Re: [93attendees] Network experiment during the meeting

["McDonald, Alex" <[e-mail]>]

http://www.cnpd.public.lu/fr/publications/groupe-art29/wp217_en.pdf

Opinion on the notion of legitimate interests of the data controller etc

Example 24: Information website for teenagers

An NGO website offering advice to teenagers regarding issues such as drug abuse, unwanted pregnancy and alcohol abuse collects data via its own server about visitors to the site. It then immediately anonymises these data and turns them into general statistics about which parts of the  website  are  most  popular  among  visitors  coming  from  different  geographical  regions  of the country.
Article 7(f) could be used as a legal ground even if data concerning vulnerable individuals are concerned,  because  the  processing  is  in  the  public  interest  and  strict  safeguards  are  put  in place  (the  data  are  immediately  rendered  anonymous  and  only  used  for  the  creation  of statistics), which helps tipping the balance in favour of the controller.

So the answer is perhaps yes, if caveats re anonymization and use are adhered to.

(As a general note, I didn't raise this with the intent of having "I am not a lawyer but..." discussions. It's just that this stuff has a tendency to bite hard when it does bite. The EU doesn't mess around, especially in light of recent events around Snowden and the leak of US clearance information, and with bodies or companies it thinks should know better.)

Alex McDonald
Standards & Industry Associations Group
CTO Office
NetApp
[phone] Mobile Phone
[e-mail]
twitter: @alextangent
Follow us: 


> -----Original Message-----
> From: Randall Gellens [mailto:[e-mail]]
> Sent: 15 July 2015 20:35
> To: McDonald, Alex; Rolf Winter; [e-mail]
> Subject: Re: [93attendees] Network experiment during the meeting
> 
> At 3:33 PM +0000 7/14/15, Alex McDonald wrote:
> 
> >      if processing is necessary to perform tasks of public interests
> > or tasks carried out by government, tax authorities, the police or
> > other public bodies; or
> >      if the data controller or a third party has a legitimate interest
> > in doing so, as long as this interest does not affect the interests of
> > the data subject, or infringe on his or her fundamental rights, in
> > particular the right to privacy. This provision establishes the need
> > to strike a reasonable balance between the data controllers' business
> > interests and the privacy of data subjects.
> >  <<----
> >
> >  The last clause is the only clause under which you can collect and
> > process this data.
> 
> 
> What about the "public interest" clause?
> 
> --
> Randall Gellens
> Opinions are personal;    facts are suspect;    I speak for myself only
> -------------- Randomly selected tag: --------------- To iterate is human; to
> recurse, divine.  --Robert Heller