Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
482
questions
0
votes
2answers
14 views
GDPR - Storage and processing of student email addresses
I'm writing some software for use in a school. An essential function of the software is to email students using their school provided email account.
My question is, does GDPR apply to the storage and ...
0
votes
1answer
45 views
Does Article 27(1) of the GDPR apply to a U.S. controller using Google Analytics if it only sells to U.S. clients?
If a U.S. controller who only sells to U.S. clients uses Google Analytics on their website, would it be required to have a representative in the Union? I am unsure whether Google Analytics in this ...
2
votes
1answer
40 views
Who's liable for GDPR compliance when embedding/hosting a self-contained 3rd-party website/service?
I'm building a website for a client (a hotel) in Germany. In addition to a bunch of static pages, this website will also host a reservation system which is provided by a 3rd party software company in ...
9
votes
5answers
3k views
GDPR and right to provide meter readings
My energy company have estimated the opening meter readings for my move in date for a property.
I have the correct readings in photos taken on that date, but the energy company won't allow me to ...
5
votes
1answer
2k views
I have created an App to help isolated people in Corona Virus lockdown. Do GDPR rules apply
I have created an App at helpathome.me which isolated people can use to fill out a form and request help from others.
I innocently thought this would be fine but a friend told me that I must comply ...
1
vote
2answers
53 views
Reporting poor privacy practices in a mobile app
I found a vulnerability in a paid Smartphone app. It is supposed to contain a lot of private details.
There is a logging option for support that you can switch off and on, to extract the part that ...
0
votes
2answers
38 views
How to anonymize network data packets for commercial use?
I am working on a project where I have to identify anomalies in network traffic of business networks with machine learning. The algorithm is feeded with captured network packets from inside of the ...
2
votes
1answer
78 views
Online Proctoring, Exams, and the GDPR?
Due to the coronavirus outbreak, my university has tentatively canceled all live forms of live education, including exams. Instead, they have decided to hold exams through an online proctoring ...
0
votes
0answers
58 views
Facebook vs GDPR - Is Facebook never deleting the Searches you do?
I frequently delete the Search History from my account's Activity Log.
However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past.
Suggestions ...
1
vote
1answer
55 views
Subject Access Request (SAR) of data relating to cookies?
Take a search engine (e.g. Google), where user A can make searches without logging in with their account. The search engine collects, processes and stores, over time, a number of data about the user A,...
2
votes
1answer
783 views
Will storing hashed phone numbers violate GDPR?
I've read GDPR document from start to end, but I am still not sure about one thing.
Let's say I have a system where I store phone numbers in hashed form (let's say bcrypt).
Will this violate GDPR if ...
0
votes
1answer
33 views
Which article of the GDPR implies that one should use the BCC field in order not to dissiminate personal mail addresses?
Which article of the GDPR implies that one should use the BCC field in order not to dissiminate personal mail addresses when sending mails?
2
votes
1answer
36 views
How to obtain the legal basis for the processing of personal data from the controller?
If someone has not kept the information recieved under Article 13 or 14, then referring to which article he or she can obtain information about the legal basis for processing of personal data? I do ...
1
vote
1answer
41 views
Voicemail recordings and transcription email fall under GDPR
A client calls, leaves a voicemail with his name and number.
A vendor calls, leaves account information and address information. This call is also transcribed and sent via email.
The above are ...
0
votes
0answers
39 views
Is WhatsApp GDPR compliant as it allows backups for group chat?
Currently WhatsApp claims it uses end to end encryption.
However the app provisions users to switch on backups to Google Drive and other providers. So if I am in a group chat with a set of users and ...
0
votes
1answer
41 views
Does my own company also need to be EU-US Privacy Shield certified if we use AWS to store data of European customers?
We're based in United States. We understand that any sub-processor that we use should be EU-US Privacy Shield certified and GDPR compliant.
So, we can use AWS and Google Cloud. Both of them are EU-US ...
1
vote
2answers
86 views
GDPR: What is the legal situation on documenting cases of “Right to be forgotten” claims?
I wasnt able to find an explanation inside the GDPR whether a data privacy officer (or similar responsible) is allowed or required to document cases where individuals claimed the right to be forgotten....
1
vote
2answers
50 views
Laws and IP logging
Given I do not collect any personal data with an online service, at least IPs will be logged by the web server. An IP can be mapped to a person.
What I've read recently, with nginx for example you ...
1
vote
2answers
98 views
GDPR and CDN (content delivery networks)
I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content.
A CDN is, basically, a distributed network of servers. ...
1
vote
0answers
39 views
Corporate responsibility when allowing biometric authentication
At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for ...
0
votes
1answer
87 views
Is it legal to display user airline seat info on a public platform with absolute user consent
Planning a public platform to display user seating info after taking proper user consent , will that still attract legalities if user is ok with it , will it fall under any legal clauses under GDPR ...
0
votes
2answers
71 views
GDPR: can vendors accept core dumps or logs
As a software vendor, am I allowed to accept core dumps or application logs from my customers to investigate a crash or malfunction even though they most likely contain personally identifiable ...
2
votes
2answers
167 views
Is the UUID considered personal data?
I am planning to build a mobile platform which I would use the UUID as the username, and a password of user’s choice. So that users would just need to type a chosen password to use my services.
...
1
vote
0answers
36 views
Is Apple's default Privacy settings GDPR compliant?
I recently realized that some apps were able to "link" my identity to Facebook. I checked my off facebook activity and could see some apps that I've never given my email.
Investigating further, I ...
0
votes
1answer
63 views
Must the Privacy Policy be Included In-App, or is a Hyperlink Good Enough?
The title says it: I'm wondering if my company has to have a copy of our app's Privacy Policy included in the actual software package.
On the one hand, I could see a copy of the Policy being required,...
1
vote
2answers
71 views
Is storing business data considered personal data?
I want to create an online application. The visitor could enter his website URL then the application will make some analysis. The application asks the visitor if he wants a regular website report on e-...
0
votes
1answer
47 views
Is “Advanced Matching” of Facebook against GDPR?
I am wondering if sharing a hashed email or phone number with facebook with the purpose of matching that hashed value on Facebook's side is against GDPR? https://www.facebook.com/business/help/...
2
votes
1answer
178 views
Accidentally used “to” instead of using “bcc” while sending out email [GDPR violation]
I, as the admin of a small mailing group, used "to" field instead of "bcc" while sending an email to 10 people.
One out of the 10 emails turned out to wrong, and of a lawyer, who pointed out that we ...
1
vote
2answers
46 views
Where is the line between transactional vs marketing emails with GDPR?
If a company that offers a product where the user logs in, such as a SAAS product, and they send emails with certain intentions, where is the line drawn between a transactional and a marketing email?
...
2
votes
0answers
35 views
Cookie laws: Do I have to show a banner for technical cookies?
I am aware that technical cookies don't need consent, only marketing cookies need consent.
However, if my site only uses functional cookies, do I still have to display a cookie banner that says what ...
3
votes
1answer
46 views
Extraterritorial Scope of Brazil's LGPD
How can a national legislation, like the recent Brazil's LGPD apply to companies which are not established in Brazil, but may offer services to Brazilian citizens via the Internet?
Imagine a website (...
53
votes
4answers
19k views
Does GDPR include UK customers, or not anymore?
Now that Brexit happened, does GDPR include UK customers, or not anymore?
0
votes
0answers
20 views
Does my personal website GDPR compliant? [duplicate]
I made a basic chat website. Shows active users with nicknames or if not given nickname, random given name. There is no register or login I take users nickname and save it to cookies. Nickname can be ...
0
votes
0answers
15 views
Is a privacy policy required for storing user preferences?
I wanted to use localStorage (which I think technically counts as a cookie) to store a user's preferences in a simple web app. The stored data doesn't identify the user and is never sent to any sort ...
0
votes
0answers
21 views
Handling of names, emails, phone numbers and messages submitted through website forms under GDPR
I am developing a website for a one-man, Swedish, acupressure company. The site contains a contact form that requires the user to submit a name, email and message. It also contains a booking form that ...
0
votes
2answers
166 views
Institution can access my email (inbox/sent items/etc) and edit it?
First of all, I have thoroughly read the answers to the following questions and none of them answer my queries:
Can Google Chrome read/scan my ProtonMail inbox page?
Can my IT department read my ...
4
votes
3answers
211 views
Do I have a “legitimate interest” under GDPR to not delete data my software needs to fulfil its function?
The GDPR gives users the right to have their stored data deleted.
How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by ...
3
votes
1answer
76 views
GDPR - does a unique device identifier count as personal data?
I'm planning to sell my software online. The payment process is handled by a reseller (FastSpring), so the personal data collected (like the buyer's name and e-Mail address) is never stored on my ...
2
votes
0answers
41 views
How does the GDPR differ from national data protection law?
Before the GDPR came into effect, I had to deal with both the German Bundesdatenschutzgesetz and the Italian Codice in materia di dati personali, and recall them having very similar provisions (though ...
1
vote
2answers
62 views
Process IP address without GDPR consent
We are trying to log the location of our visitors, without storing their actual IP address on our servers.
To geolocate the IP address, we use an external service, to which we make an API request ...
0
votes
1answer
52 views
Cookie opt-in required on paid-for web-based software-as-a-service application?
Context:
We provide a paid-for web-based software-as-a-service application. This application requires users to register an account, and agree to our terms & conditions and privacy policy to be ...
-1
votes
2answers
87 views
What should I reply when someone ask about their GDPR information against a cold marketing email?
I recently received an email says "..please send me a GDPR information about all my data you have assigned to this email.."
I collect the email address from a public domain (say GitHub) and ...
0
votes
1answer
19 views
GDPR & CCPA compliance involving terms of service violation
If a user writes a comment on a website that gets flagged and removed+archived are we still obligated to delete the user content and/or the association of that comment with the person? According to ...
1
vote
1answer
82 views
Is it possible to create data subject to the GDPR without any involvement by the person in question?
Say I email a colleague, in a professional capacity:
I have been thinking about offering John Smith, who currently works at Big Corp, a job
John Smith has had no involvement with my organisation. ...
1
vote
0answers
32 views
Company acquired a website with existing users. Is GDPR announcement obligatory?
When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
24
votes
5answers
14k views
Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?
I have recently come across this part of an app from a well-known US company:
Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of ...
0
votes
0answers
49 views
Is WhatsApp legally obligated to remove my chat on every device, based on the GDPR? [duplicate]
Dear Law StackExchange community,
I'm attempting to get chat history removed with another party dating back a long time ago. I don't want the chats to remain existent on any device whatsoever, so I ...
0
votes
1answer
48 views
Which EU-related jurisdictions in Americas apply the GDPR regulation?
According to some information, a person will need to be a resident in an EU country in order to be protected by the GDPR regulation.
Are there jurisdictions in North or South America where residency ...
0
votes
1answer
44 views
Does GDPR disclosure apply to European citizen temporarily in United States?
For some background: the EU "[Data Protection Directive][1]" is a European Union directive which regulates the processing of personal data within the European Union, as explained in [this Wikipedia ...
0
votes
1answer
144 views
Right to be forgotten in US legal system. Practical approach for erasure?
As it commonly known, the right to be forgotten is a fundamental right in the modern informational society. It is the right of an individual to obtain erasure of his personal data from the online and ...
