Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
969
questions
0
votes
1
answer
49
views
Is "gossip surveillance" processing personal data under the GDPR?
The Guardian has an article on "gossip surveillance" where strangers report on social media private conversations they are not party to in the hope of exposing duplicity from the speakers in ...
- 5,880
0
votes
1
answer
181
views
Right to be forgotten on internet forums [closed]
I was recently tricked by an admin into getting booted off a forum of his where I had been active for years.
This happened in a thread (my last) where this admin claims a number of things that are at ...
- 109
2
votes
2
answers
118
views
Is it legal/appropriate to email a GDPR SAR to the executive team if that is the only email address the company provides?
This is prompted by this question but I am fairly sure I do not have the correct answer so I am making this one.
My personal answer to "How do I get my data from company X under GDPR" is to ...
- 5,880
0
votes
1
answer
87
views
How to get user data from Foursquare/Swarm under GDPR?
Is there a way to download all my contributed check-in and reviews data from Foursquare/Swarm?
The foursquare.com doesn't seem to have a way to log in with the old foursquare/swarm credentials.
Isn't ...
- 101
-3
votes
0
answers
88
views
When running a dropshipping business, how can business owners protect customer data in accordance with GDPR?
In accordance with GDPR laws, how can dropshippers protect their customers' personal data when it's being sent to suppliers in countries that don't have data protection laws as strict as the EU?
16
votes
2
answers
4k
views
Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?
The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
- 5,880
0
votes
1
answer
47
views
Which EU country's regulation is applied when doing direct marketing from country A to a legal or natural person in country B?
So I'm wondering which country's legislation is used when, for example, a company from Sweden would do electronic direct marketing to another company in, say, Germany.
Assuming that Sweden and Germany ...
0
votes
1
answer
132
views
What to do if a company starts sending abusive newsletters years after having asked them to stop? [closed]
Five years ago, I used my e-mail address once to buy a service from a company in the EU (so the GDPR applies). Since then, they subscribed me without asking to a newsletter and sent me several mails ...
- 103
9
votes
1
answer
4k
views
GDPR, online shopping and phone numbers for shipping - Is it legal?
Many webshops expect the phone number to be entered for shipping. My understanding of the GDPR is that you are not even allowed to ask information which is not absolutely needed for the given task. ...
- 101
6
votes
2
answers
3k
views
Are developers data processors?
This question is inspired by this other question: What are an employed/contracted software developer's responsibilities under the GDPR?
I wanted to understand more precisely the concept of a data ...
- 67
-2
votes
1
answer
116
views
Are deleted comments left by U.K. based users retained and subject to subject access under U.K. GDPR?
Meet Bob; Bob left some comments on a post on stack exchange and some over zealous moderators decided that they were not needed and so to delete them. Bob wishes to access these comments for the ...
- 9,009
0
votes
1
answer
53
views
Does GDPR require consent to collect non-personal information?
If a website never assigns a user a unique identifier, does the website need to get explicit consent from the user before collecting non-personal information?
Examples of non-personal information that ...
- 103
1
vote
2
answers
179
views
What are an employed/contracted software developer's responsibilities under the GDPR?
This is prompted by this question but that is rather complicated by the technical details. Suppose the following hypothetical:
Alice is a software developer for Bob Inc. perhaps as a normal employee, ...
- 5,880
3
votes
1
answer
92
views
Can one person's genetic information be another persons personal information?
In the UK GDPR ‘personal data’ is defined as:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one ...
- 5,880
4
votes
2
answers
3k
views
If this has nothing to do with GDPR, is this acceptable legally?
I was advised to ask only one question per post.
In my earlier post
Does this action violate GDPR
If a company is aware that a customer cannot provide a receipt, yet still requests their personal ...
- 348
1
vote
0
answers
26
views
Multi Domain Cookies Consent —Special Category Data
Can cross domain cookie consent be applied to government websites which collect special category data?
Or is there any legal\policy guidance covering the use of multi domain cookies consent for the EU?...
- 11
1
vote
1
answer
52
views
Cookie Consent: Do we require consent for login or user preferences?
I would like my web site to be as GDPR friendly as possible. I don’t make use of tracking, advertising or analytics.
On a web site, we might have want to track the following:
Login cookies — has this ...
- 213
3
votes
2
answers
178
views
What rules determine jurisdiction on the internet?
It is in the news that Clearview AI has won an appeal against the UK Information Commissioner's Office (ICO). The reasons for judgment are here: Clearview AI Inc v The Information Commissioner [2023] ...
- 5,880
1
vote
1
answer
332
views
Does this action violate GDPR
If a company is aware that a customer cannot provide a receipt, yet still requests their personal information to facilitate a product exchange due to a defective item, but later denies the exchange ...
- 348
3
votes
0
answers
78
views
When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?
When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately?
There exists an argument ...
- 131
-4
votes
1
answer
94
views
Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?
Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to ...
- 9,009
0
votes
0
answers
38
views
Is jigsaw identification enough to render a piece of information DPA-subject “personal data“? [duplicate]
In some legal contexts there is the notion of “jigsaw identification,” that is pieces of information that could allow certain people if adequately placed and privileged to other pieces of information ...
- 9,009
-2
votes
1
answer
81
views
Is changing my IP to test a website a violation of GDPR [closed]
My company is US based and we host and creates websites. Some websites are hosted in europe and some in the US, both are accessible to the EU though. We were wondering if for example there was a bug ...
- 1
0
votes
1
answer
101
views
Are outward facing security cameras’ footage on the outside of ambassadorial missions subject to subject access rights?
Bob walks past the front entrance of the embassy of the republic of Zwakilostan which is somehow under diplomatic protocols Zwakilostani sovereign territory. The cameras point outside toward the road ...
- 9,009
10
votes
5
answers
4k
views
Is scraping an iCal link legal?
TL;DR: my university says my app is illegal
Since our university doesn't have a mobile app to check our schedules, I created one that does the following:
Opens an embedded web browser (in app) and ...
- 117
-1
votes
1
answer
74
views
Is it reasonable for a data controller to require proof of one’s address before honouring a subject’s right of access
Alice has requested access to her personal data from a shopkeeper.
Barbara has submitted a SAR to a police force for BWV footage.
They both require one item of identification and another for evidence ...
- 9,009
-7
votes
1
answer
87
views
Wat are the benfits of Temporal Tables for GDPR Compliance?
I am a software developer with some basic knowledge of the GDPR. I asked Chat GPT what the benefits are of temporal tables in SQL Server for GDPR Compliance. Is Chat GPT 4 right? And what could be ...
- 234
3
votes
1
answer
78
views
Can GDPR force public sector workers to fix an exploit they were notified of?
I live in some EU country and I rely on social security provided by the regional government. There is a website for residents who can sign up and claim benefits without physically visiting an office. ...
- 31
3
votes
2
answers
1k
views
GDPR takedown request unsuccessful
I made the following request
My name is _ I am a citizen of the EU. My email addresses are _ and _
In accordance with Article 17 of the GDPR I request you to erase all personal data that you hold ...
- 139
1
vote
0
answers
88
views
Does the GDPR/data protection act contain any anti-reprisal provisions?
The Information Commissioner's Office ICO advisers state that one “shouldn't” be treated any directly or less favourably as a result of exercising one’s rights under the legislation. What legal ...
- 9,009
10
votes
2
answers
4k
views
Is a "login timestamp" considered as personal data according to GDPR?
If software is saving the timestamp of the last login of a user, would that timestamp itself be considered personal data by GDPR?
- 233
2
votes
1
answer
331
views
GDPR and privacy policy compliance for software used internally by customer company
We are developing software that are sold to and used by other companies. In the software, certain types of personal data, like name, email and phone number, can be stored when a user registers. The ...
- 233
1
vote
2
answers
127
views
Are surveillance laws in EU member states necessary and proportionate? [closed]
On the 10th of July the EU Commission adopted a new adequacy decision, as a successor to the failed Safe Harbour and Privacy Shield agreements, to allow data transfers from the EU to the USA. The two ...
- 599
2
votes
1
answer
53
views
Can legal/ pre-action correspondence with a business be subject to a SAR?
Bob has been harmed by a business ACME inc. He sends them a letter before claiming damages as under the pre action protocol. They send him a reply.
Bob loses his copy of both of these articles of ...
- 9,009
16
votes
5
answers
7k
views
Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?
On day one of my first year in high school me and basically every other students were given a few documents to sign. One of them included a clause that allowed the school to publish pictures of us ...
- 161
0
votes
0
answers
67
views
how long might the regulatory action against Meta’s GDPR flouting take to play out?
Meta Inc is known to flout subject access request under the GDPR and numerous complaints have been lodged. What is the timeframe for these processes to play out?
How does Facebook justify non-...
- 9,009
3
votes
1
answer
981
views
If website uses cookies only after users login, can I ask for cookie consent during account creation instead of website launch?
I have a website that uses cookies only if the user logs in. Is it necessary to show a cookie popup banner at website launch or can I ask for consent when user is creating an account (the standard I ...
- 143
4
votes
1
answer
92
views
How can Standard Contractual Clauses overcome Schrems II?
My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
- 143
-4
votes
4
answers
122
views
GDPR Privacy Policy - how to handle non standard cases without much budget
I want to market a little side hustle of mine and due to GDPR need to create some data privacy policy. Since as any reasonable developer I try to leverage the power of frameworks like Firebase, Stripe,...
- 87
3
votes
1
answer
104
views
UK GDPR Transcribing calls
I'd like to understand the rules around automated transcribing calls in the UK, from a B2B perspective.
GDPR seems quite clear that if you are recording calls, video and/or audio, you must get consent....
- 133
8
votes
1
answer
3k
views
Does GDPR apply when PII is already publicly available?
Pretend there is a website, it might be free to access, or be a paid per search service, where the users get access to summarised information on the people that they search for.
All of the information ...
- 688
2
votes
1
answer
146
views
Is the usage of an OCR service causing copyright issues when a photo of a book page is analyzed?
Here's the scenario
A user takes a photo using an app from a book, which might have be copyrighted.
The app then uploads the photo to a cloud service in order to analyze it using OCR
The app receives ...
- 23
0
votes
3
answers
134
views
Using Sentry in an app targeting children below 13 years
We have created a children game using Unity and therein we use SentrySDK for automatic bug reporting.
Since our app is targeting children under 13 years, we need to comply with
COPPA
GDPR
Google's ...
- 101
1
vote
0
answers
56
views
What information can insurance companies share with brokers?
I'm currently in the process of buying my first home, and have a mortgage broker helping me through the process. Our broker found us life insurance (to cover the cost of the mortgage) through a large ...
0
votes
0
answers
451
views
GDPR implications of email sent to a misconfigured host
I sent an email to a website's contact and my mailserver received this error:
<...@...>: host ....mail.protection.outlook.com[104.47.70.110] said:
451 4.4.4 Mail received as unauthenticated, ...
- 103
11
votes
5
answers
2k
views
GDPR: Can a city request deletion of all personal data that uses a certain domain for logins?
A city in Finland asked me to delete all data for everyone whose login uses a certain domain. The domain contains "edu" in it and "oppilas" (which translates to "student")...
- 211
1
vote
1
answer
115
views
SARing received text messages from a lost phone
Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received.
Bob loses his phone but ...
- 9,009
4
votes
1
answer
89
views
gdpr: classification of a psychiatric report
I'm following a job-related course regarding data protection and the GDPR (European Union, I'm located in Italy). My background is not in law.
I was puzzled whether a psychiatric report ("perizia ...
- 143
1
vote
0
answers
63
views
Receive written confirmation about non-breached data
Context:
I am working for an institution which has recently suffered a data breach.
There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
- 153
1
vote
1
answer
99
views
Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR? [duplicate]
Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR?
Any help on this questions would be much appreciated!
- 13