5 ms·

GDPR Breach, plain and simple. No franchise would risk storing and leaking what amounts to medical records (since that is the source) in front of a GDPR Watchdo

by zaarn 5y ago

GDPR Breach, plain and simple. No franchise would risk storing and leaking what amounts to medical records (since that is the source) in front of a GDPR Watchdog. Pretty sure you'd get the hammer if you did that. Either way, the official apps that let you check the record do not allow tracking, only verification. The simple solution is that if you don't see them using the official app, simply leave.

michaelt 5y ago
> the official apps that let you check the record do not allow tracking, only verification. So why are name and date of birth included in the QR code?
- bigiain 5y ago
  I would guess so that they can use more traditional ID (like a drivers license) to confirm the vaccine record is yours.
- mtmsr 5y ago
  Because you need a way for the pub to authenticate that this is indeed your qr code (matching your id)
  - Mediterraneo10 5y ago
    The EU standard was developed for the purposes of avoiding additional quarantine or testing during cross-border travel, not going to pubs within one’s own country. For domestic use of proof of COVID vaccination, some countries developed their own internal standards alongside the EU standard.
  - raxxorrax 5y ago
    Not currently visiting pubs, I still wait until they stop validating their guests.
- solarexplorer 5y ago
  To check with your passport/id card that this is your QR code and not someone else’s…
- fsw 5y ago
  To compare it with name and DOB in the government ID.
- deleted 5y ago
  [deleted]
- nottorp 5y ago
  I don't think name and date of birth are enough for identity theft anywhere in Europe...
gpvos 5y ago
> The simple solution is that if you don't see them using the official app, simply leave. It'd be easy to make something that looks like the official app but does store the information, especially if that app is open source (is it?).
- libertine 5y ago
  That's beyond the point of GDPR, even if they collect the data illegally the value would be to reach the person (to give them promotional content, advertising, custom experience, what ever...) Basically even if they collected the data they wouldn't be able to use it. If they just collected your name to personalize your experience they'd be literally in deep shit if someone asked: "where did you get this information from?" - which to you may sound a weird question, but since 2018, at least in my country, more and more people ask this question. When in doubt, report. They'd need to show to authorities that the person gave explicit consent to store that data and to be used for personalized experiences. It's about consent. If the user didn't give consent you have no use for the data, and you'll be storing toxic material to get you fined.
- zaarn 5y ago
  An app faking the official look would open you up to so many liabilities and the GDPR watchdogs will probably just drool at the thought of anyone trying to defend that in a court after getting hammered by record fines.

by zaarn 5y ago

michaelt 5y ago

> the official apps that let you check the record do not allow tracking, only verification. So why are name and date of birth included in the QR code?

bigiain 5y ago
I would guess so that they can use more traditional ID (like a drivers license) to confirm the vaccine record is yours.
mtmsr 5y ago
Because you need a way for the pub to authenticate that this is indeed your qr code (matching your id)
- Mediterraneo10 5y ago
  The EU standard was developed for the purposes of avoiding additional quarantine or testing during cross-border travel, not going to pubs within one’s own country. For domestic use of proof of COVID vaccination, some countries developed their own internal standards alongside the EU standard.
- raxxorrax 5y ago
  Not currently visiting pubs, I still wait until they stop validating their guests.
solarexplorer 5y ago
To check with your passport/id card that this is your QR code and not someone else’s…
fsw 5y ago
To compare it with name and DOB in the government ID.
deleted 5y ago
[deleted]
nottorp 5y ago
I don't think name and date of birth are enough for identity theft anywhere in Europe...

gpvos 5y ago

> The simple solution is that if you don't see them using the official app, simply leave. It'd be easy to make something that looks like the official app but does store the information, especially if that app is open source (is it?).

libertine 5y ago
That's beyond the point of GDPR, even if they collect the data illegally the value would be to reach the person (to give them promotional content, advertising, custom experience, what ever...) Basically even if they collected the data they wouldn't be able to use it. If they just collected your name to personalize your experience they'd be literally in deep shit if someone asked: "where did you get this information from?" - which to you may sound a weird question, but since 2018, at least in my country, more and more people ask this question. When in doubt, report. They'd need to show to authorities that the person gave explicit consent to store that data and to be used for personalized experiences. It's about consent. If the user didn't give consent you have no use for the data, and you'll be storing toxic material to get you fined.
zaarn 5y ago
An app faking the official look would open you up to so many liabilities and the GDPR watchdogs will probably just drool at the thought of anyone trying to defend that in a court after getting hammered by record fines.