@chris His defences are "Processing is necessary to satisfy a contract to which the data subject is a party." and "Processing is necessary to perform a task in the public interest or to carry out some official function."

#SantaGDPR

@chris

Might get away with 'legitimate interest'.

Bigger question: is that 'Data concerning health'?

@chris article 4 is just the definitions… I think it should be article 6

Oh boy do I feel smart! 😁

😏

@chris
He sees you when you're sleeping
He knows when you're awake
He knows if you've been bad or good
So be good for goodness sake!

You better watch out

@chris
I would argue that Santa has legal basis for the data processing?😉

Exercise of official authority or task in the public interest:
The data controller must process personal data in order to carry out its duties as an authority or to carry out a task in the public interest.

@chris

It could be argued that by checking his list twice, he's doing his due diligence and pruning those that haven't given consent.

Of course, he's also well known for not sharing data with third party delivery companies too, choosing instead to handle the fulfillment side himself.

I would also think that he's been given explicit right to use the data, for a specific purpose. I can't remember the last person that wrote to him asking for advice on Crypto.

@chris

Actually, Santa's elves are compiling the data from public sources including police reports, local newspapers, social media and self-reporting.

@chris @MostlyUnpainted

Now who didn’t try to sing that?!

@chris The real challenge would be successfully executing any judgement against Santa. His bases strategically advantageous location at the north pole rules out any sort of ground assault, while the air combat capabilities of his reindeer exceed the combined power of every air force on earth.

We are at the mercy of a jolly red god, it is best not to get on his naughty list.