1. We are screen grabbing comments and sending to clients from Facebook, that includes names/comments of other Facebook users. We use these in our reports and send to clients. Are we able to still do this?
1. This depends on what you are going with the comments, for what purpose you are collecting them. So, in order to provide you with an accurate answer would need more details on the reports you are sending and the reason for doing that. Also, do you really need to include the names ? What is the reason behind that?
However, if you don`t receive the personal information from directly from the data subject but from another source as per article 14 of the EU GDPR – “Information to be provided where personal data have not been obtained from the data subject” you can provide the Privacy Notices:
- within a reasonable time after obtaining the data, but at the latest within a month;
- if the personal data is used to communicate with the individual, at the latest when that communication is made;
- if the personal data is disclosed to a third party, at the latest when that data is disclosed.
If you obtain that personal data from a third party, there is no need to provide a privacy notice if:
- the individual already has the information;
- providing the information would be impossible or involve disproportionate effort, particularly where the processing
is for archiving, scientific or historical research purposes or statistical purposes;
- the obtaining or disclosure is pursuant to Union or Member State law and there are appropriate measures to protect - the individual; or
- the information is subject to professional secrecy
There is no mention in the EU GDPR on how you should communicate the Privacy Notice so you can use email as well.