uk/media/action-weve-taken/2259369/democracy... p29
  - gwright 8y ago
    There is a difference between the interpretation of the phrase "personal data" within the context of the GDPR and outside the context of GDPR. At least I think there is a difference. For example, consider a website that maintains a collection of birthdays for public figures derived from public sources (historical documents, news accounts, social media posts from the public figures themselves, etc.). In many jurisdictions the birth dates might even be available via public record searches. Clearly the birth dates are "personal data" in the colloquial sense of the phrase, but I don't think that the data as held by the website operator would be subject to the GDPR provisions, right?
    - M2Ys4U 8y ago
      Yes, those data would be personal data, and thus be subject to the GDPR. Personal data is _any_ information about an identified (or identifiable) natural person.
- detaro 8y ago
  The definition of personal data in GDPR doesn't mention "created or provided by that person" in any way. Can you provide a reference limiting the scope past the definition in Article 4? Article 14 explicitly talks about data not provided by the data subject, further clarifying that it is in scope.
  - gwright 8y ago
    My wording wasn't quite right. GDPR refers to "personal data". I don't think all data about a person is "personal data" to be controlled by that person according to GDPR. * are my interview notes during the hiring process "personal data" subject to GDPR provisions (disclosure, destruction, etc). * are my business meeting notes with a contractor subject to GDPR?
    - smu 8y ago
      Both times: yes and no. They both are indeed considered personal data, but they don't always have to be disclosed (as disclosing might harm others)
- jdietrich 8y ago
  >It isn't clear to me that the GDPR requires disclosure of data that is related to a person but was not created by or provided by that person. It absolutely, positively does require that disclosure. Article 15 states: "The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data" "Personal data" is defined in Article 4 as: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;". If I have any information* that can be related to you by any identifier, directly or indirectly, it is personal data within the scope of GDPR. Server logs, invoices, customer service records, CCTV footage, emails between employees that mention your name or username, the whole kit and caboodle. The definition of "processing" given in Article 4 includes storage. The regulations would be a farce if I could hoover up data about you from third parties or through surveillance technology, but you had no rights over that data simply because you didn't provide it to me. https://gdpr-info.eu/ https://gdpr-info.eu/
  - gnode 8y ago
    The quote there mostly defines what a natural person is, not what "relating" should be taken to mean. Does it refer only to facts about a person, or does it include opinions and business decisions made by the company about that person? If one employee tells another by email that they dislike a particular customer and asks to have them banned, is that the customer's personal information in itself?
    - smu 8y ago
      See my answer above.
- smu 8y ago
  A couple of points to answer your question: 1. Yes, when exercising your "right of access", companies would have to send you all the personal data they have on you, except when disclosing this information would harm others (ie: notes of your manager about your performance or the example you gave) The exception does not mean that they can blankly refuse to give you any data, only the "offensive" part must be refused. By definition, that is still considered personal data however. As M2Ys4U mentioned: inferred data is also personal data. 2. there is a case where you don't have to provide all information: the right of data portability only applies to data provided by the data subject. 3. Someone is referencing article 14 below. That is not the same as giving access to data. Article 14 specifies how a data subject must be informed about processing of his data when you've received the data from someone else. For example: you've received someone's info from a recruiter and you now want to process his data to see if this person is a valid prospect. The article works together with article 13 (how to inform a data subject on what you are doing with the data he gives to you directly). Together, these articles are the reason for 50% of the privacy notices of the last couple of months :-)
close04 8y ago
> Maybe this would include the reason they banned the account It might not unless the definition is really stretched. It's not data collected about you. Otherwise every email some employee sends discussing this situation would also need to be included.
- jdietrich 8y ago
  >It might not unless the definition is really stretched. It's not data collected about you. It's quite obviously personal data within the definitions used in GDPR. It's information that can be related to a natural person; those two criteria are the only criteria that must be satisfied for data to be regulated under the GDPR. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ >Otherwise every email some employee sends discussing this situation would also need to be included. Yep. If the contents of those emails can be related to a natural living person by any identifier (name, username, email address, account number etc) then it's personal data.
  - wafflesindeed 8y ago
    Its identifiable, yes, but not personal. Otherwise, all free-form text entry would have to be processed prior to a GDPR request, which is not likely. Take Facebook as an example, when you request your personal data, they present what is linked in their database to you, which is of course not where anyone mentions your name. Who is to say that my name (Paul Smith) identifies me and not some other Paul?
    - smu 8y ago
      Actually, when someone is identifiable with a couple of pieces of data, that becomes personal data. For example, if you would be the only Paul Smith on earth, we would consider that personal data. If you are the only Paul Smith in the US and the context reveals that we are talking about someone in the US, those 2 pieces together are personal data (and so on). That is what they mean with "indirect identification" in the link provided by jdietrich.

by gnode 8y ago

gwright 8y ago

It isn't clear to me that the GDPR requires disclosure of data that is related to a person but was not created by or provided by that person. So complaints from user1 about user2 or customer service notes about user2 wouldn't be considered personal data of user2 and thus wouldn't fall under GDPR rules. If this isn't the correct interpretation, I would appreciate a pointer to something in the GDPR that elaborates on this.

M2Ys4U 8y ago
>It isn't clear to me that the GDPR requires disclosure of data that is related to a person but was not created by or provided by that person. Why wouldn't it? If it's data about an identifiable individual then - by definition - it is personal data. Furthermore, in the ICO's recent report into political parties' use of personal data[0], they expressed the following view: "Our investigation found that political parties did not regard inferred data as personal information as it was not factual information. However, the ICO’s view is that as this information is based on assumptions about individuals’ interests and preferences and can be attributed to specific individuals, then it is personal information and the requirements of data protection law apply to it." [0] https://ico.org.uk/media/action-weve-taken/2259369/democracy-disrupted-110718.pdf https://ico.org.uk/media/action-weve-taken/2259369/democracy... p29
- gwright 8y ago
  There is a difference between the interpretation of the phrase "personal data" within the context of the GDPR and outside the context of GDPR. At least I think there is a difference. For example, consider a website that maintains a collection of birthdays for public figures derived from public sources (historical documents, news accounts, social media posts from the public figures themselves, etc.). In many jurisdictions the birth dates might even be available via public record searches. Clearly the birth dates are "personal data" in the colloquial sense of the phrase, but I don't think that the data as held by the website operator would be subject to the GDPR provisions, right?
  - M2Ys4U 8y ago
    Yes, those data would be personal data, and thus be subject to the GDPR. Personal data is _any_ information about an identified (or identifiable) natural person.
detaro 8y ago
The definition of personal data in GDPR doesn't mention "created or provided by that person" in any way. Can you provide a reference limiting the scope past the definition in Article 4? Article 14 explicitly talks about data not provided by the data subject, further clarifying that it is in scope.
- gwright 8y ago
  My wording wasn't quite right. GDPR refers to "personal data". I don't think all data about a person is "personal data" to be controlled by that person according to GDPR. * are my interview notes during the hiring process "personal data" subject to GDPR provisions (disclosure, destruction, etc). * are my business meeting notes with a contractor subject to GDPR?
  - smu 8y ago
    Both times: yes and no. They both are indeed considered personal data, but they don't always have to be disclosed (as disclosing might harm others)
jdietrich 8y ago
>It isn't clear to me that the GDPR requires disclosure of data that is related to a person but was not created by or provided by that person. It absolutely, positively does require that disclosure. Article 15 states: "The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data" "Personal data" is defined in Article 4 as: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;". If I have any information* that can be related to you by any identifier, directly or indirectly, it is personal data within the scope of GDPR. Server logs, invoices, customer service records, CCTV footage, emails between employees that mention your name or username, the whole kit and caboodle. The definition of "processing" given in Article 4 includes storage. The regulations would be a farce if I could hoover up data about you from third parties or through surveillance technology, but you had no rights over that data simply because you didn't provide it to me. https://gdpr-info.eu/ https://gdpr-info.eu/
- gnode 8y ago
  The quote there mostly defines what a natural person is, not what "relating" should be taken to mean. Does it refer only to facts about a person, or does it include opinions and business decisions made by the company about that person? If one employee tells another by email that they dislike a particular customer and asks to have them banned, is that the customer's personal information in itself?
  - smu 8y ago
    See my answer above.
smu 8y ago
A couple of points to answer your question: 1. Yes, when exercising your "right of access", companies would have to send you all the personal data they have on you, except when disclosing this information would harm others (ie: notes of your manager about your performance or the example you gave) The exception does not mean that they can blankly refuse to give you any data, only the "offensive" part must be refused. By definition, that is still considered personal data however. As M2Ys4U mentioned: inferred data is also personal data. 2. there is a case where you don't have to provide all information: the right of data portability only applies to data provided by the data subject. 3. Someone is referencing article 14 below. That is not the same as giving access to data. Article 14 specifies how a data subject must be informed about processing of his data when you've received the data from someone else. For example: you've received someone's info from a recruiter and you now want to process his data to see if this person is a valid prospect. The article works together with article 13 (how to inform a data subject on what you are doing with the data he gives to you directly). Together, these articles are the reason for 50% of the privacy notices of the last couple of months :-)

close04 8y ago

> Maybe this would include the reason they banned the account It might not unless the definition is really stretched. It's not data collected about you. Otherwise every email some employee sends discussing this situation would also need to be included.

jdietrich 8y ago
>It might not unless the definition is really stretched. It's not data collected about you. It's quite obviously personal data within the definitions used in GDPR. It's information that can be related to a natural person; those two criteria are the only criteria that must be satisfied for data to be regulated under the GDPR. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ >Otherwise every email some employee sends discussing this situation would also need to be included. Yep. If the contents of those emails can be related to a natural living person by any identifier (name, username, email address, account number etc) then it's personal data.
- wafflesindeed 8y ago
  Its identifiable, yes, but not personal. Otherwise, all free-form text entry would have to be processed prior to a GDPR request, which is not likely. Take Facebook as an example, when you request your personal data, they present what is linked in their database to you, which is of course not where anyone mentions your name. Who is to say that my name (Paul Smith) identifies me and not some other Paul?
  - smu 8y ago
    Actually, when someone is identifiable with a couple of pieces of data, that becomes personal data. For example, if you would be the only Paul Smith on earth, we would consider that personal data. If you are the only Paul Smith in the US and the context reveals that we are talking about someone in the US, those 2 pieces together are personal data (and so on). That is what they mean with "indirect identification" in the link provided by jdietrich.