Issues with BO's Privay Policy

Leftoverbricks

I'm worried about particular phrases in the Privacy Policy, which you can find here: https://www.brickowl.com/privacy

(1)
"Brick Owl processes personal data as a Controller as defined in GDPR. We process personal data to allow Users to place orders and interact with Brick Owl. All data collected by Brick Owl is stored securely in data centres located in the European Economic Area."

Since Brexit GDPR is no longer effective for the UK, the privacy policy needs to be updated and failing to do so is a criminal offence in the UK.

(2)
"Information correction & deletion. You can update any of the information that we have stored on you from your user profile, or you can contact us if you would like for your information to be deleted. Some information may need to be kept for financial record-keeping according to local government regulations."

I have submitted about one thousand edits to the BO catalogue, including many pictures. If I cancel my account I don't want them to be used in the future. According to GDPR law - which no longer is in effect since the UK left the EU, but still is in the Privacy Policy of Brickowl, I assume I still have the right to be forgotten: https://gdpr.eu/right-to-be-forgotten/
The latter will mean that all my contributions to the catalogue on BO are lost.

Please inform your sellers outside the UK how you are going to handle this and comply to the law. Thanks.

Lawrence

I can confirm we did review the privacy policy after the UK left the EU. The website data is still stored on EEA servers, and the UK retains a similar GDPR framework. Users can still have their account deleted. Catalog submissions are not personal data so it would not come under this.

We would hope that any members that no longer wish to have a Brick Owl account, would not also ask for all their catalog contributions to be reverted.

Hoddie

Copyright is not necessarily held by the photographer. A photograph is only protected as a copyrightable work if the photographer has made creative choices. Additionally, a photograph does not itself become a copyrightable work if it is of an object that is already subject to copyright.

It is a complicated area of both EU and UK law, but essentially, if you photograph a product that is subject to copyright, and the product is the only substantive part of the image, the photographer could not claim it to be a copyrightable work. The copyright of the photograph would belong to whoever owns the copyright of the product.

There's also the consideration that users willingly uploaded images for BrickOwl to use for purposes they were explicitly aware of (that is, they knew that by uploading images, BrickOwl would possibly use them in the catalogue). This effectively assigns the relevant part of any copyright that does exist (likely none) to BrickOwl.

Considerations under "right to be forgotten" can often be met by anonymising data, not necessarily removing it. In any case, an image of a Lego item is unlikely to qualify as they contain no personal data.

Hoddie

Hmm for some reason I read images not edits. The final paragraph still applies.

Leftoverbricks

@Lawrence 'We would hope that any members that no longer wish to have a Brick Owl account, would not also ask for all their catalog contributions to be reverted.' is very clear. I hope you don't have to deal with these kind of issues because indeed it would be an administrative nightmare for you.

Vosblokjes

To be forgotten for catalog submissions is quite simple, I think.
Just remove all references from the requester to the submissions hence forgetting the requester.
As far as I know there is no rule that all submitted data from a person has to be deleted, there only should no longer be a reference to a person that wants to be forgotten.

NelisSolis

@Leftoverbricks: GPDR does still apply to BrickOwl, since it still operates in the EU and processes personal data of EU individuals:

https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm

MinifigMan

I agree with BasKrie. As a web developer running multiple community driven websites, I hired an IT-specialised lawfirm to find out what my rights were regarding community submissions. The result was that as long as they are not personal, but factual information, there is no privacy or copyright component involved and a user cannot have them deleted.

Photos might be another case, but that was not part of my question for the lawfirm. I've seen websites ask for an indefinite publication right, but that might be hard if you ave to remove attribution data.