5 ms·

GDPR applies to everyone, including individuals.

donatj 4y ago
Does that mean I can send people requests to delete my contact info from their phone and they're legally required to comply?
- geofft 4y ago
  From GDPR article 2: > 2. This Regulation does not apply to the processing of personal data: > (c) by a natural person in the course of a purely personal or household activity My sense (I am neither a lawyer nor European so this is certainly not European legal advice) is that you cannot use GDPR to compel someone to delete your contact info if they're solely a social acquaintance, but you can use it to compel them to delete it if they're a one-person business of some sort (contractor, Etsy seller, lawyer, etc.).
  - nolok 4y ago
    Exactly, your baby sitter, your employer, your lawyer, the plumber you called two months ago ... Are covered. The person you traded phone at the bar last week, your neighbor or your coworker from last job are not.
- makeitdouble 4y ago
  If they operate a service for you, yes. For instance the baby sitter you hire now and then probably keeps track of the contacts of their potential clients, and you could request deletion of your data if you don’t intend to work with them for a few years.
- dumbfounder 4y ago
  And does this mean I can do this to the collection agent trying to get me to pay 4x for a parking ticket I got in Italy 5 years ago?
  - lambertsimnel 4y ago
    IANAL. Although I imagine you could, presumably they'd argue that (while your parking tickets are unpaid) they have a legal basis other than consent for processing your personal data. In that case, you'd probably have to find grounds for erasure other than withdrawal of consent. 1d or 1e of Article 17 look most relevant (but maybe not very promising): https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
    - dumbfounder 4y ago
      So Italy issued the ticket, gets my contact info from the rental company, then hands it over to the collection agency. Is it reasonable that all of that is something I agreed to beforehand? I have no idea. If you rent a car in the EU should you immediately send them a GDPR request after you are done to get them to remove your data so you can't be found? Or is there a legal requirement for them to hold on to the data? Are my rights different because I do not reside in the EU?
      - lambertsimnel 4y ago
        I assume (but I don't know) that GDPR applies fully if any party is in/from the EU. (In practice, if the data processor is outside the EU, enforcement might be difficult, but in your case it sounds like the data processor is inside the EU, so I imagine you have the same rights in this case as those who do reside in the EU.) However, my understanding is that 1) if your data is processed for contractual purposes, the data processor has a right not to delete it on request 2) if your data is processed for law enforcement purposes, the data processor has a duty not to delete it on request There are several legal grounds for processing personal data under GDPR, and consent is only one of them. I think most of the others outweigh any request for deletion by the data subject.
      - dmitriid 4y ago
        Come on, GDPR does bot supersede other laws. E.g. if some law requires a company to retain certain data for longer periods than stated in GDPR, that law still applies.

Does that mean I can send people requests to delete my contact info from their phone and they're legally required to comply?

geofft 4y ago
From GDPR article 2: > 2. This Regulation does not apply to the processing of personal data: > (c) by a natural person in the course of a purely personal or household activity My sense (I am neither a lawyer nor European so this is certainly not European legal advice) is that you cannot use GDPR to compel someone to delete your contact info if they're solely a social acquaintance, but you can use it to compel them to delete it if they're a one-person business of some sort (contractor, Etsy seller, lawyer, etc.).
- nolok 4y ago
  Exactly, your baby sitter, your employer, your lawyer, the plumber you called two months ago ... Are covered. The person you traded phone at the bar last week, your neighbor or your coworker from last job are not.
makeitdouble 4y ago
If they operate a service for you, yes. For instance the baby sitter you hire now and then probably keeps track of the contacts of their potential clients, and you could request deletion of your data if you don’t intend to work with them for a few years.
dumbfounder 4y ago
And does this mean I can do this to the collection agent trying to get me to pay 4x for a parking ticket I got in Italy 5 years ago?
- lambertsimnel 4y ago
  IANAL. Although I imagine you could, presumably they'd argue that (while your parking tickets are unpaid) they have a legal basis other than consent for processing your personal data. In that case, you'd probably have to find grounds for erasure other than withdrawal of consent. 1d or 1e of Article 17 look most relevant (but maybe not very promising): https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
  - dumbfounder 4y ago
    So Italy issued the ticket, gets my contact info from the rental company, then hands it over to the collection agency. Is it reasonable that all of that is something I agreed to beforehand? I have no idea. If you rent a car in the EU should you immediately send them a GDPR request after you are done to get them to remove your data so you can't be found? Or is there a legal requirement for them to hold on to the data? Are my rights different because I do not reside in the EU?
    - lambertsimnel 4y ago
      I assume (but I don't know) that GDPR applies fully if any party is in/from the EU. (In practice, if the data processor is outside the EU, enforcement might be difficult, but in your case it sounds like the data processor is inside the EU, so I imagine you have the same rights in this case as those who do reside in the EU.) However, my understanding is that 1) if your data is processed for contractual purposes, the data processor has a right not to delete it on request 2) if your data is processed for law enforcement purposes, the data processor has a duty not to delete it on request There are several legal grounds for processing personal data under GDPR, and consent is only one of them. I think most of the others outweigh any request for deletion by the data subject.
    - dmitriid 4y ago
      Come on, GDPR does bot supersede other laws. E.g. if some law requires a company to retain certain data for longer periods than stated in GDPR, that law still applies.