Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0 votes
1 answer
49 views

Is "gossip surveillance" processing personal data under the GDPR?

The Guardian has an article on "gossip surveillance" where strangers report on social media private conversations they are not party to in the hope of exposing duplicity from the speakers in ...
User65535's user avatar
  • 5,880
0 votes
1 answer
181 views

Right to be forgotten on internet forums [closed]

I was recently tricked by an admin into getting booted off a forum of his where I had been active for years. This happened in a thread (my last) where this admin claims a number of things that are at ...
RJVB's user avatar
  • 109
2 votes
2 answers
118 views

Is it legal/appropriate to email a GDPR SAR to the executive team if that is the only email address the company provides?

This is prompted by this question but I am fairly sure I do not have the correct answer so I am making this one. My personal answer to "How do I get my data from company X under GDPR" is to ...
User65535's user avatar
  • 5,880
0 votes
1 answer
87 views

How to get user data from Foursquare/Swarm under GDPR?

Is there a way to download all my contributed check-in and reviews data from Foursquare/Swarm? The foursquare.com doesn't seem to have a way to log in with the old foursquare/swarm credentials. Isn't ...
ccpizza's user avatar
  • 101
-3 votes
0 answers
88 views

When running a dropshipping business, how can business owners protect customer data in accordance with GDPR?

In accordance with GDPR laws, how can dropshippers protect their customers' personal data when it's being sent to suppliers in countries that don't have data protection laws as strict as the EU?
northstar's user avatar
16 votes
2 answers
4k views

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
User65535's user avatar
  • 5,880
0 votes
1 answer
47 views

Which EU country's regulation is applied when doing direct marketing from country A to a legal or natural person in country B?

So I'm wondering which country's legislation is used when, for example, a company from Sweden would do electronic direct marketing to another company in, say, Germany. Assuming that Sweden and Germany ...
undefined's user avatar
0 votes
1 answer
132 views

What to do if a company starts sending abusive newsletters years after having asked them to stop? [closed]

Five years ago, I used my e-mail address once to buy a service from a company in the EU (so the GDPR applies). Since then, they subscribed me without asking to a newsletter and sent me several mails ...
Karlo's user avatar
  • 103
9 votes
1 answer
4k views

GDPR, online shopping and phone numbers for shipping - Is it legal?

Many webshops expect the phone number to be entered for shipping. My understanding of the GDPR is that you are not even allowed to ask information which is not absolutely needed for the given task. ...
armset's user avatar
  • 101
6 votes
2 answers
3k views

Are developers data processors?

This question is inspired by this other question: What are an employed/contracted software developer's responsibilities under the GDPR? I wanted to understand more precisely the concept of a data ...
User8's user avatar
  • 67
-2 votes
1 answer
116 views

Are deleted comments left by U.K. based users retained and subject to subject access under U.K. GDPR?

Meet Bob; Bob left some comments on a post on stack exchange and some over zealous moderators decided that they were not needed and so to delete them. Bob wishes to access these comments for the ...
Seeking answers's user avatar
0 votes
1 answer
53 views

Does GDPR require consent to collect non-personal information?

If a website never assigns a user a unique identifier, does the website need to get explicit consent from the user before collecting non-personal information? Examples of non-personal information that ...
Aaron Stanek's user avatar
1 vote
2 answers
179 views

What are an employed/contracted software developer's responsibilities under the GDPR?

This is prompted by this question but that is rather complicated by the technical details. Suppose the following hypothetical: Alice is a software developer for Bob Inc. perhaps as a normal employee, ...
User65535's user avatar
  • 5,880
3 votes
1 answer
92 views

Can one person's genetic information be another persons personal information?

In the UK GDPR ‘personal data’ is defined as: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one ...
User65535's user avatar
  • 5,880
4 votes
2 answers
3k views

If this has nothing to do with GDPR, is this acceptable legally?

I was advised to ask only one question per post. In my earlier post Does this action violate GDPR If a company is aware that a customer cannot provide a receipt, yet still requests their personal ...
Skies's user avatar
  • 348
1 vote
0 answers
26 views

Multi Domain Cookies Consent —Special Category Data

Can cross domain cookie consent be applied to government websites which collect special category data? Or is there any legal\policy guidance covering the use of multi domain cookies consent for the EU?...
NiallL's user avatar
  • 11
1 vote
1 answer
52 views

Cookie Consent: Do we require consent for login or user preferences?

I would like my web site to be as GDPR friendly as possible. I don’t make use of tracking, advertising or analytics. On a web site, we might have want to track the following: Login cookies — has this ...
Manngo's user avatar
  • 213
3 votes
2 answers
178 views

What rules determine jurisdiction on the internet?

It is in the news that Clearview AI has won an appeal against the UK Information Commissioner's Office (ICO). The reasons for judgment are here: Clearview AI Inc v The Information Commissioner [2023] ...
User65535's user avatar
  • 5,880
1 vote
1 answer
332 views

Does this action violate GDPR

If a company is aware that a customer cannot provide a receipt, yet still requests their personal information to facilitate a product exchange due to a defective item, but later denies the exchange ...
Skies's user avatar
  • 348
3 votes
0 answers
78 views

When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?

When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately? There exists an argument ...
GolDDranks's user avatar
-4 votes
1 answer
94 views

Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?

Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to ...
Seeking answers's user avatar
0 votes
0 answers
38 views

Is jigsaw identification enough to render a piece of information DPA-subject “personal data“? [duplicate]

In some legal contexts there is the notion of “jigsaw identification,” that is pieces of information that could allow certain people if adequately placed and privileged to other pieces of information ...
Seeking answers's user avatar
-2 votes
1 answer
81 views

Is changing my IP to test a website a violation of GDPR [closed]

My company is US based and we host and creates websites. Some websites are hosted in europe and some in the US, both are accessible to the EU though. We were wondering if for example there was a bug ...
Nasor c's user avatar
0 votes
1 answer
101 views

Are outward facing security cameras’ footage on the outside of ambassadorial missions subject to subject access rights?

Bob walks past the front entrance of the embassy of the republic of Zwakilostan which is somehow under diplomatic protocols Zwakilostani sovereign territory. The cameras point outside toward the road ...
Seeking answers's user avatar
10 votes
5 answers
4k views

Is scraping an iCal link legal?

TL;DR: my university says my app is illegal Since our university doesn't have a mobile app to check our schedules, I created one that does the following: Opens an embedded web browser (in app) and ...
Tom Vk's user avatar
  • 117
-1 votes
1 answer
74 views

Is it reasonable for a data controller to require proof of one’s address before honouring a subject’s right of access

Alice has requested access to her personal data from a shopkeeper. Barbara has submitted a SAR to a police force for BWV footage. They both require one item of identification and another for evidence ...
Seeking answers's user avatar
-7 votes
1 answer
87 views

Wat are the benfits of Temporal Tables for GDPR Compliance?

I am a software developer with some basic knowledge of the GDPR. I asked Chat GPT what the benefits are of temporal tables in SQL Server for GDPR Compliance. Is Chat GPT 4 right? And what could be ...
Daan's user avatar
  • 234
3 votes
1 answer
78 views

Can GDPR force public sector workers to fix an exploit they were notified of?

I live in some EU country and I rely on social security provided by the regional government. There is a website for residents who can sign up and claim benefits without physically visiting an office. ...
swq08570's user avatar
3 votes
2 answers
1k views

GDPR takedown request unsuccessful

I made the following request My name is _ I am a citizen of the EU. My email addresses are _ and _ In accordance with Article 17 of the GDPR I request you to erase all personal data that you hold ...
dranxo's user avatar
  • 139
1 vote
0 answers
88 views

Does the GDPR/data protection act contain any anti-reprisal provisions?

The Information Commissioner's Office ICO advisers state that one “shouldn't” be treated any directly or less favourably as a result of exercising one’s rights under the legislation. What legal ...
Seeking answers's user avatar
10 votes
2 answers
4k views

Is a "login timestamp" considered as personal data according to GDPR?

If software is saving the timestamp of the last login of a user, would that timestamp itself be considered personal data by GDPR?
Mr. Eivind's user avatar
2 votes
1 answer
331 views

GDPR and privacy policy compliance for software used internally by customer company

We are developing software that are sold to and used by other companies. In the software, certain types of personal data, like name, email and phone number, can be stored when a user registers. The ...
Mr. Eivind's user avatar
1 vote
2 answers
127 views

Are surveillance laws in EU member states necessary and proportionate? [closed]

On the 10th of July the EU Commission adopted a new adequacy decision, as a successor to the failed Safe Harbour and Privacy Shield agreements, to allow data transfers from the EU to the USA. The two ...
Eike Pierstorff's user avatar
2 votes
1 answer
53 views

Can legal/ pre-action correspondence with a business be subject to a SAR?

Bob has been harmed by a business ACME inc. He sends them a letter before claiming damages as under the pre action protocol. They send him a reply. Bob loses his copy of both of these articles of ...
Seeking answers's user avatar
16 votes
5 answers
7k views

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

On day one of my first year in high school me and basically every other students were given a few documents to sign. One of them included a clause that allowed the school to publish pictures of us ...
nz4387's user avatar
  • 161
0 votes
0 answers
67 views

how long might the regulatory action against Meta’s GDPR flouting take to play out?

Meta Inc is known to flout subject access request under the GDPR and numerous complaints have been lodged. What is the timeframe for these processes to play out? How does Facebook justify non-...
Seeking answers's user avatar
3 votes
1 answer
981 views

If website uses cookies only after users login, can I ask for cookie consent during account creation instead of website launch?

I have a website that uses cookies only if the user logs in. Is it necessary to show a cookie popup banner at website launch or can I ask for consent when user is creating an account (the standard I ...
Kamil's user avatar
  • 143
4 votes
1 answer
92 views

How can Standard Contractual Clauses overcome Schrems II?

My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
baarkerlounger's user avatar
-4 votes
4 answers
122 views

GDPR Privacy Policy - how to handle non standard cases without much budget

I want to market a little side hustle of mine and due to GDPR need to create some data privacy policy. Since as any reasonable developer I try to leverage the power of frameworks like Firebase, Stripe,...
TomFree's user avatar
  • 87
3 votes
1 answer
104 views

UK GDPR Transcribing calls

I'd like to understand the rules around automated transcribing calls in the UK, from a B2B perspective. GDPR seems quite clear that if you are recording calls, video and/or audio, you must get consent....
GooJ's user avatar
  • 133
8 votes
1 answer
3k views

Does GDPR apply when PII is already publicly available?

Pretend there is a website, it might be free to access, or be a paid per search service, where the users get access to summarised information on the people that they search for. All of the information ...
user5623335's user avatar
2 votes
1 answer
146 views

Is the usage of an OCR service causing copyright issues when a photo of a book page is analyzed?

Here's the scenario A user takes a photo using an app from a book, which might have be copyrighted. The app then uploads the photo to a cloud service in order to analyze it using OCR The app receives ...
HowlingCoder's user avatar
0 votes
3 answers
134 views

Using Sentry in an app targeting children below 13 years

We have created a children game using Unity and therein we use SentrySDK for automatic bug reporting. Since our app is targeting children under 13 years, we need to comply with COPPA GDPR Google's ...
mcExchange's user avatar
1 vote
0 answers
56 views

What information can insurance companies share with brokers?

I'm currently in the process of buying my first home, and have a mortgage broker helping me through the process. Our broker found us life insurance (to cover the cost of the mortgage) through a large ...
Chelsie Wright's user avatar
0 votes
0 answers
451 views

GDPR implications of email sent to a misconfigured host

I sent an email to a website's contact and my mailserver received this error: <...@...>: host ....mail.protection.outlook.com[104.47.70.110] said: 451 4.4.4 Mail received as unauthenticated, ...
Nemo's user avatar
  • 103
11 votes
5 answers
2k views

GDPR: Can a city request deletion of all personal data that uses a certain domain for logins?

A city in Finland asked me to delete all data for everyone whose login uses a certain domain. The domain contains "edu" in it and "oppilas" (which translates to "student")...
cesoid's user avatar
  • 211
1 vote
1 answer
115 views

SARing received text messages from a lost phone

Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received. Bob loses his phone but ...
Seeking answers's user avatar
4 votes
1 answer
89 views

gdpr: classification of a psychiatric report

I'm following a job-related course regarding data protection and the GDPR (European Union, I'm located in Italy). My background is not in law. I was puzzled whether a psychiatric report ("perizia ...
Gabriele's user avatar
  • 143
1 vote
0 answers
63 views

Receive written confirmation about non-breached data

Context: I am working for an institution which has recently suffered a data breach. There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
Vassilis Markos's user avatar
1 vote
1 answer
99 views

Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR? [duplicate]

Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR? Any help on this questions would be much appreciated!
fini-stair's user avatar

1
2 3 4 5
20