donogh

No argument on either point. We have to be practical, though, and the law is usually forgiving of such practicalities.

You're right, though: strictly speaking, it's not compliant.

That's the right to data portability, which is your right to have your data with an electronic service transferred to another service in a machine readable format.

It has nothing to do with data subject access requests, which is encoded in Article 15: https://gdpr-info.eu/art-15-gdpr/

"Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form."

That does not mean machine readable.

It does not have to be machine readable. GDPR is technologically neutral. If the medium of storage is paper, a data subject access request can be fulfilled on paper. For example, photocopy the page, redact the other names, and mail the copy to the data subject.

If the data subject access request is sent by email, you can take it a step further and scan and email that page. Still, it does not have to be machine readable.

I would say that you could provide a notice specifying that signing the guestbook also constitutes consent to the public display of the person's name.

If you want to take it further, you could ask them to submit a small form confirming their consent.

Worst case, you redact their name -- use a marker! -- and document that process as part of your data review.

Either way, it's complete overkill. It's not about following the letter of the law; it's about the spirit of the law. No one is going to get sued or fined for providing a public guest book.

A small shop absolutely does not need a DPO. See guidance here: http://gdprandyou.ie/data-protection-officer/

If the small shop happens to be collecting sensitive personal data -- health data, political affiliations or union membership, etc. -- (a) they should probably stop and (b) they would need a DPO.

Highly unlikely in any case !

As to the DPO, it is meant to be an independent person within the organisation, who cannot be unduly influenced by management, etc. Assigning the role to a regular employee who, e.g., reports to the principal and is a teacher by day, would not seem to satisfy the requirement.

Bear in mind that a DPO has to have "expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39".

A school does not necessarily meet the definition of a public authority [1]; I would say it's not; it depends on individual EU countries to legislate on that definition.

Furthermore, in Ireland, for example, fines cannot be levied against public authorities: https://www.irishtimes.com/news/crime-and-law/public-bodies-...

[1] https://www.lexology.com/library/detail.aspx?g=e71ac55f-566b...

Unfortunately, most organisations need professional guidance on GDPR, and that's not necessarily cheap or accessible to the budget-constrained. A few points on their issues (IANAL):

1. Most organisations do NOT need a Data Protection Officer (DPO). There are a set of criteria for determining if you do. Here is guidance on it from the Irish DPC: http://gdprandyou.ie/data-protection-officer/

If they are processing health data, then technically, yes, you might need one. You can consider outsourcing the DPO role to a privacy consultant; it may be the most sensible option.

2. If your data processors have not put agreements in place, then you are legally obliged to do so yourselves. This can actually be an advantage because you set the terms. Unfortunately, again it's best to seek professional advice, preferably legal advice when it comes to drafting contracts. I would go so far as to ask your solicitor to send a "threatening" letter with the agreement they need to sign.

3. Why does the visitor book need to be publicly visible? Is there a secretary or receptionist who could handle the book? Switching it to an electronic system is not necessarily going to meet the requirement. (GDPR is intentionally technologically neutral by the way -- there is no inherent advantage of one medium over another, so long as you're collecting and using data in a justifiable way, and meeting the other data controller requirements.)

4. Again, regarding display of health data, which is considered sensitive personal data, I would say it depends. GDPR is not a series of absolute dictums. Use of data does have to be explained and documented, and I believe you could seek parental consent for display of that information under certain circumstances. (Presumably to teachers who will be overseeing children?)

5. The vagueness of the legislation is definitely a problem. The GDPR does allow for an official certification[i], which will be a huge improvement (whenever we see it!).

All the scaremongering aside, the reality is that the legislation is still largely untested. We can fully expect to see a series of test cases appear over the coming months, which will provide clarity.

However, it's important to note and realise that no data protection authorities are going to start doling out extreme fines come Friday morning.

Even if an organisation is reported to the authority, there will undoubtedly be opportunities for remediation first and, unless it's a serious data breach, I seriously doubt anyone will receive a significant fine any time soon.

Facebook, on the other hand...

6. When it comes to training and certification, I'd recommend the IAPP: https://iapp.org/

They are one of the thought leaders in the space, and have a solid track record, with affiliations with lots of reputable privacy consultants.

[i] http://www.privacy-regulation.eu/en/article-42-certification...

Really nice idea. What immediately jumps out is there are checkboxes for tasks that don't apply to everyone. For example, most companies won't need a Data Protection Officer (DPO).

Still, the world needs more clarity on GDPR, and this helps.

Strange, still works for me! Here's the actual ruling: http://curia.europa.eu/juris/document/document.jsf?text=&doc...

If this were to come before the CJEU[1], it would not be clear-cut at all. There was a landmark case where home CCTV was ruled inadmissible in a robbery by virtue of the fact that it included footage of a public road, and the thieves did not consent to the use of their personal data[2], i.e., the recording of their images in public using a home CCTV system.

And the definition of personal data extends to any data that can be linked to you. For example, if a server records a log entry with your name and IP, and the server also records log entries with just the IP, all of the log entries are considered personal data, even for dynamic IPs in some instances[3].

There are some exceptions around criminal justice and the protection of persons and property, however, I still wouldn't be surprised if this DNA evidence were ruled inadmissible in the EU.

[1] Court of Justice of the European Union [2] http://curia.europa.eu/juris/document/document.jsf?docid=160... [3] https://www.whitecase.com/publications/alert/court-confirms-...

Not contradicting, worth pointing out for the Americans in the audience: even if you have an exclusively US-based company, working with any EU users means you are in scope for GDPR.

The consequences for violating GDPR are quite severe -- up to 20 million euro, or 4% of global turnover, whichever is greater. Again, this applies to US companies even if it's a single record of EU personal data.

Furthermore, individuals are fully entitled to sue in the event of a data breach, and there is legal precedent in the EU for compensation of between 10-15k euro per person.

As to the question of EU law applying in the US, just look to financial regulation like Sarbanes–Oxley to see it going the other way.

Impressive! Only negative: the "Slides from Recent Talks" section is all broken links.

Amazon doesn't provide a sandbox for any of its sites, making it quite challenging to integrate with Seller Central in any region.

If you're curious about the future of privacy, while flawed in some ways, the GDPR (General Data Protection Regulation) comes into effect in the EU next May. Here's their definition of personal data [1]:

  "Personal data means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller. This can be a very wide definition depending on the circumstances."

And then we have this:

  "Right to change or remove your details

  If you discover that a data controller has details about you that are not factually correct, you can ask them to change or, in some cases, remove these details.

  Similarly, if you feel that the organisation or person does not have a valid reason for holding your personal details or that they have taken these details in an unfair way, you can ask them to change or remove these details.

  In both cases, you can write to the organisation or person, explaining your concerns or outlining which details are incorrect. Within 40 days, the organisation must do as you ask or explain why they will not do so."

It's true that enforcement is difficult -- I imagine it'll be more reactive than proactive. That said, a breach is handled quite well, assuming the law is enforced:

https://www.dataprotection.ie/docs/Data-Security-Breach-Code...

The GDPR is a solid step in the right direction, and a model for a better approach to privacy.

[1] https://www.dataprotection.ie/docs/A-guide-to-your-rights-Pl...

Do you think there'll end up being due process with this approach? And fair trials? I wouldn't be so quick to endorse a dictatorship's approach to law and justice.

In this case, 'elements' seems to refer to the number of sections of the set that are independent -- the stages of the rocket, the lander, the astronauts, etc.

Also, they specifically refer to the "LEGO Ideas" collection; the Taj Mahal was part of the "LEGO Sculptures" collection.

(There have been many other sets from other collections with more pieces than this.)

Speculation: maybe it involves hiding bomb components in multiple passengers' laptops, then combining them in-flight?