Blog on datarequests.org

Is tracking data linked with cookie and fingerprinting IDs personal data under the GDPR?

Fri, 24 Nov 2023 10:30:30 +0200

Tracking is ubiquitous on the web: companies follow users across websites, collecting vast amounts of data to profile their behavior and target them with personalized ads. For these practices, which can have serious dangers and negative consequences for users, trackers typically don’t know users’ real names, instead only assigning them unique identifiers. But are these IDs personal data under GDPR? We’ve explored this question by reviewing relevant sources, including EU case law, legal commentary, and recommendations and decisions from data protection authorities. While there is still debate as to whether IDs on their own constitute personal data, in the larger context of online tracking, there is a strong consensus that such data processing falls within the scope of the GDPR and poses significant risks to the fundamental rights and freedoms of natural persons.

datarequests.org v2: Refreshed interface and complaint generator

Wed, 07 Dec 2022 17:00:00 +0200

In an old Christian tradition, German children get presents and candy in their shoes on the morning of the 6th of December. Yesterday, we put something else into your shoes: The new release of our websites with many great new features! We spent a lot of time in the last few months to update the user interface and took great care to make it as easy and accessible as possible to send requests to companies and other data controllers. Thanks to the Prototype Fund run by the Open Knowledge Foundation Germany and funded by the German Federal Ministry of Education and Research, who gave a grant to Lorenz and Benni, we were able to put more time than usual into this release (read more in our transparency information). Now we are just really excited and proud to present you all the new features. If you want to take a look at the code, you can find all changes on GitHub.

Worrying confessions: A look at data safety labels on Android

Sun, 18 Sep 2022 10:17:13 +0200

The Google Play Store recently introduced a data safety section in order to give users accessible insights into apps’ data collection practices. We analyzed the labels of 43,927 popular apps. Almost one third of the apps with a label claims not to collect any data. But we also saw often downloaded apps, including apps meant for children, admitting to collecting and sharing highly sensitive data like the user’s sexual orientation or health information for tracking and advertising purposes. To verify the declarations, we recorded the network traffic of 500 apps, finding more than one quarter of them transmitting tracking data not declared in their data safety label.

Hacktoberfest 2021: Hack with us!

Wed, 29 Sep 2021 18:51:03 +0200

~~Party time!~~ October and therefore the Hacktoberfest are back! We are participating again and are looking forward to your contributions. Just like in previous years, we are happy to give away some goodies as well.

Just like the original Hacktoberfest from DigitalOcean, we want to get people excited about Open Source software and contributing to it. That means for you: Contribute to datarequests.org or one of our websites in another language, and we’ll give you some goodies: The first 100 people get a useful webcam cover and a sticker pack. The ten best contributions will receive a t-shirt as well! All that is completely free for you, we will even pay for postage.

More than just coupon codes: Browser extension Honey also collects their user’s history data

Mon, 02 Nov 2020 14:34:13 +0200

The free browser extension “Honey” wants to save their users money by automatically finding and applying coupon codes. They describe themselves as advocates for data protection and allegedly only collect history data on online shopping websites. Two of our members who have used Honey in the past, have asked for access to the data saved on them using the GDPR. Our analysis of the responses shows that Honey collects history data on a large scale, contrary to what their own privacy policy says. Thus, we have submitted complaints with the data protection authorities.

We are also participating in the Hacktoberfest 2020

Wed, 30 Sep 2020 11:55:42 +0200

It’s that time again: The Hacktoberfest 2020 is coming up, as always hosted by the hosting provider DigitalOcean. The aim is to get people excited about working on open source software as usual. The Hacktoberfest invites you to submit pull requests to open source projects during October 2020. Those who submit four or more pull requests will receive a t-shirt from DigitalOcean as a gift or can plant a tree.

It has almost become a tradition for other companies to participate in addition to this official event and to offer their own rewards for contributions to their respective open source projects.
After the great success of our participation last year, we are pleased to announce that we will again participate in the Hacktoberfest this year. datarequests.org loves open source and the people who contribute to the project are very important to us. That’s why we will reward contributions to the project that are submitted during October 2020 as a pull request via GitHub or as a patch via email. Find out more in this post.

Territorial scope of the GDPR

Tue, 04 Aug 2020 12:37:15 +0200

Who is entitled to assert the GDPR’s data subject rights? Against whom? This article provides a brief overview of the territorial scope of the GDPR.

The General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) is a European law that came into force in 2016. The GDPR is a regulation and as such applies generally and directly to all EU member states (pursuant to Article 288 (2) TFEU). In contrast to directives, the GDPR has effects on all member states without the need for implementation into national law. It has been applicable to all EU member states since May 25, 2018.

Sample letter for objections against direct marketing as per Art. 21(2) GDPR

Thu, 24 Oct 2019 18:47:21 +0200

Advertising seems ubiquitous today: As soon as you open your mailbox or email inbox, you are usually greeted by a series of letters and emails from companies wanting to promote their products. Often, they are personally addressed to you.

As the legal basis, these companies frequently rely on their “legitimate interest” or your consent—usually buried deep in a contract on a completely different subject.

Fortunately, you don’t have to put up with that. According to the General Data Protection Regulation (GDPR), you have the right to object to direct marketing. This is clearly stated in Art. 21(2) GDPR. You may also rise this objection if you have previously given consent for direct marketing.

We are participating in the Hacktoberfest 2019!

Fri, 04 Oct 2019 11:46:02 +0200

The hosting provider DigitalOcean is once again hosting the Hacktoberfest to celebrate open source. The Hacktoberfest invites you to submit pull requests to open source projects. People who submit four or more pull requests, get a free t-shirt from DigitalOcean.

In addition to this official event, every year many other companies and organizations also use the opportunity to participate in the Hacktoberfest and offer additional rewards for certain contributions.
Over here at datarequests.org, we love open source. Our project has been designed from the ground up to be as open as possible. We are thus very happy to announce that we are participating in the Hacktoberfest this year! We will reward contributions to our project that are made during October 2019 as a pull request through GitHub with an exclusive sticker pack.

GDPR cheat sheet — an explanation of the important terms and concepts

Sat, 16 Feb 2019 16:44:39 +0200

At first glance, the GDPR can appear confusing like any other legal topic. It introduces numerous legal terms that are vital for understanding the regulations.

What is a data controller and how is that different from a data processor? And of the two, which should I look for if I want to assert my rights towards a company?

In this article, we explain the most important terms and concepts relating to the GDPR so that you can stay in control of and exercise your data protection rights. You’ll find that it isn’t that difficult to understand once you know some of the terms.

Supervisory data protection authorities

Thu, 07 Feb 2019 16:58:19 +0200

The supervisory data protection authorities are an important institution for data protection. As independent bodies, their task is to ensure compliance with data protection laws, in particular the GDPR.

A number of powers are conferred on them for this purpose. Firstly, the supervisory authorities have control powers which enable them to check whether a controller complies with applicable data protection law. They can, for example, request the list of processing activities and other information they need for their tasks and even have access to the premises of the company (see Art. 58(1) GDPR).
If the authority determines a misconduct of the controller, it will first instruct them to cease said activity and to adhere to the law. Depending on the seriousness of the offense, it can also impose fines if necessary.

Sample letter for erasure requests as per Art. 17 GDPR (“right to be forgotten”)

Wed, 16 May 2018 22:06:12 +0200

If the personal data that companies or other organisations (so-called controllers) have stored on you is no longer necessary for its original purpose, you have a “right to be forgotten” according to the General Data Protection Regulation. This means that you can ask the controller to delete said data.

If the controller has forwarded your data to other companies, they also have to inform them about your request for deletion.

Sample letter for rectification requests as per Art. 16 GDPR

Wed, 16 May 2018 22:06:12 +0200

If a company or other organization (a so-called controller) has stored false (or incomplete) personal data on you, then under the General Data Protection Regulation (GDPR) you have a right to demand immediate correction of said incorrect data.

This allows you to defend yourself against credit agencies (such as Experian or Equifax), for example, if they rate your creditworthiness or your payment history negatively due to incorrect entries.

If you want to learn more, have a look at our article about your rights under the GDPR.

Sample letter for requests for access to personal data as per Art. 15 GDPR

Wed, 16 May 2018 22:06:12 +0200

According to the GDPR, you have a right to access the personal data stored and processed on you by companies and other organisations (so-called controllers).

First of all, this includes a confirmation as to whether your personal data is being processed. If so, you can request a copy of said data. But not only that: In addition, you also have the right to further details, such as the purposes of the processing, the recipients to whom the data is passed on and the duration of the storage.

Your rights under the General Data Protection Regulation (GDPR)

Mon, 07 May 2018 08:22:36 +0200

In our increasingly digital world, data protection plays a more important role every day. With the new General Data Protection Regulation (GDPR), the European Union significantly strengthens your rights with regard to the careful handling of your personal data.

In this article, we want to give you a detailed overview of the rights you have thanks to the GDPR. If you are looking for a short summary instead, have a look at this article.

A quick overview of datarequests.org

Fri, 23 Mar 2018 03:25:12 +0200

Every company in the EU is required by law to grant access to your personal data, the ability to have it corrected or even deleted and more. Here at datarequests.org, we want to help you exercise these rights.

What are my rights?

With the introduction of the General Data Protection Regulation (GDPR), data protection law was harmonised throughout the EU. Since then, every company in the EU (or even outside the EU if they offer their services to EU citizens) has to grant you the following rights (among others):

Blog on datarequests.org

Is tracking data linked with cookie and fingerprinting IDs personal data under the GDPR?

datarequests.org v2: Refreshed interface and complaint generator

Worrying confessions: A look at data safety labels on Android

Hacktoberfest 2021: Hack with us!

More than just coupon codes: Browser extension Honey also collects their user’s history data

We are also participating in the Hacktoberfest 2020

Territorial scope of the GDPR

What is the GDPR?

Sample letter for objections against direct marketing as per Art. 21(2) GDPR

We are participating in the Hacktoberfest 2019!

GDPR cheat sheet — an explanation of the important terms and concepts

Supervisory data protection authorities

Sample letter for erasure requests as per Art. 17 GDPR (“right to be forgotten”)

Sample letter for rectification requests as per Art. 16 GDPR

Sample letter for requests for access to personal data as per Art. 15 GDPR

Your rights under the General Data Protection Regulation (GDPR)

A quick overview of datarequests.org

What are my rights?