Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

0
votes
0answers
10 views

GDPR the other way arround [duplicate]

Let's say that there is a site with a list of people that did one thing. Once with GDPR rules, those people can ask to be removed from that site. I was wondering if that site changes the way it makes ...
1
vote
1answer
13 views

Is information only about financial transactions personally identifiable in terms of GDPR?

I am creating application where you can manage your incomes/expenses e.g. on eBay. Main functionality is: create new item and specify price you've payed to get it set price that you've All other ...
4
votes
1answer
32 views

Should all gdpr related documents be translated to all official EU languages?

I wrote application localized in Ukrainian language , which is not one of the official European Union languages. Since I reside in the EU territory I need to comply with gdpr. This application is ...
3
votes
2answers
73 views

anonymisation/redaction of public website content as response to 'right to erasure'

An organisation runs some public email lists. These are archived, and the archives are also publically available from its website. A user of the mailing list asserts their "right to be forgotten" and ...
0
votes
1answer
33 views

Data Scraping public athlete name and performance data. Does this need to be treated as personal data?

Consider the following data for amateur/professional athletes: Athlete name, Athletic event + best performance data e.g.: Joe Bloggs 5k 19:00 10k 40:00 Half Marathon 85:00 other events etc... and ...
0
votes
0answers
17 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
0
votes
0answers
17 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
2
votes
1answer
19 views

Can DPO do an internal audit of information security according to ISO 27001?

In one company, due to GDPR, a DPO was designated, who was later given additional role and a new task: to conduct an internal audit of information security according to ISO 27001. Is there a conflict ...
1
vote
0answers
19 views

How to notify the use of cookies (Cookie Law Notice)

I have been investigating notifications about the use of cookies and a question has come up: Why 99.9% of websites do not report correctly about the use of cookies and nothing happens? With "...
2
votes
1answer
58 views

Do Bitcoin nodes need consent to store EU citizen's personal data?

The Bitcoin blockchain stores data about bitcoin users. This includes: There bitcoin address, which is linkable to their identity via blockchain analysis Transactions they have made This would seem ...
4
votes
1answer
41 views

Would revealing/storing whether or not an EU customer uses a service violate the GDPR?

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
0
votes
0answers
14 views

Storing 3rd party legal informations regarding giveaways - GDPR

Im planning to have a microservice that offers users an easy to use interface where they see legal informations of giveaways they've entered. The problem: The giveaway providers (im talking ...
2
votes
1answer
68 views

Can't GDPR compliance be trivially bypassed?

For large tech firms such as Facebook, at least, wouldn't it be a trivial matter for these companies to avoid EU GDPR compliance altogether? Many big companies don't actually "sell" any tangible ...
0
votes
0answers
10 views

Do you have to provide information about processing personal data for contact persons?

Two companies write a legal agreement between themselves and contain contact details of their representatives in its content. Assuming that these contact details are personal data, are these companies ...
0
votes
0answers
15 views

Does sending email with personal data require agreement with email provider under GDPR? [duplicate]

It's common practice to allow users of your service to get email notifications about interesting events. For example user Joe subscribes to notifications to email address joe@emailprovider.com about ...
0
votes
0answers
20 views

Cause of action for data processor where the data controller neglects to notify supervisory authority

By reading the GDPR I have gathered that a data processor is obligated to notify the data controller of a breach within 72 hours and the data controller is likewise obligated to notify the supervisory ...
2
votes
1answer
49 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
0
votes
1answer
36 views

Replication of user data a violation of GDPR

I'm in the planing staging of building game service provider, kind of like Xbox Live, PSN, Steam, etc. As far as I understand in the terms of the GDPR, information that can directly identify users ...
7
votes
1answer
63 views

Is it sufficient to provide a privacy policy only in english language?

Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language? Is a translation necessary for every country of the EU ...
1
vote
1answer
60 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
1
vote
1answer
66 views

In the EU, with GDPR in force, can a company refuse service if a customer doesn't want marketing emails?

I am having an argument with a local discount airline in the EU: They have been sending 3 up-sell emails for a single flight. Under GDPR, it is my right to revoke any consent to receive marketing ...
5
votes
1answer
89 views

Company makes confidential CV publicly available and searchable. Legal recourse?

A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
3
votes
1answer
52 views

Are artificially generated personal data covered by the GDPR?

According to Article 2(1) GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be ...
3
votes
2answers
38 views

Is this privacy statement from a solicitors in line with GDPR?

I'm in the process of buying a house and have paid for a survey to be done on the property. I have received a contract from the solicitor who will be conducting the survey for me and will provide me ...
1
vote
1answer
32 views

Do I need an active consent according to GDPR? [duplicate]

If I have a form on a website where people fill in their personal details and credit card information to subscribe to a monthly delivery of apples, do I need an active consent (e.g. checkbox) from the ...
4
votes
2answers
49 views

Does possesing BUT NOT processing a personal data make the organization their controller?

According to Article 4(7) of GDPR: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
1
vote
1answer
19 views

Responsible GDPR data protection authority (DPA) responsible for non-EU companies?

Article 15 EU GDPR is often cited as basis of what needs to be included in privacy policy. The data subject shall have the right to obtain from the controller confirmation as to whether or not ...
1
vote
1answer
71 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
1
vote
1answer
27 views

Can a data subject be asked to share a limited part of their data if it would be in their interest to do so?

I am an adviser for a UK agency that provides free advice to the public. I have two employment cases that differ in detail, but are fundamentally the same issues and involve the same company. It could ...
0
votes
1answer
70 views

Yahoo Messenger and the GDPR

Yahoo Messenger was was discontinued on December 1, 2018. On this date downloading of chat history was stopped. However they did not tell their users what happened to their data associated with Yahoo ...
3
votes
1answer
89 views

Was my GDPR request not complied with?

On the 12th of December I made a GDPR request to a major online retailer in the UK. While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
2
votes
1answer
61 views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
0
votes
0answers
27 views

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer ? Is above fundamental right's affected by Clauses in temporary employment contract like '...
0
votes
1answer
32 views

Does GDPR impose requirement for an EU based e-mail address?

Does GDPR impose requirement for an EU based e-mail address? I mean, not directly but indirectly for all practical purposes. Assume an EU based company having a public website. GDPR requires a ...
1
vote
1answer
24 views

GDPR article 20, portability of future data

Article 20.2 of the GDPR states: "In exercising his or her right to data portability [...], the data subject shall have the right to have the personal data transmitted directly from one controller to ...
0
votes
1answer
47 views

GDPR: How to respond to clinicians who ask for subject access requests for results to be made in writing

During a hospital stay, when requesting a copy of blood test results from doctors or nurses, unfortunately patients are often met with the response "Your request must be made in writing and must be ...
0
votes
0answers
8 views

GDPR: Transmitting results from secondary to primary care records

In the UK, results of a blood test taken at a hospital (in secondary care) are stored in the hospital's records but are not automatically forwarded into primary care records (GP records) unless this ...
1
vote
1answer
28 views

Does a website owner (data controller) have to disclose its data processors in its privacy policy?

A website owner is data controller. Most website owners are using web hosting companies, i.e. data processors. Each website owner must have a GDPR compliant privacy policy. Must each website owner ...
2
votes
2answers
93 views

Is a website OK with GDPR if it is not permitting the users to delete their posts?

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. Is it against the right to erasure mentioned here ...
0
votes
1answer
32 views

Emails from clients and GDPR

I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the ...
2
votes
1answer
50 views

Does my Personal Web App need to comply to GDPR?

I am building an app where I have some concerns about GDPR and user data. First of all this is a personal app, no company behind. What the app does: Allows a user to authenticate via e.g. ...
1
vote
1answer
39 views

Can GDPR violations lead to piercing of the corporate veil?

Does GDPR have any clauses that hint at piercing of the corporate veil? Can GDPR violations lead to piercing of the corporate veil?
2
votes
1answer
94 views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
1
vote
1answer
24 views

GDPR: Do I have to mention MailChimp in the privacy policy of a website if the registration form is only linked?

If I use MailChimp to send out newsletters and on my website I link to the registration form hosted on the MailChimp server, but don't embed it, do I need a MailChimp section in the privacy policy of ...
3
votes
1answer
42 views

Does GDPR apply to location data collected by apps?

I've just been reading this article in the New York Times which expounds on the business practices of mobile apps which collect your location data and use it/sell it. The article gives examples of ...
1
vote
1answer
32 views

Fee for Subject Access Request to GCHQ, Data Protection Act 2018

When making a Subject Access Request to GCHQ I was told that I would have to pay a fee for this Request. The GDPR does not allow for such a fee, while the UK Data Protection Act does(Part 4 – Chapter ...
0
votes
1answer
51 views

What is “disclosure by transmission”?

Article 4(2) GDPR states: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as ...
0
votes
1answer
42 views

How much can the GDPR be amended by EU member states in their national laws?

Citing article 8 of the GDPR (emphasis added): Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the ...
1
vote
0answers
81 views

GDPR: How does Airbnb get away with their signup form?

We're looking at making our signup form GDPR friendly along with sending users more timely, personalised marketing and account update emails. Asking if a user wants to receive all these different ...
0
votes
0answers
16 views

Changes to the privacy policy that require the user's consent: GDPR compliance

Suppose you have an online service, with a privacy policy that the users have accepted. Then at some point you want to introduce some changes to that privacy policy, in a way that requires the user's ...