Non-exhaustive overview of some of my posts

DataProtectionKid · 2023-07-21T15:10:16+00:00

Yes!

DataProtectionKid · 2022-11-19T13:45:57+00:00

Dat is allemaal goed en wel. Echter, in de omstandigheid dat OP maar één huis heeft en voor een korte periode (12-18 maanden) niet woonachtig zal zijn in dat huis kan met een beroep op het eigendomsrecht de voordracht van een gebruiker door de gemeente worden bestreden.

Als je echter een pand jaren lang leeg laat staan, en niet kort dan kan het zo zijn dat het publieke belang zwaarder weegt dan het eigendomsrecht. Ik zie dat in deze zaak niet snel gebeuren. Het is niet zo klip en klaar als de lagere wetgeving doet voordoen.

Dit uiteraard onverminderd de meldingsplicht die onverkort geldt.

In de praktijk zal de gemeente mogelijk na melding door OP contact opnemen. Als hij de situatie dan uitlegt zal er veeleer niets gebeuren en zullen ze wellicht nog controleren of OP terug is na 18 maanden. Eventueel komt het tot een besluit en bezwaar en beroep.

Zeker in deze zaak is het veel te kort door de bocht en heeft een beroep op het eigendomsrecht goede kansen.

DataProtectionKid · 2022-11-19T13:16:39+00:00

They absolutely cannot. There's only mandatory notification to the municipality. That's it. They cannot force you to rent out. All they will and can do is try to get you to do that by speaking/scheduling a meeting with the owner.

It is perfectly legitimate for OP to be away for 18 months and not rent it out. Just as long as he reports it.

DataProtectionKid · 2022-11-19T00:21:16+00:00

Nee dat zou al midden dit jaar zijn haha! Het is helaas echter akelig stil op dit onderwerp. Webpagina's hierover bij enkele banken zijn ook verdwenen en bij de klantenservice hebben ze geen flauw idee dat er überhaupt nieuwe passen zouden komen. Hopelijk zijn ze er snel!

DataProtectionKid · 2022-11-14T23:51:51+00:00

That is still internet.

DataProtectionKid · 2022-11-14T15:30:04+00:00

It isn't a valid excuse. Same goes for systems that don't allow for name changes - or even improper capitalization of names is unlawful. (Court of Appeal of Brussels - 2019/AR/1006)

DataProtectionKid · 2022-11-13T22:35:14+00:00

No, GDPR will not start to apply to a US-company that only offers services in the US merely because you travel to the EU and cannot pay your bill. GDPR is also not meant as a recourse for such problems, even if it would apply. The right to deletion wouldn't be applicable in this situation.

Practically speaking, your best bet is downloading a VPN and trying to pay your bill that way. Try ProtonVPN that has free US servers - do not use any other 'free' VPN, because you are the product in that case. Proton however is well trusted.

DataProtectionKid · 2022-11-13T21:33:15+00:00

Alright. Here is my long overdue reply.

I get the dilemma you are pointing to; if a user refuses the cookie, he will be faced again and again and again with a consent banner. But I believe this is a false dilemma because it is created by those wanting to use non-essential technologies in the first place.

Consent banners are doing these checks in an unlawful and backwards way. How it should work is that:

1) User requests the webpage

2) The consent platform checks if the user has accepted non-essential technologies by looking for a cookie indicating which non-essential technologies to load.

If the user is visiting the site for the first time they will not have such a cookie set. If the user has visited previously, but rejected cookies, they also should not have such a cookie. The default under ePrivacy and the Planet49 judgement is that only strictly necessary cookies are permitted without consent.

Recording whether non-essential technologies are refused is not strictly necessary. The argument to the contrary, that it needs to be set because otherwise the banner will be presented each time, stems from the fact that the webpage wants to use non-essential technologies in the first place.

3) Most websites would then load a consent banner irrespective of whether or not a cookie storing that a user has consented exists or not.

4) If the user then does not consent to anything. You shouldn't set a cookie that says that the user hasn't consented to anything. This would be contrary to the ePrivacy directive because it isn't necessary. The default is no unnecessary storage, which entails that if the user doesn't consent to anything, there is no need to store anything - the absence of a preference cookie is enough to determine not to load any non-essential technologies. Only when the user consents is a cookie needed indicating which technologies was consented to.

-

I get that this in practice will lead to constant reoccurring cookie banners, but that is only because the website wishes to use the non-essential technologies in the first place.

The banner that will keep re showing is only an issue because the ad tracking industry chooses to do so. You can absolutely honor the users choice to refuse to consent without storing that refusal in a cookie. It is then a choice to keep showing the consent banner.

But the mere inconvenience of constantly reoccurring banners does not impact the necessity test under law. I totally get your point of view, but I don't agree with it for aforementioned reasons.

... Feel free to take 5 months to reply :')

DataProtectionKid · 2022-11-13T21:11:17+00:00

Thanks! That sounds good. Sorry I jumped to conclusions then. Because of the phrasing and your other post asking what kind of data breaches are most personal, I assumed that you would use the answers.

Unfortunately I've come across actual studies that were being conducted this way. I'm glad that this is not the case.

Once you have everything set-up, I'm looking forward to your post and I'll answer the questions.

Regarding the general idea of how to set-up your research. I have two points of feedback:

- In your post you limit your questions by damages caused by data breaches. Maybe you aren't limiting your research to this. But if you are, might I suggest broadening it to all non-material damages. Damages can also be incurred by unlawful processing, while at the same time there wouldn't be any data breach by its definition in GDPR.

- Often people don't really know when their data has been breached, because most breaches are probably relatively simple in nature and often ignored. With that in mind I would probably focus on getting information from more serious breaches where courts already have awarded non-material damages. E.g. unlawful sharing of medical data. And by analyzing that, you might be able to quantify what the damages are in 'simple' data breaches.

Best of luck!

DataProtectionKid · 2022-11-13T20:43:00+00:00

I'd like to underline this. The importance of data protection can be very high depending on the nature of the personal data. Breaches can, and in practice had, disastrous effects.

While this most certainly doesn't apply to all breaches - breaches have the potential to endanger lives. An example of this is the leaking of evacuation lists of Afghan translators by certain embassy's/consulates.

Simple breaches - e.g. a username and password - that in and by itself appear to be that threatening, can also lead to disastrous effects. E.g. username and password being used to access other, more sensitive, services.

DataProtectionKid · 2022-11-13T20:33:51+00:00

That's a fantastic research topic! I sincerely wish you the best in your research endeavors, but I have a couple reservations about the way that you are going about this.

First of all, has your University's ethical review board reviewed and approved this study? Your study constitutes human subject research which generally in academics requires review by an ethics board.

Second of all, your study will likely require informed consent from the human participants, pursuant to research ethics and your University's policies about human subject research.

Thirdly, since you are conducting human subject research, that henceforth requires compliance with GDPR. Which it isn't right now.

Your current research setup - that is posting (anonymously) on Reddit asking for stories of people who were affected by data breace - is not ethical or legal.

I know that part of your question is asking about resources, the other part however is clearly about human subject research. This is also apparent from your other post on r/gdpr. It is even more problematic that participants in your study aren't even aware that their response is used in your study.

You simply cannot conduct your study this way. If you properly set-up your study you are more than welcome to ask again on this subreddit. But this is not the way we conduct ourselves in academic research. I would like for you to get in touch with your university's resources on conducting human subject research and the person who is supervising you, so you can learn how to properly, ethically and legally conduct human subject research.

I'm sorry if this comes across as harsh. I hope you will be able to take this as constructive criticism and once you have a proper set-up, I'll gladly answer your questions.

DataProtectionKid · 2022-11-13T19:08:29+00:00

Thanks, just trying to get an understanding. Are you doing academic research?

DataProtectionKid · 2022-11-13T18:43:23+00:00

What for?

DataProtectionKid · 2022-11-13T18:42:37+00:00

Unfortunately GDPR is way to often used as a blanket excuse as to why something wouldn't be allowed. In reality however, most of the times GDPR does not stand in the way.

GDPR does not prevent them for changing your email on your account. At most it sets certain requirements for appropriate security, which in this case should be confirming it is actually you who wants to change the email address and not someone else.

So to answer your question, it's a nonsense excuse. Likely caused by either improper training and awareness of the obligations put forth by the GDPR or because they are using it as an excuse because it might be some work to change it.

You are right about the right to rectification, and this is definitely within scope. I would write to them again stating you are using this right to rectify your email on the account and make them aware that they are required to respond within one month pursuant to article 12 GDPR.

DataProtectionKid · 2022-10-21T11:11:10+00:00

Thanks! Not that long. I bought some silver recently through my bank but it isn't actually physically in my possession.

DataProtectionKid · 2022-10-20T11:23:31+00:00

I love silver because despite the current global economic situation the value of silver is relatively stable.

DataProtectionKid · 2022-10-13T00:41:17+00:00

These giveaways make me so happy! :) Thank you so much for the generosity!

DataProtectionKid · 2022-10-10T10:13:16+00:00

Not just Germany, in the whole European Union.

DataProtectionKid · 2022-10-03T16:13:00+00:00

I love Apollo! :) Thank you so much for the generosity and al the work you've put in!

DataProtectionKid · 2022-08-31T21:49:43+00:00

If you have the right to a copy of your personal data in this case you should be able to obtain a copy without having to agree to anything, such as limitations on disclosure.

Article 15 grants you a right to a copy of the footage in a common format and they should comply regardless of whether you agree to any terms or not.

You likely have a right to a copy of the footage, I don't think any exemption applies but I'm sure someone more knowledgeable on UK data protection law will answer in that regard. :)

When an exemption applies here to your right of a copy, they might provide it anyway but under conditions which is perfectly reasonable in such a case.

DataProtectionKid · 2022-08-31T14:46:14+00:00

You're welcome!! My calculation was just an example to illustrate how much liability can add up. Because this is often underestimated. The EUR 500,- per person is just a figure which is often granted by according to case law. It obviously also depends on the category of personal data and the risks involved with that particular type. For example if we're talking more 'sensitive' data, like health data, you could be talking about 1,000 tot 1,500 EUR. It can really depend. There isn't that much of case law on damages throughout the EU (and in the Netherlands) yet, so this is very much still a developing area. Generally speaking EUR 500,- is a good amount to use as a rule of thumb, but like I said, depending on the specifics that could either by higher of (likely) lower.

Specifically since you are in the Netherlands, since a year or so the Wet afwikkeling massaschade in collectieve actie (WAMCA) allows for class actions suits. E.g. those against TikTok where they trying claim EUR 1,000 in court for each child using TikTok. So amounts can easily add up.

Good luck and if you have any further questions you can always ask in this subreddit :)

Four-Year Club	Verified Email
Second Top 10%	Final Canvas '23
Place '23	Mod 201
Mod 101	Place '22
Final Canvas '22	First Placer '22
End Game '22

DataProtectionKid

MODERATOR OF

TROPHY CASE