Is Santa Claus in contradiction of article 6 of GDPR

sexmag · 02-12-2018 11:20PM #1

1. Processing shall be lawful only if and to the extent that at least one of the following applies:
=> Article: 9(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

http://www.privacy-regulation.eu/en/article-6-lawfulness-of-processing-GDPR.htm

Now by having a list of every boy and girl in which he identifies them as naughty or nice(and checks twice),seeing as not all children write to him expressing their desires for toys and claiming their status as good there by giving their consent for him to process their data, by having a list of all boys and girls without their consent is he breaking GDPR legislation?

Or does part B and/or E absolve him?

Carawaystick · 02-12-2018 11:23PM

Santy is
a) not real
b) lives at the north pole, which is not in the eu
c) like what are the cjeu gonna do?

hullaballoo · 02-12-2018 11:47PM

I think consent is freely given for all of the details and data Santa collects tbh.

The spirit of the GDPR is something that's often forgotten on conversations about the nitty gritty of its provisions.

And lest we forget, the spirit of it is genuinely justiciable and at its very centre.

nim1bdeh38l2cw · 02-12-2018 11:52PM

hullaballoo wrote: »

I think consent is freely given for all of the details and data Santa collects tbh.

Is it though? The balance of power is definitely in Santa's court. If you don't consent, you don't get any present! Ergo, consent cannot be freely given so one of the other bases must be relied upon.

10-10-20 · 02-12-2018 11:58PM

This is huge.
It's not just personal data, it's special category personal data because it's based on a kid's beliefs.
http://www.citizensinformation.ie/en/government_in_ireland/data_protection/overview_of_general_data_protection_regulation.html
Additionally, consent wasn't granted on the initial child->Santa communication, so consent will have to be requested and granted again. Good luck with that given that kids typically move out of home just after ~21 years (wishful, I know).

So here's the offending text:
Santa Claus is comin' to town ---> Promotion of the event. He's operating as a business as opposed to an individual. Rules differ!
He's making a list and checking it twice ---> So here's that confidential customer list.
Gonna find out who's naughty and nice ---> Personal data! Just saying! Data collection and retention. It's going to be on computers, so FOI request!
...
He sees you when you're sleepin' ---> Hmmm, did he get permission for monitoring kids? Ok, I suppose he needs to know this so that he can deliver effectively.
He knows when you're awake ---> This I have an issue with. It's beyond his remit to know the wake-state of every kid.
He knows if you've been bad or good ---> This is justified. Generation Z should be treated in the same way as every other generation.

Yeah, Santa better have employed a good Data Controller.

10-10-20 · 03-12-2018 12:12AM

sexmag,
You'll get whistle-blower protection. Just graciously decline any offers of assistance from Garda HQ.

http://www.citizensinformation.ie/en/employment/enforcement_and_redress/protection_for_whistleblowers.html

Gimme A Pound · 03-12-2018 12:19AM

Also the legal term for Secret Santa is Confidentiality Claus.

Under His Eye · 03-12-2018 12:30AM

Santa claims his principal place of business as Rovaniemi, Finland, so GDPR does apply to him.

wench · 03-12-2018 01:01AM

Carawaystick wrote: »

Santy is
a) not real
b) lives at the north pole, which is not in the eu
c) like what are the cjeu gonna do?

Under His Eye wrote: »

Santa claims his principal place of business as Rovaniemi, Finland, so GDPR does apply to him.

And in any case the data subjects do live in the EU, so he can't get out of it that way.

nuac · 03-12-2018 01:03AM

Under His Eye wrote: »

Santa claims his principal place of business as Rovaniemi, Finland, so GDPR does apply to him.

That is a recent claim. Everybody knows that Santa is based at the North Pole.

Peregrinus · 03-12-2018 01:15AM

Under His Eye wrote: »

Santa claims his principal place of business as Rovaniemi, Finland, so GDPR does apply to him.

No. Rovaniemi, Finland claims that it is Santa's principal place of business - subtle but important distinction.

Worth pointing out that North Pole, Alaska (this is a real place and it's not at the actual North Pole) also claims to be Santa's principal place of business. He has a brass plate operation in Canada, the address of which is "North Pole H0H 0H0, Canada". And he has a fixed establishment in Russia, at Veliky Ustyug in the Vologda region.

I kind of assume this multiplicity of jurisdictional locations is tax-driven - Santa is probably avoiding tax, and also there must be some doubt as to where social insurance contributions for the elves are supposed to be paid - but it certainly creates jurisdictional problems when it comes to enforcing regulations or pursuing claims.

tricky D · 03-12-2018 01:27AM

sexmag wrote: »

Or does part B and/or E absolve him?

Sanity Clause

https://www.youtube.com/watch?v=GZQROJsdYF0

Losty Dublin · 03-12-2018 01:42AM

10-10-20 wrote: »

So here's the offending text:
Santa Claus is comin' to town ---> Promotion of the event. He's operating as a business as opposed to an individual. Rules differ!
He's making a list and checking it twice ---> So here's that confidential customer list.
Gonna find out who's naughty and nice ---> Personal data! Just saying! Data collection and retention. It's going to be on computers, so FOI request!
...
He sees you when you're sleepin' ---> Hmmm, did he get permission for monitoring kids? Ok, I suppose he needs to know this so that he can deliver effectively.
He knows when you're awake ---> This I have an issue with. It's beyond his remit to know the wake-state of every kid.
He knows if you've been bad or good ---> This is justified. Generation Z should be treated in the same way as every other generation.

Yeah, Santa better have employed a good Data Controller.

To take up your point.....

Santa doesn't run any event himself. He just turns up upon invite.
Santa lists are currently outsourced to Elf on a Shelf. Elf is subject and not Santa, to Data laws. FOI is State only so only children of Civil and Public Servants that live in work would be covered here.
Santa Cams are only subject to CCTV laws if a monitoring contract is entered into.
A paediatric Sleep Clinic may have let Santa know about your child sleeping or not. This is a breach of the Hippopotamus Oath.
A Youth Worker is obliged to pass on claims of abuse

:pac:

RobbingBandit · 03-12-2018 02:07AM

Carawaystick wrote: »

Santy is
a) not real
b) lives at the north pole, which is not in the eu
c) like what are the cjeu gonna do?

WILL FERRELL wants a word

Santa! Oh, my God! Santa's coming! I know him! I know him!

You calling Will a liar well are you!

Mr. Incognito · 03-12-2018 11:06AM

Best of luck serving him with proceedings.

Princess Consuela Bananahammock · 03-12-2018 11:12AM

All joking aside, genuine question: if you write a list of people's names for whatever reason - to do list, invite list for party, potential meeting attendees, and so on - are you in breach?

sexmag · 03-12-2018 11:42AM

Losty Dublin wrote: »

Elf is subject and not Santa, to Data laws.

Actually not true,once the elf hands over the data to Santa, santa is then the data controller and subject to same regulations.

What needs to be found is if a child has not given consent then how do they opt out?

Also what's 4% of Santas global turnover should he be fined?

xalot · 03-12-2018 12:06PM

Santa needs the list for business operational reasons so I think he can justify himself if it comes to that!

Seth Brundle · 03-12-2018 12:16PM

sexmag wrote: »

What needs to be found is if a child has not given consent then how do they opt out?

Can a child under 16 give consent in these situations?

I'm also concerned over his long history of illegally entering people's properties. This country is a joke - known criminals allowed to freely wander the streets!

Is Santa Claus in contradiction of article 6 of GDPR

Comments