Item talk:Q5103 - Revision history

Podehaye at 13:18, 13 February 2021

2021-02-13T13:18:10Z

Podehaye at 13:16, 13 February 2021

2021-02-13T13:16:48Z

Podehaye at 13:16, 13 February 2021

2021-02-13T13:16:29Z

Podehaye at 13:14, 13 February 2021

2021-02-13T13:14:14Z

Podehaye at 13:08, 13 February 2021

2021-02-13T13:08:28Z

Podehaye at 13:04, 13 February 2021

2021-02-13T13:04:59Z

Podehaye at 13:03, 13 February 2021

2021-02-13T13:03:54Z

Podehaye at 13:02, 13 February 2021

2021-02-13T13:02:09Z

Podehaye at 13:00, 13 February 2021

2021-02-13T13:00:41Z

Podehaye at 12:53, 13 February 2021

2021-02-13T12:53:42Z

@@ Line 42: / Line 42: @@
 For all personal data not falling within portability, I would like to request, under the right to access (GDPR, art 15):
 -   **a copy sent to me in electronic format**. This includes - but is not limited to - any data derived about me, such as opinions, inferences, settings and preferences. (Note that opinions, inferences and the like are considered personal data. See Case C‑434/16 *Peter Nowak v Data Protection Commissioner* [2017] ECLI:EU:C:2017:994, 34.)  For data that is available to the controller in machine readable format, it must be provided to me in that form in accordance with the principle of fairness and provision of data protection by design.
 Article 26

@@ Line 5: / Line 5: @@
 This page aims to help you find out more information about how this is happening, and who might be helping Clubhouse in doing so. The idea is that the GDPR also gives you some rights to transparency, which the template below will help you exercise to their maximum.
-If you would like to discuss this further, you are welcome to email [http://mailto:clubhouse@personaldata.io clubhouse@personaldata.io] or to [https://forum.personaldata.io/t/gdpr-breach-by-clubhouse/458 contribute to the thread in our forum].
+If you would like to discuss this further, you are welcome to email [mailto:clubhouse@personaldata.io clubhouse@personaldata.io] or to [https://forum.personaldata.io/t/gdpr-breach-by-clubhouse/458 contribute to the thread in our forum].
 {{MailtoDual|mailto:support@alphaexplorationco.com|GDPR request to Clubhouse|Dear Clubhouse,

@@ Line 5: / Line 5: @@
 This page aims to help you find out more information about how this is happening, and who might be helping Clubhouse in doing so. The idea is that the GDPR also gives you some rights to transparency, which the template below will help you exercise to their maximum.
-If you would like to discuss this further, you are welcome to email clubhouse@personaldata.io or to contribute to the thread in our forum.
+If you would like to discuss this further, you are welcome to email [http://mailto:clubhouse@personaldata.io clubhouse@personaldata.io] or to [https://forum.personaldata.io/t/gdpr-breach-by-clubhouse/458 contribute to the thread in our forum].
 {{MailtoDual|mailto:support@alphaexplorationco.com|GDPR request to Clubhouse|Dear Clubhouse,

← Older revision		Revision as of 13:14, 13 February 2021
Line 1:		Line 1:
	__NOTOC__		__NOTOC__
		+	== What is this? ==
		+	The General Data Protection Regulation gives you rights. The app Clubhouse is actively breaching your rights, and [https://www.linkedin.com/pulse/clubhouse-next-privacy-nightmare-youve-never-heard-alexander-hanff/ encouraging your friends to do so as well]!
		+
		+	This page aims to help you find out more information about how this is happening, and who might be helping Clubhouse in doing so. The idea is that the GDPR also gives you some rights to transparency, which the template below will help you exercise to their maximum.
		+
		+	If you would like to discuss this further, you are welcome to email clubhouse@personaldata.io or to contribute to the thread in our forum.
		+
	{{MailtoDual\|mailto:support@alphaexplorationco.com\|GDPR request to Clubhouse\|Dear Clubhouse,		{{MailtoDual\|mailto:support@alphaexplorationco.com\|GDPR request to Clubhouse\|Dear Clubhouse,

← Older revision		Revision as of 13:08, 13 February 2021
Line 1:		Line 1:
		+	__NOTOC__
	{{MailtoDual\|mailto:support@alphaexplorationco.com\|GDPR request to Clubhouse\|Dear Clubhouse,		{{MailtoDual\|mailto:support@alphaexplorationco.com\|GDPR request to Clubhouse\|Dear Clubhouse,

@@ Line 9: / Line 9: @@
 It is natural that you will need to identify me and make sure I am who I claim to be. I understand that according to Article 11 GDPR, and particularly Art 11.2, you might thus need additional information. The following information should help you locate my personal data:
-- e-mail address: << ADD VALUE >>;
+* e-mail address: << ADD VALUE >>;
-- telephone number: << ADD VALUE >>.
+* telephone number: << ADD VALUE >>.
 You should be able to verify easily by email address simply by responding to my email.

@@ Line 77: / Line 77: @@
 ==== Submission Form ====
-**Please note that it is not legal to require data subjects to use an  in-house form**. (see for instance UK Information Commissioner’s Office, ‘Subject Access Code of Practice’ (9 June 2017) p 13; Information Commissioner’s Office, ‘Guide to the GDPR: Right to access’ (22 May 2019), stating that 'even if you have a form, you should note that a subject access request is valid if it is submitted by any means, so you will still need to comply with any requests you receive in a letter, a standard email or verbally [..] although you may invite individuals to use a form, you must make it clear that it is not compulsory')
+Please note that it is not legal to require data subjects to use an  in-house form. (see for instance UK Information Commissioner’s Office, ‘Subject Access Code of Practice’ (9 June 2017) p 13; Information Commissioner’s Office, ‘Guide to the GDPR: Right to access’ (22 May 2019), stating that 'even if you have a form, you should note that a subject access request is valid if it is submitted by any means, so you will still need to comply with any requests you receive in a letter, a standard email or verbally [..] although you may invite individuals to use a form, you must make it clear that it is not compulsory')
 ==== Further assistance ====

@@ Line 5: / Line 5: @@
 Due to specific growth hacking mechanisms you employ, it similarly concerns some of your users, who might already be in breach of GDPR.
-Identification
+==== Identification ====
-==============
 It is natural that you will need to identify me and make sure I am who I claim to be. I understand that according to Article 11 GDPR, and particularly Art 11.2, you might thus need additional information. The following information should help you locate my personal data:
@@ Line 16: / Line 16: @@
 I would encourage you to verify the telephone number by simply calling me.
-Copies of my personal data
+==== Copies of my personal data ====
 I would like to request a copy of all my personal data held and/or undergoing processing. This is both a subject access request and a portability request. This request is directly addressed to you, and concerns data you hold directly but also joint controllership data (GDPR Art 26), jointly held with other data controllers. Some of those other controllers would also include some of your users (particularly those who have already breached GDPR and are located in Belgium, in light of the Twoo decision).
@@ Line 23: / Line 22: @@
 Article 20
-----------
 For data falling within the right to data portability (GDPR, art 20), which includes all data I have provided *and* which have been indirectly observed about me (Article 29 Working Party, *Guidelines on the Right to Data Portability (WP 242)*, 13 December 2016, 8) and where lawful bases for processing include consent or contract, I wish to have that data:
@@ Line 33: / Line 32: @@
 Article 15
-----------
 For all personal data not falling within portability, I would like to request, under the right to access (GDPR, art 15):
@@ Line 40: / Line 39: @@
 Article 26
-----------
 Given the nature of the growth hacking you engage in, I fully expect the referral mechanisms you employ not to fall within the household exemption in the GDPR. This interpretation is confirmed by the recent Twoo decision of the Belgian Data Protection Authority:
 https://iapp.org/news/a/tell-a-friend-but-only-with-your-friends-consent/
@@ Line 47: / Line 46: @@
-Metadata on processing
+==== Metadata on processing ====
-======================
 This request also includes the metadata I am entitled to under the GDPR.
 Information on controllers, processors, source and transfers
 - The **identity of all joint controllers** of my personal data, as well as the essence of you contracts with them (Article 26).
 - Any **third parties to whom data has been disclosed**, named with contact details in accordance with Article 15(1)(c). Please note that the European data protection regulators have stated that by default, controllers should name precise recipients and not "categories" of recipients. If they do choose to name categories, they must justify why this is fair, and be specific, naming "the type of recipient (i.e. by reference to the activities it carries out), the industry, sector and sub-sector and the location of the recipients. ( Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ WP260 rev.01, 11 April 2018 ) Please note that in the case of any transferred data processed on the basis of consent, there is no option to just name categories of recipients without invalidating that legal basis (Article 29 Working Party, ‘Guidelines on Consent under Regulation 2016/679’ (WP259 rev.01, 10 April 2018) 13).
@@ Line 64: / Line 61: @@
 Information on purposes and legal basis
 - All **processing purposes and the lawful basis for those purposes by category of personal data**. This list must be broken down by purpose, lawful basis aligned to purposes, and categories of data concerned aligned to purposes and lawful bases. Separate lists where these three factors do not correspond are not acceptable (Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ (WP260 rev.01, 11 April 2018), page 35.
@@ Line 71: / Line 67: @@
 - The **specified legitimate interest** where legitimate interest is relied upon (Article 14(2)(b)).
-Information on automated decision-making ----------------------------------------
+Information on automated decision-making
 - Please confirm whether or not you make any automated decisions (within the meaning of Article 22, GDPR). If the answer is yes, please provide meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for me. (Article 15(1)(h))
 Information on storage
-----------------------
 - Please confirm for how long each category of personal data is stored, or the criteria used to make this decision, in accordance with the storage limitation principle and Article 15(1)(d).
-Submission Form
+==== Submission Form ====
-===============
 **Please note that it is not legal to require data subjects to use an  in-house form**. (see for instance UK Information Commissioner’s Office, ‘Subject Access Code of Practice’ (9 June 2017) p 13; Information Commissioner’s Office, ‘Guide to the GDPR: Right to access’ (22 May 2019), stating that 'even if you have a form, you should note that a subject access request is valid if it is submitted by any means, so you will still need to comply with any requests you receive in a letter, a standard email or verbally [..] although you may invite individuals to use a form, you must make it clear that it is not compulsory')
-Further assistance
+==== Further assistance ====
-==================
 If you do not normally deal with these requests, please pass this email to your Data Protection Officer. If you need advice on dealing with this request, any European Data Protection Authority should be able to provide you with assistance.
 In accordance with the law, I look forward to hearing from you within one month of receipt.

← Older revision		Revision as of 12:53, 13 February 2021
Line 1:		Line 1:
−	{{~~MailtoDuo~~\|mailto:support@alphaexplorationco.com\|GDPR request\|Dear Clubhouse,	+	{{MailtoDual\|mailto:support@alphaexplorationco.com\|GDPR request\|Dear Clubhouse,

	This is a transparency request under the General Data Protection Regulation, including a subject access request, a portability request, and other specific provisions.		This is a transparency request under the General Data Protection Regulation, including a subject access request, a portability request, and other specific provisions.