Article
What is GDPR, the EU's new data protection law?
gdpr.eu
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Article 6 lists the instances in which it’s legal to process person data. Don’t even think about touching somebody’s personal data — don’t collect it, don’t store it, don’t sell it to advertisers — unless you can justify it with one of the following: “The data subject gave you specific, unambiguous consent to process the data. (e.g. They’ve opted in to your marketing email list.)” Processing is necessary to execute or to prepare to enter into a contract to which the data subject is a party. (e.g. You need to do a background check before leasing property to a prospective tenant.)
Consent “There are strict new rules about what constitutes consent from a data subject to process their information.” Consent must be “freely given, specific, informed and unambiguous.”
Children under 13 can only give consent with permission from their parent. “You need to keep documentary evidence of consent.” Data Protection Officers