Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0 votes
1 answer
80 views

Are javascript keyloggers on websites legal?

I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
user avatar
  • 1,245
0 votes
0 answers
68 views

Self-set needs-based salary

Is it legal, in regard to GDPR and Norwegian/European law, for an employer to ask their employees to List their yearly monetary needs Present their needs, to management for approval Set their salary ...
user avatar
  • 101
2 votes
2 answers
52 views

Limits of automated decision making WRT workplace surveys

As part of the GDPR, if personal data is used for automated decision making a number of rules apply, particularly regarding consent and access to data. A number of companies offer workplace surveys, ...
user avatar
  • 1,245
3 votes
1 answer
42 views

UK - Privacy Policy requirements for website with no tracking

Essentially I run a website which is a microblog for anyone to use. The user who creates the content does so on one domain which requires login, stores a cookie etc.. The reader (user) of the blog ...
user avatar
0 votes
1 answer
47 views

My previous employer had a data breach

It seems my bank account details. Passport information. Address etc have been leaked. I left the company 3 years and 4 months ago. It’s a private law firm. They have offered me a 12 month credit ...
user avatar
10 votes
2 answers
3k views

Can I store the names of arbitrary business associates in my CRM system?

I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships. For example, "Gina works on reception." Is this allowed ...
user avatar
1 vote
1 answer
46 views

Collecting statistics from online gaming and GDPR obligations

I am looking to to build an interface within a sandbox pc game environment that will allow for the collection of tabletop wargaming game stats in addition to player online ID(steam name). This data ...
user avatar
1 vote
1 answer
73 views

Is it possible to send an additional email to people who didn't confirm their subscription?

We are wondering if we can send another email to people who subscribed to our newsletter but never clicked on the confirmation link sent afterwards. Is it ok GDPR-wise?
user avatar
0 votes
1 answer
29 views

should a website show cookies popup in following context?

I am a part of developers team in a software as service project hosted and HQ-ed in United States. Why I asking my question I personally tasked to improve our analytics and one of tasks is to find an ...
user avatar
0 votes
3 answers
76 views

Is there any restriction in the GDPR on creating a Whatsapp group?

I work with an assistance entity that helps people in situations of social vulnerability (poverty). Surprisingly everyone has a cell phone and uses Whatsapp. Taking this facility into account, I ...
user avatar
0 votes
2 answers
71 views

Is it possible to receive copy of deleted facebook messenger messages under GDPR?

Is it possible to receive copy of deleted private facebook messenger messages under GDPR if two recipients deleted them?
user avatar
-1 votes
1 answer
103 views

Where is it stated in the GDPR that the GDPR only applies to EU citizens?

I recently came to the shocking realization that the GDPR does not apply to natural persons who are not EU citizens. I looked up the GDPR to find the Article or GDPR item that mentions this but could ...
user avatar
  • 109
1 vote
1 answer
41 views

Does an email hop in the US count as an international data transfer?

Alice is a data subject, Bob Inc. is a data controller processing her PII, both located in the UK. In responding to a subject access request, Bob Inc. sends some PII in plain text in an email. ...
user avatar
  • 1,245
0 votes
2 answers
47 views

Is Browser-Fingerprinting legal when I transfer/ store only the hash of user related attributes?

Is the following pseudo code, being executed within the browser, compatible with GDPR? sha256(fonts + useragent + plugins + ..) Notice: It doesnt store the actual attributes on the server, only the ...
user avatar
0 votes
1 answer
74 views

Does the GDPR apply to reference managers?

Reference managers are software products that record the details of scientific papers that one interacts with. All academics and many others use them as a crucial tool of their work. Common examples ...
user avatar
  • 1,245
1 vote
1 answer
74 views

Is my name and email address being sent to another customer a GDPR violation?

An agency, to which I provided my personal email address (contains my full name), has emailed me and another of their customers (both emails in "TO" field). The other customer and I have ...
user avatar
  • 153
1 vote
2 answers
40 views

Under The EU General Data Protection Regulation (GDPR,) do I need a legal obligation in order to divulge information to law enforcement?

Suppose I get a request from a law enforcement agency, for data that I'm already processing legally. Can I just give the information to the agency, or do I need to verify that I am under a legal ...
user avatar
  • 2,340
22 votes
2 answers
3k views

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
user avatar
  • 231
3 votes
1 answer
82 views

Trans-Atlantic Data Privacy Framework - defined national security objectives

According to this release from the White House they state: the United States is to put in place new safeguards to ensure that signals surveillance activities are necessary and proportionate in the ...
user avatar
2 votes
1 answer
61 views

Does the GDPR cover reference to court proceedings?

On this site many good answers are referenced by real court cases, usually in the form Surname vs. Surname [date] <link to further details>. There also exist documents (example is US so as not ...
user avatar
  • 1,245
3 votes
1 answer
89 views

Do sites need to explicitly ask for cookie consent as of 2022?

I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the ...
user avatar
13 votes
2 answers
2k views

Does the Companies Act 2006 trump an individual's right to be forgotten?

I once was a contractor and ran a limited company. At the time all my details and my secretary's were published on the Companies House website. edit: This information includes full names and addresses....
user avatar
  • 241
1 vote
2 answers
78 views

Penalties for requesting GDPR data you are not entitled to

Looking at Accessing public CCTV footage about you I could see a scenario where a stalker might request GDPR data & footage on a person they are stalking who has passed the camera. So, imagine ...
user avatar
  • 121
1 vote
2 answers
2k views

How does the personal/household activity exemption not apply to domestic CCTV pointed to the street?

I am surprised to learn that, in the UK, private/domestic CCTV cameras pointed to the public street make the owner GDPR controller — with all the consequences like having to respond to data requests ...
user avatar
  • 19.8k
29 votes
2 answers
5k views

Accessing public CCTV footage about you

Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
user avatar
1 vote
1 answer
69 views

If one requests bodycam footage of a police encounter involving another person, would they be notified of the request?

If party A calls the police on party B and they attend, then party B is entitled to request the bodycam footage of the encounter under the GDPR. If party B performs such a request, and party A appears ...
user avatar
  • 817
1 vote
2 answers
46 views

Do EU GDPR demands on a web hosting service extend to its clients?

If a web hosting service like GoDaddy or Wordpress.com is subject to GDPR, does it require they impose GDPR requirements on their clients? Does it matter whether the client is subject to the GDPR or ...
user avatar
  • 357
1 vote
1 answer
62 views

Is it ok to use slack in EU without data residency option?

Since you can only setup Slack data residency in EU on the most expensive plans, is it ok to use their service still under GDPR rules without that option? Would signing a DPA stating they are ...
user avatar
1 vote
1 answer
62 views

GDPR: Storing consent for non-personal data cookie

According to GDPR you need to store information about consent given to using cookies. We don't process any personal data, but we place an analytic cookie (to recognize returning visitors) so we need ...
user avatar
  • 111
2 votes
1 answer
90 views

Is posting another persons PI on social media a GDPR violation?

If Alice posts Bobinators private information like full name and address on a Facebook group, in an attempt to warn others of bad experience with him, is it a GDPR violation? Does it matter if a group ...
user avatar
  • 143
0 votes
1 answer
68 views

What are the limits of ID requirements for a subject access request?

When one makes a subject access request it is required that the data controller is required to ensure the identity of the requestor, to prevent unauthorised individuals accessing personal data of ...
user avatar
  • 1,245
2 votes
1 answer
582 views

Does the IP logging + user data apply to GDPR?

I read a lot about logging IP addresses, and it applies to GDPR: Do default Apache logs violate the GDPR? How to satisfy GDPR's consent requirement for IP logging? My question is slightly ...
user avatar
2 votes
1 answer
97 views

Is MailChimp compliant with GDPR?

In light of recent news of Facebook not being compliant with GDPR because it processes data in USA and not in europe, would a website using MailChimp for newsletter be GDPR compliant since it is based ...
user avatar
  • 143
1 vote
3 answers
96 views

How to avoid having problem with data protection regulations (GDPR)?

I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by ...
user avatar
0 votes
1 answer
55 views

What global big tech does to comply with data protection laws all over the world?

Give this scenario... A user in Germany, a user in US. Each one decides to create an account on Facebook and facebook is located in US... According with GDPR, US cannot store data from EU Citizens. So,...
user avatar
  • 111
0 votes
1 answer
36 views

What is the correct responce of a data processor to a SAR if they have multiple controllers?

In the case where a subjects data handled both by a data controller and a data processor, and the subject makes a data subject access request (SAR) of the processor the usual procedure if for the data ...
user avatar
  • 1,245
1 vote
1 answer
29 views

What references are available for the GDPR legitimate interests balancing test?

A basis for the processing of personally identifiable data (PII) is legitimate interest. According to the UK ICO data controllers who rely on this basis should conduct a legitimate interests ...
user avatar
  • 837
0 votes
1 answer
51 views

How does GDPR Art. 14 apply to large scale B2B data transfer

Article 14 of the GDPR appears to require any data controller to inform the data subject when a business to business transfer of personal data occurs. Business to business transfer of personal data ...
user avatar
  • 1,245
3 votes
1 answer
63 views

Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever

I have a small static personal website, where I publish some technical articles and my personal CV. Do I need to include a privacy-policy if: There are no (third- or first party) tracking services ...
user avatar
  • 33
1 vote
1 answer
61 views

Under GDPR can a company give out the demographics of employees e.g. ethnic background without anonymising it?

If a client asks for the demographics of a company's employees e.g. female to male ratio or ethnicity. Does this have to be anonymised so it is compliant with the GDPR or can the names be revealed?
user avatar
  • 231
2 votes
1 answer
77 views

Can I use forum posts related to user to analyze them?

I would like to create an app, which would make analyses based on user behaviors, posts, comments. I can gather those data from sites, forums because e.g twitter and so are public websites, they are ...
user avatar
  • 123
3 votes
1 answer
103 views

Does failure to provide photo of face count as breach of GDPR in UK?

I have requested that an aesthetic clinic send me the 'before' images taken of my face before a procedure two times via email. They have ignored my requests while responding to other questions in the ...
user avatar
3 votes
1 answer
44 views

"Destiny" of issued certificates after account deletion

Lets say I have a online-training platform where I issue "completion certificates" to users who complete the course (like Udemy, Coursera, etc.). One day a user wants to delete their account....
user avatar
0 votes
1 answer
58 views

Is GDPR consent as part of Terms & Conditions valid?

In the terms and conditions of the kite festival consent for use of footage of the audience is written into the Terms & Conditions: 5.c: Ticket Holders consent to being photographed, filmed and ...
user avatar
  • 1,245
1 vote
1 answer
182 views

Is it obligatory to make my name and address known publicly in compliance with Art 13 GDPR?

I'm a private individual. I live in EU. I'd like to create a personal blog on blogger.com and put there Google AdSense advertisements. Do I have to state there also publicly my given name, surname, ...
user avatar
2 votes
1 answer
81 views

A scholarship organization is publishing my personal information on their website

In February 2018, I received a one-time scholarship (1000 €) from a private association in the EU. A few months ago, I noticed the organization published on their website private information of the ...
user avatar
  • 21
1 vote
1 answer
46 views

GDPR (and data protection laws in general) in regard to non-commercial, personal database

(this is the closest StackExchange site I could find, even so, I'm sorry if the Q is still a bit out of place). So, I've just finished building an application for better handling some of my needs and ...
user avatar
1 vote
2 answers
148 views

Is blocking third-party phone numbers GDPR-compliant?

To be compliant with GDPR you have to process phone numbers as personal data. Suppose there is a service which users can subscribe to in order to block calls from numbers which the users nominate. The ...
user avatar
12 votes
5 answers
4k views

How can I get more than 10 years of transaction history from my bank?

I will shamefully admit that it was only in the year 2021 that I finally built my own bookkeeping system. Yes, I should have done it 10-20 years ago, but I didn't. So now I'm in this situation: First ...
user avatar
  • 147
0 votes
3 answers
55 views

GDPR - access to transaction data

Is it within my rights as a user of a payment service like Paypal or Western Union, to ask for the full details of a transaction that I did (namely the card number of the recipient) ? edited : bank ...
user avatar

1
2 3 4 5
16