Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
547
questions
0
votes
0answers
73 views
Is it illegal to refuse to fix a hacked website?
Suppose there's a website or a server that has been hacked. There is no personal data stored anywhere, so there hasn't been a real data breach, because basically there's no valuable data to steal at ...
0
votes
2answers
64 views
GDPR, PII, and UUIDs
GDPR states that
An individual is ‘identified’ or ‘identifiable’ if you can distinguish them from other individuals.
and also that
The GDPR provides a non-exhaustive list of identifiers, including:
...
-2
votes
0answers
38 views
Who can collect and process private and personal data? [closed]
I made a small social network and I would like to run it in my country (Slovakia, Europe). But I'm just an ordinary person, I have no business, no company, I don't even have a trade license. Just a ...
1
vote
0answers
38 views
What is the penalty for not respecting GDPR outside EU? [duplicate]
What happens when a newspaper website in USA or in Australia or in Japan does not comply with GDPR?
Can EU punish them in any way?
0
votes
1answer
27 views
What's the rationale for “joint controller” instead of keeping every entity doing stricly separate?
After reading Case C-40/17 and Case C-210/16 I still cannot figure out why GDPR would require "joint controller" decision.
Wouldn't it be much simpler to decide that e.g. in "Fashion ID&...
0
votes
1answer
42 views
Who needs to implement Cookie Consent for embedded content?
Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <iframe>...
2
votes
1answer
76 views
Right to personal data on youtube : what if account is banned
Since GDPR at least we have the right to access and get the data we generated on websites like Facebook or Google (our history, likes, almost everything).
My question is : what happens if Facebook or ...
1
vote
1answer
45 views
How does GDPR affect game data and how it is processed?
A real-time strategy game's data involving player points is available publicly (the point data is paired with their username). A player gains points through actions such as 'attacking' and 'building'.
...
0
votes
1answer
72 views
Online player nicks: personal data under GDPR?
We run a server for an old, open-source FPS game. The game collects match events that get logged, where the only information stored is player nicknames (changeable at will at any time by the players). ...
2
votes
1answer
127 views
Does sharing personal data publicly imply consent for collection and processing?
Suppose an EU citizen publishes their personal information, such as name and contact details online, for instance, on social media.
If I wanted to contact them in my professional capacity over email, ...
3
votes
2answers
93 views
What does “structured, commonly used and machine-readable format” look like in practice?
I have made a subject access request, and the result included:
Statement that their right to process data is from Article 6(1)(b)
A series of images, that appear to be photographs of a computer ...
2
votes
3answers
469 views
Does GDPR consent notification apply to access points intended purely for maintenance?
Suppose I have a publicly available interface, intended to be used exclusively by me or my employees for the purposes of maintenance, e.g. an SSH server.
Since I am processing user's IP address when ...
1
vote
1answer
59 views
Cookie consent compliance: disabling JavaScript and keyboard accessibility
I've noticed that most cookie consent solutions are JavaScript based, and when you have JS disabled, the cookie consent settings may not be accessible.
Speaking of accessibility, some cookie consent ...
1
vote
1answer
63 views
Do users who are given another user's email address have obligations under GDPR?
I have an app/website which connects people into groups and then the group performs work in the real world. That work in the real world will occasionally require that group members talk to each other. ...
1
vote
1answer
89 views
GDPR and global load balancing
Given the recent ruling in regards to the EU-US Privacy Shield and GDPR [1] would it still be possible to implement a global system with regional data sources? Specifically can you request a user ...
0
votes
0answers
41 views
Is Elementor Pro GDPR Compliant?
Elementor Pro (WordPress pagebuilder plugin) uses local storage which cannot be disabled. Something like this:
elementor:"{"__expiration":{},"pageViews":5,"sessions":...
0
votes
1answer
29 views
Can internet providers use navigation data for advertising / profiling?
My internet provider knows which sites I am connecting to (even if only the server names, when using https). Can they legally use that information for profiling / advertising? For instance, if they ...
0
votes
1answer
39 views
International Transfers to a Data Subject
A membership organisation based in the EEA receives membership applications from people based outside of the EEA, in countries which do not have an adequacy decision. During the course of the ...
0
votes
0answers
76 views
Private messages on social media - GDPR [duplicate]
As the title suggests, if you delete your account on social media/dating websites and there are personal/private chat messages there.
Under GDPR, would these have to be deleted by the controller?
So ...
0
votes
3answers
78 views
Is the user agent string considered personal data?
I have a website. I would like to store the user agent string, current time and opened url (not the IP address or something else) in a database for each page visit to be able to build some statistical ...
2
votes
3answers
92 views
Does the GDPR apply to the data subject's computers?
In this answer to a GDPR question about processing conducted by an app on the user's computer I wrote:
The GDPR only applies to data processed by you on your computer. Any processing that happens on ...
8
votes
2answers
2k views
GDPR & EPR regards maintaining email blacklist
Note a user call YIVI had previously stated that you could store a hash of the users email address to avoid the requirements of General Data Protection Regulation (GDRP) and ePrivacy Directive (EPD). ...
13
votes
1answer
2k views
Does the German GDPR require storing the data in a German datacenter for a tele-health company?
I co-founded a tele-health startup, we are expanding to Germany,
we have gone through the GDPR, and implemented most of it, however, we didn't quite understand the data residency part and found ...
1
vote
1answer
88 views
Does sharing a personal text conversation violate GDPR
I engaged in a text conversation over WhatsApp with another person, both of us in the EU, specifically Spain. I would now like to show a section of the texts to a party that would be affected by ...
0
votes
0answers
35 views
Is the Absence of Account deletion possibility legal in Europe? (GDPR)
This website explicitly states there is no easy way to "delete your account". It is accessible from within Europe.
How legal is this?
What would be my lever to force them to delete my ...
-1
votes
2answers
54 views
GDPR compliance - not an “adequacy decision” country [closed]
Our corporate website's server is located in a country that's considered not an “adequacy decision” country, according to GDPR.
I'm aware that GDPR allows that (under certain conditions). It's just I ...
-6
votes
1answer
108 views
painting of a child [closed]
I live in Europe. My wife's friend has made a painting of my wife and daughter.
The painting has been done from a photo, which my wife's friend, the painter, has taken. I did not have any idea about ...
3
votes
1answer
162 views
Are online retailers breaking EU/US law by using user's log-in information to charge different prices without explicitly notifying them?
I am aware that in most places firms are generally allowed to price discriminate, i.e. offer different prices for the same product to different customers based on personal characteristics. For example,...
1
vote
3answers
88 views
Is offline-only processing a “‘processing” as understood by GDPR?
GDPR, article 4, point (1) states:
‘processing’ means any operation or set of operations which is
performed on personal data or on sets of personal data, whether or not
by automated means, such as ...
6
votes
1answer
110 views
Can a company charge you to update your address under GDPR?
I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
4
votes
1answer
79 views
What is my responsibility related to GDPR as a Freelance developer
I'm a Software Engineer, and I've just taken my first "side gig" job in hopes of becoming Freelance one day. I'm based in the UK. My Client told me exactly what they want, and i've built it. ...
0
votes
2answers
67 views
Is it illegal to pre-check the email opt-in option for an html form?
Email opt-in and opt-out for online registration forms is subject to GDPR compliance rules.
However, I don't see any information out there about whether it is ok for an email opt-in checkbox to be pre-...
0
votes
0answers
48 views
If a user of my site gives me info of a third party they claim to be affiliated with, am I allowed to contact that third party to check?
I am developing an app where a part of the on-boarding process requires users to enter the email / company name of the agency that they are affiliated with (the 3rd party). I need to confirm that they ...
1
vote
1answer
71 views
Is it legal to post an email to social media if the email also contains a photo of the sender and other personal identifiable information?
I've seen a few similar questions asked before, however would posting a screenshot of an email onto social media be legal under the following circumstances:
The poster on social media is the ...
-1
votes
2answers
110 views
As an individual, not a company, if I collect email addresses of visitors to my website, what gdpr regulations apply to me?
I'm planning on making a website to act as a CV / portfolio of my work as a software developer. I intend to lock this personal data behind a token based access system, so that it isn't available ...
0
votes
1answer
37 views
Validity of automated GDPR subject access requests
If a software product was distributed that automated the creation and sending of GDPR subject access requests, do these request impose the same legal requirements on the data processor as if the ...
4
votes
2answers
463 views
GDPR: Is only a birthday personal identifiable information?
I wonder if only a birthday is seen as personal identifiable information according to the GDPR, so no usernames, passwords, emails, phone numbers are present in the system. Literally only a birthdate. ...
1
vote
1answer
52 views
Is storing only part(s) of an IP address compliant with the GDPR?
Let's say that ip address is something like xxx.52.114.191. Would be allowed to store into database 113.191? And let's say address is Nick Example, Some street 5, 33012 Florida, US. Would be allowed ...
1
vote
0answers
83 views
Is facebook in violation of CCPA if they don't delete all messenger messages when you delete your account?
It seems like Facebook won't delete your messages from the recipient's inbox when you delete your account. People send a lot of personal information in messages including their address, phone number, ...
-2
votes
2answers
39 views
Storing users data in database, which data is legal to store and how to store it?
I am developing a mobile application that will be pretty similar to Instagram. Now this app will be available for free and I will be offering it on the Stores as an individual not as a business. So ...
-1
votes
2answers
106 views
What legal conditions do I have to meet to open an open source website?
I'm working on a website for a pretty long time and in the close future I want to open it into the public. The problem is, my website collects personal data and cookies which (in my country - Poland) ...
0
votes
1answer
41 views
Is Google obliged to obtain consent for the processing of searches for anonymous searches under the GDPR?
If you do not register a personal account for Google, thereby not giving specific and informed consent for the processing of your personal data, are Google still obliged to obtain consent for the ...
3
votes
1answer
54 views
Why does Google require consent from users in order to process ads personalization data?
Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was ...
0
votes
1answer
36 views
What is the law regarding web/mobile applications and “personal” data?
I'm developing an application for mobile/web/desktop that will (in very watered down basic terms) store free text strings they've self-contributed and access them freely.
As it stands, these ...
0
votes
0answers
35 views
GDPR and contact tracing
Alice has a business relationship with Bob, which involves both keeping contact information and enough physical interaction to count as a contact. Charlie contacts Alice and requests Bobs contact ...
2
votes
1answer
44 views
GDPR/right of erasure and online marketplaces/payment platforms
I am in the early stages of designing an online marketplace platform for professional services. In the context of specifying what happens when a user hits the "delete account" button, I am considering ...
1
vote
1answer
62 views
GDPR - Personal data
I've read the definition of "personal data" and I still can't understand it clearly. For example I have a youtube account and create a comment, is this comment now considered my personal data? If that ...
1
vote
0answers
45 views
University diploma / various certificates under GDPR
Background: I'm considering building a web (focused to Europe) which, for one of it's part, would require users to upload their university diplomas and/or other similar certificates of achieved ...
1
vote
2answers
63 views
What consequences are there to ignoring GDPR rules as a non-EU entity?
If a non-EU entity ignores the GDPR rules, including not paying any fines they receive from not following them, what consequences are they subject to? Can a company simply decide to ignore GDPR rules ...
35
votes
2answers
5k views
How to store refusal of cookie consent
If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
