Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

3
votes
2answers
28 views

Is this privacy statement from a solicitors in line with GDPR?

I'm in the process of buying a house and have paid for a survey to be done on the property. I have received a contract from the solicitor who will be conducting the survey for me and will provide me ...
1
vote
1answer
25 views

Do I need an active consent according to GDPR?

If I have a form on a website where people fill in their personal details and credit card information to subscribe to a monthly delivery of apples, do I need an active consent (e.g. checkbox) from the ...
4
votes
2answers
42 views

Does possesing BUT NOT processing a personal data make the organization their controller?

According to Article 4(7) of GDPR: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
1
vote
1answer
17 views

Responsible GDPR data protection authority (DPA) responsible for non-EU companies?

Article 15 EU GDPR is often cited as basis of what needs to be included in privacy policy. The data subject shall have the right to obtain from the controller confirmation as to whether or not ...
1
vote
1answer
60 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
1
vote
1answer
26 views

Can a data subject be asked to share a limited part of their data if it would be in their interest to do so?

I am an adviser for a UK agency that provides free advice to the public. I have two employment cases that differ in detail, but are fundamentally the same issues and involve the same company. It could ...
0
votes
1answer
50 views

Yahoo Messenger and the GDPR

Yahoo Messenger was was discontinued on December 1, 2018. On this date downloading of chat history was stopped. However they did not tell their users what happened to their data associated with Yahoo ...
3
votes
1answer
81 views

Was my GDPR request not complied with?

On the 12th of December I made a GDPR request to a major online retailer in the UK. While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
2
votes
1answer
46 views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
0
votes
0answers
23 views

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer ? Is above fundamental right's affected by Clauses in temporary employment contract like '...
0
votes
1answer
30 views

Does GDPR impose requirement for an EU based e-mail address?

Does GDPR impose requirement for an EU based e-mail address? I mean, not directly but indirectly for all practical purposes. Assume an EU based company having a public website. GDPR requires a ...
1
vote
1answer
24 views

GDPR article 20, portability of future data

Article 20.2 of the GDPR states: "In exercising his or her right to data portability [...], the data subject shall have the right to have the personal data transmitted directly from one controller to ...
0
votes
1answer
37 views

GDPR: How to respond to clinicians who ask for subject access requests for results to be made in writing

During a hospital stay, when requesting a copy of blood test results from doctors or nurses, unfortunately patients are often met with the response "Your request must be made in writing and must be ...
0
votes
0answers
7 views

GDPR: Transmitting results from secondary to primary care records

In the UK, results of a blood test taken at a hospital (in secondary care) are stored in the hospital's records but are not automatically forwarded into primary care records (GP records) unless this ...
1
vote
1answer
28 views

Does a website owner (data controller) have to disclose its data processors in its privacy policy?

A website owner is data controller. Most website owners are using web hosting companies, i.e. data processors. Each website owner must have a GDPR compliant privacy policy. Must each website owner ...
2
votes
2answers
87 views

Is a website OK with GDPR if it is not permitting the users to delete their posts?

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. Is it against the right to erasure mentioned here ...
0
votes
1answer
24 views

Emails from clients and GDPR

I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the ...
2
votes
1answer
45 views

Does my Personal Web App need to comply to GDPR?

I am building an app where I have some concerns about GDPR and user data. First of all this is a personal app, no company behind. What the app does: Allows a user to authenticate via e.g. ...
1
vote
1answer
37 views

Can GDPR violations lead to piercing of the corporate veil?

Does GDPR have any clauses that hint at piercing of the corporate veil? Can GDPR violations lead to piercing of the corporate veil?
2
votes
1answer
85 views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
1
vote
1answer
22 views

GDPR: Do I have to mention MailChimp in the privacy policy of a website if the registration form is only linked?

If I use MailChimp to send out newsletters and on my website I link to the registration form hosted on the MailChimp server, but don't embed it, do I need a MailChimp section in the privacy policy of ...
3
votes
1answer
41 views

Does GDPR apply to location data collected by apps?

I've just been reading this article in the New York Times which expounds on the business practices of mobile apps which collect your location data and use it/sell it. The article gives examples of ...
1
vote
1answer
28 views

Fee for Subject Access Request to GCHQ, Data Protection Act 2018

When making a Subject Access Request to GCHQ I was told that I would have to pay a fee for this Request. The GDPR does not allow for such a fee, while the UK Data Protection Act does(Part 4 – Chapter ...
0
votes
1answer
33 views

What is “disclosure by transmission”?

Article 4(2) GDPR states: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as ...
0
votes
1answer
37 views

How much can the GDPR be amended by EU member states in their national laws?

Citing article 8 of the GDPR (emphasis added): Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the ...
1
vote
0answers
72 views

GDPR: How does Airbnb get away with their signup form?

We're looking at making our signup form GDPR friendly along with sending users more timely, personalised marketing and account update emails. Asking if a user wants to receive all these different ...
0
votes
0answers
14 views

Changes to the privacy policy that require the user's consent: GDPR compliance

Suppose you have an online service, with a privacy policy that the users have accepted. Then at some point you want to introduce some changes to that privacy policy, in a way that requires the user's ...
3
votes
1answer
43 views

GDPR - How quick to honour unsubscribe?

Does GDPR or any other UK law specify the timeframe for removing someone from a mailing list? In our case the mailing list must be created up to 10 days before an automated email send over the ...
1
vote
1answer
36 views

Does the process of anonymizing web server logs count as 'Processing' under GDPR?

As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. I am looking to implement a log anonymization ...
2
votes
0answers
49 views

Ebay - GDPR - Legality of re-assigning Data Controllers?

This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016. According to Article 27 (...
2
votes
1answer
50 views

GDPR Requiring consent to give up privacy

A website that I visited posted the following: “YOUR PRIVACY IS IMPORTANT TO US. New regulations in your country require you to agree to our terms of use agreement and privacy policy before you can ...
1
vote
1answer
66 views

Processing of genetic data: which are the required “technical and organisational measures”?

Several articles of the Regulation require to apply the “appropriate technical and organisational measures” or “appropriate safeguards” in order to ensure the security of data. While GDPR ...
0
votes
3answers
80 views

Is this information considered personal?

Imagine a UK-based company made an application to order food from restaurants. The company decided to share the following information with the restaurants to summarize orders made restaurant location ...
0
votes
1answer
32 views

Modify a client file

After the setup of the GDPR law about personnal data security, I have a case I'm not sure about. Test case: I receive an addresses file from a client containing x lines of addresses with personnal ...
3
votes
1answer
53 views

GDPR compliance for software that lets users store PII of other people

Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential ...
0
votes
1answer
32 views

How can GDPR affect user generated content?

I'm wondering where the lines of GDPR are in regard to user generated content and how it meets the Communications Decency Act. Section 230 has been what ISPs and websites (Yelp as an example) use as ...
1
vote
2answers
68 views

Deliberately inaccurate data

The GDPR seem to assume that the client would want us to maintain accurate data. Article 5(1)(d) makes it clear we have to correct inaccurate data. But I deliver pizzas for a big chain, and I ...
4
votes
2answers
101 views

Do I have to provide proof of citizenship - GDPR

Recently, I've been going through some old accounts of mine (on online websites) and I started deleting them. Thanks to GDPR, this is now much easier. Most companies' customer services have no ...
0
votes
1answer
38 views

Identity of the controller (GDPR): can any website now ever be anonymous?

No matter whether a website collects personal data or not, it seems that a privacy policy is required anyway, and such a policy should contain (citing article 13 of the GDPR, first paragraph): (a) ...
1
vote
1answer
34 views

GDPR Article 13.4 - how do you know that the data subject already has the information?

Article 13.1 states: Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject ...
1
vote
1answer
37 views

GDPR - website with no cookies, no analytics, no private data collection

I'm building a website right now and I'm little bit concerned about GDPR and I hope you can help me out. So, the website will be a blog with posts, product reviews and some affiliate links, I plan to ...
2
votes
1answer
49 views

GDPR and locked content, legal or not?

We are at the point where we want to launch a web application. The application requires the visitor to create a free account to explore the website. So already at the beginning, they need to create ...
1
vote
1answer
63 views

Does the GDPR law apply to my hobby-site?

I'm the owner of a website that maintains statistics about crew-members of an other site. The statistics about the crew-members are as follows: Username (on that other website) User ID (on that other ...
1
vote
1answer
82 views

GDPR - Recording simple page views

We are currently using google analytics to track our site. The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the ...
0
votes
1answer
50 views

GDPR - is user social ID personal data

1) Is Google or Facebook user ID number considered personal data? The ID itself is just a number, but you can use it to construct a profile url and reveal his identity through Google or Facebook ...
2
votes
1answer
48 views

Can a user request the deletion of their IP address that is stored for moderation purposes?

An Internet forum logs their users' IP addresses for moderation purposes (fighting abusive sockpuppetry, temporary banning a dynamic IP address range in case of a spam attack, permanently banning ...
1
vote
1answer
70 views

Does a user have the right to request their forum posts deleted?

Forum posts and similar stuff: chat messages from chatlogs, etc. According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered ...
2
votes
1answer
85 views

My email has been shared with other parties

I am in the process of searching for a new job and I have applied for a few. Today I received an email from HR representative of one of the companies saying that I was not called for an interview ...
1
vote
2answers
67 views

Is GDPR really needed if my android app doesn't collect any personal data?

I have developed some Android applications, and they don't store any personal data, but they do some calculation about some input, for example the annual salary provided by user and return to him a ...
1
vote
1answer
89 views

GDPR: if a user doesn't agree cookies on my banner, what must I do?

if a guest of my site click on "Not agree" on cookie banner, what must I do? Have I to disable all the cookies? Have I to disable all the cookies except technical cookies (eg. login session cookies)? ...