Your data
This section names 64 people it did not get the data from. This page says what is held, why it is lawful to hold it, and how to have it removed without giving a reason. Machine surface: notice.json.
Not legal advice. This notice is what a publication owes the people it names, written by the people publishing it. It is not legal advice and no lawyer has reviewed it. The statutory article it rests on was returned truncated when the brief's author read it and must be re-read in full. If you are relying on this as a model, get your own advice.
Who is responsible
Dinis Cruz, personally — dinis.cruz@owasp.org
No entity exists for this publication. Naming a person rather than a project is the honest version and it is also the cheap one — it means the objection route below reaches somebody who can act on it rather than a form.
What is held
People named on the event's own published speaker list, in their professional capacity: name, the role they are listed under, the organisation they are listed under, and the links the event published for them.
Held
- Name, as published by the event
- Professional role, as published by the event
- Organisation, as published by the event
- The URL of that person's own page on the event's site
- A LinkedIn profile URL where the event published one
Refused, always
- Postal addresses of any natural person
- Email addresses of any natural person
- Telephone numbers of any natural person
- Any special category data
- Biographies, which are the speaker's or organiser's own writing and are linked rather than reproduced
- Any assessment, ranking, score or characterisation of any named person
Where it came from: One publisher: the event's own website, fetched and frozen to dated snapshots in this repository. Every source is listed with its SHA-256 in the register. The register →
Why we are allowed to
The basis is legitimate interests, and the journalistic route is deliberately not claimed. The journalistic derogation is not claimed. Article 24(3) of Lei 58/2019 conditions processing for journalistic purposes on the national legislation governing access to and exercise of the profession. This publication is not accredited under it and does not meet that condition, so it does not rely on it.
Reporting what a public event has published about itself, and demonstrating a verification method on it. Both are matters of public interest and neither is commercial — the section carries no price, no advertising and no tracking.
The reporting cannot be done without the names, because the subject IS who is speaking. The data held is the minimum: the four published professional fields and nothing else. No biography is stored, no contact detail is stored, and no inference about anybody is made or published.
Every datum was published by the event itself for the express purpose of announcing these people as speakers, in their professional capacity, and carries no private-life content. Against that: being listed on a third-party site is not something anybody consented to, which is why the objection route below is unconditional rather than assessed. We also record that data having been made public does not by itself mean it may be processed on this basis — it is a factor in the balance, not an answer to it.
The three limbs follow the European Data Protection Board's guidelines on legitimate interests adopted 8 October 2024.
Why this is a public page rather than an email to each of you
Where personal data is not obtained from the person it concerns, Article 14 of the GDPR requires that they be told. Article 14(5)(b) exempts a controller where individual notification would involve disproportionate effort — but that exemption is conditional, and one of the measures it expressly requires is making the information publicly available.
This page is that measure. It exists so the exemption is earned rather than assumed, and it was published before this section's first update following the discovery that it was missing.
And the part that reflects badly on us. It should have been published at the same time as the pages naming these people, not after. It was not. That is recorded here rather than quietly fixed, and the release note says the same.
What you can do
- Ask what is held about you, and get a copy
- Have anything inaccurate corrected
- Object to being included, and be removed
- Have the removal propagate to every page on the next build, which runs on request rather than on a schedule
- Complain to the Comissão Nacional de Proteção de Dados, or to the supervisory authority where you live
Getting removed
How. Email the controller above. Say who you are and that you want your entry removed.
No reason is required and none will be asked for. Removal is not assessed, argued with or delayed pending a balancing exercise.
What happens. The entry is removed from the derived data, the section is rebuilt, and the person's name no longer appears on any page. Because removal changes what the snapshot diff would otherwise show, the changes page records that an entry was removed at the subject's request, with no name — which is the only way to keep the diff honest without re-publishing the name it was asked to remove.
We also never say why you left somebody else’s list. Where a name has left the event's own published list between two of our snapshots, this publication records the change and states no reason. Withdrawal, a scheduling clash, a duplicate record and an editing error are indistinguishable from outside, and attaching a motive to a named person on that evidence is the most harmful thing this section could do.
How long
The frozen source snapshots are permanent, because they are the evidence that makes every claim checkable and deleting them would break the method. The derived entity data is rebuilt from them on every run. If a person objects, their entry is removed from the derived data and from every rendered page; the frozen snapshot is not altered, because it is a copy of what somebody else published on a date, not our record of them.
Em português — resumo
Esta secção publica o nome, o cargo e a organização de 64 pessoas, tal como o próprio evento os publicou. Não guardamos moradas, endereços de correio eletrónico nem números de telefone de nenhuma pessoa, e não reproduzimos as biografias.
O responsável pelo tratamento é Dinis Cruz, personally (dinis.cruz@owasp.org). O fundamento é o interesse legítimo. Não invocamos a derrogação jornalística do artigo 24.º da Lei 58/2019, porque esta publicação não cumpre a condição de acesso e exercício da profissão que esse artigo exige.
Para ser removido, basta pedir. Escreva para o endereço acima. Não é preciso dar qualquer justificação e nenhuma lhe será pedida. Pode também apresentar queixa à Comissão Nacional de Proteção de Dados.
Este resumo existe porque várias das pessoas nomeadas são portuguesas. O resto do site está em inglês. Isto não é aconselhamento jurídico.
For an agent
The data-protection notice for this section, machine-readable at /portugal/data/notice.json. The lawful basis is legitimate interests and the journalistic derogation is expressly NOT claimed — Article 24(3) of Lei 58/2019 conditions it on professional accreditation this publication does not have. Personal contact details of any kind are refused at extraction time and gate check 11 fails the build if one appears in the data. Removal on request is unconditional and no reason is asked for. This is not legal advice and no lawyer has reviewed it.