Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
712
questions
1
vote
2answers
126 views
A salt hashed with user password is anonymous data for GDPR?
I want to use a scheme to track the user in a anonymous way. My idea is to use the user password to hash a salt to create a identify hash and track the user through this. Theoretically, the only way ...
2
votes
1answer
61 views
Do I need to ask an Android user to opt-into push notifications as per GDPR?
On Android, we do not need to explicitly ask a user to opt into push notifications. They are presumed to be opted in and can manually opt out. This is different from iOS where users must explicitly ...
0
votes
1answer
129 views
Can you legally use eye tracking on your website?
If user visits your website, can you legally use their camera to track where they are looking at and then transform this data to heatmaps? If yes, under what circumstances?
Our company created a web ...
8
votes
1answer
3k views
Is storing records of chess games a violation of GDPR?
Many amateur chess players store the notations of their games in electronic format (like pgn) so that they can later reference the game for analytical and historical reasons. Information in this file ...
0
votes
2answers
42 views
How to handle account deletion of user with financial information and/or otherwise liability related information
So, I read a post on reddit the other day about a user unhappy with Binance (crypto currency exchange company) for only being able to "disable" his account but not "delete" it.
...
-1
votes
2answers
85 views
Under GDPR's strict consent requirement rules, could a criminal/hacker/troll remain anonymous in all his activities?
Since GDPR strictly requires consent to Personal Identifiable Information (PII), could a criminal exploit online services by remaining anonymous in all his criminal activities?
Providers are not ...
12
votes
5answers
4k views
Does the law give provisions for well known service providers to deny service if users don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
1
vote
1answer
60 views
Can you opt out of use of your personal information by your country's registry?
I was changing my address a week ago and I noticed that it said in tiny letters that the information I provide may be used for direct advertising, marketting, scientific research, data collection and &...
2
votes
1answer
65 views
Count visitor per day with GDPR & Cookies in EU
My question is: how is it possible calculate visitors per day without gathering some information about the users in order to be able to identify them as revisits?
We have a cookie consent banner in ...
2
votes
1answer
108 views
Can you preemptively check local storage before user agrees under Cookie Law?
I am pretty new to the idea of asking for consent for storage for a website because I'm American. I understand that if I want to store anything, I need to ask users for consent.
However, I'm confused ...
-2
votes
1answer
97 views
Is this Cookie scenario GDPR compliant?
I noticed that many websites, including StackExchange websites just have a banner while full functionality is provided by the website, which is probably not GDPR compliant. Is this true?
As far as I ...
2
votes
1answer
47 views
Date Privacy and Twitch; Do I have the right to access my chat logs?
Under Data Privacy laws, the user has a right to access their data, erasure, etc. Yet under Twitch the users have no way to access their own logs, only the streamer and a team of mods.
This has always ...
0
votes
1answer
37 views
GDPR Compliance - Password Protected Documents in AutoRecovery
I'm working with personnel data in my job, including lots of details which I know to be sensitive and most certainly covered by GDPR.
In order to maintain compliance with the regulations while ...
3
votes
1answer
57 views
Site user posts data under licnese, can user demand erasure?
Suppose that a site, run as a free service, allows communication between users (a chat site). Suppose that the site also permits users to optionally upload text documents or images, which will be ...
-1
votes
2answers
231 views
Is Apple scanning user content for child abuse a violation of GDPR?
According to this article Apple is scanning all the photos users have on their devices to detect possible child abuse. The article explains that a NeuralHash of each image will be uploaded to Apple ...
0
votes
1answer
69 views
May I publish source code of my project without notifications about use of personal data and cookies and not break laws during it?
I have created the demo software project (frontend and backend modules) for manage staff. I want to publish source code of the project on GitHub. I know that according to GPDR page must have ...
0
votes
2answers
79 views
The Right to be Forgotten: can it be used to hide past public (news) information?
In the EU there is a "Right to be forgotten" This was created by Directive 95/46/EC in 2012 as a right to insist that search engines not link to personal data, and subsumed into tech "...
1
vote
1answer
97 views
Are firm's vendors liable in case the firm deliberately and openly shuns GDPR compliance?
This is hypothetical and it's only meant to ask about the extent of the law, not ask for a particular legal advice.
Let's say a US merchant's website uses exclusively regional US banks. Because they ...
12
votes
1answer
855 views
Is an email enumeration vulnerability a breach of GDPR?
I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows:
User inputs their email
If the email belongs to an existing user, ...
5
votes
1answer
2k views
Is this a valid approach to ask consent under GDPR?
I'm trying to figure out the best way to gather user consent to use third-party services in a mobile app for users under the GDPR. Let's say that I have an app that uses third party services (...
0
votes
1answer
109 views
Can you track those who denied tracking on a website?
I'm coordinating a website project where we are implementing Analytics and a GDPR compliant Cookie Banner. I was asked if we had a way to track how many users have declined analytics in case we needed ...
1
vote
1answer
35 views
DSGVO: Saving adress data
According to GDPR (DSGVO in germany), would it be allowed to save an adress without a name of the person?
Would it also be allowed to do the same with a hash of the persons name? The name of the ...
8
votes
2answers
2k views
Are there ways of storing personal data beyond standard GDPR limitations?
So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data.
...
0
votes
1answer
79 views
Is Google's Consent Management Platform not GDPR compliant since it does not show a consent form when 'personalised ads' are disabled?
This question borders the line between technical and legal but I am posting here because it is not a coding problem in itself. Apologies if this is the wrong forum.
I have set up my mobile app to use ...
2
votes
2answers
102 views
Would a VPN user still be under GDPR protection?
I got a client that wants to remove the 'GDPR please accept our cookies' banner when the user is NOT in the EU. (Its an NA based company)
So the way we could do it, with PHP, would be to check the IP ...
7
votes
2answers
1k views
Do I still need to check if users are inside of EEA/UK for GDPR consent if my Android app is ONLY released in countries outside of EEA/UK?
Example:
A US user downloads the Android app from the US Google Play Store
The user does not view any consent form and begins using the app and viewing ads
The user then travels to EEA/UK and ...
4
votes
1answer
471 views
Should registered users accept cookie consent in GDPR?
I want to use cookie consent for saving user language, currency and affiliate marketing purpose.
Can I store data without consent of the registered users? They are registered so do I need to take ...
0
votes
1answer
30 views
Responsibilities and GDPR reporting in case of hacked email marketing platforms
Company A allows subscription to its newlsletter via email, and their email list and newsletter is taken care of by company X. So A is hosting the page where one can subscribe, X handles list and list ...
2
votes
2answers
84 views
Is it legal to process PII in EU of customers which are not in EU?
So I have an app that processes the PII of users and their interests, the app is south Asia based. The app doesn't support EU customers and is geo-blocked by default.
I would like to process and store ...
1
vote
1answer
82 views
How long can a company take to answer my GDPR request to download my data?
In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be ...
1
vote
1answer
50 views
Is email verification required before asking users to enter personal details? GDPR-related
Is email verification step required before asking users to enter personal details?
A bit lost in GDPR documents.
Should contract between user and the app be signed (via phone number + sms or email + ...
1
vote
0answers
37 views
Data representatives in EU, UK, Switzerland - are there more countries requiring this?
The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
4
votes
1answer
84 views
Are there privacy laws other than GDPR which consider IP addresses as personal data?
In EU's GDPR the IP address is considered personal data (lots of discussions about it, but this seems to be the correct interpretation at the moment). Several countries have now privacy laws which are ...
2
votes
1answer
92 views
Is the Vilnius-Lublin portal a violation of GDPR?
Don’t get me wrong, I love it!
But is it GDPR compliant given that people walk up to a camera that will broadcast their image outside of their country?
See also this news story and this one
0
votes
1answer
67 views
The Data ownership for an automated server running for years prior to GDPR Regulations
Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various ...
2
votes
2answers
117 views
The scope of GDPR and the right to be forgotten
I have three doubts about GDPR compliance in modern systems, specifically about the "Right to be forgotten" section in the GDPR.
What I would really like to understand is whether the right ...
0
votes
1answer
55 views
Can a pre-ticked checkbox be used to RECALL/REVOKE consent under GDPR and/or ePrivacy/cookie law?
I wonder, can a pre-ticked checkbox be used to recall/revoke consent, or does revoking/recalling consent need to be a separate, explicit action?
I have made a specific consent function like this:
When ...
8
votes
2answers
2k views
Does The "Right To Be Forgotten" Include Sent Emails?
Say that you maintain an email service, and person A, sends an email to person B who is also on your email service. If person A deletes their account would that mean that person B no longer can view ...
0
votes
1answer
94 views
Is there any chance of getting a penalty for cookies with no notification for a private person with small site?
I am planning a small demo application using DRF and when using the DRF web interface csrftoken cookies are saved by default. After reading tons of material about GDPR and cookies I completely disable ...
1
vote
1answer
146 views
Impact of GDPR on remote work outside of the EU (as LLC)?
I do remote work for clients in the EU. The legal foundation is a B2B contract between two EU legal entities, one of which is the client's limited company, the other my limited company. Since both ...
0
votes
1answer
87 views
GDPR - Are the typical lists of examples for personal data misleading?
Article 4 of the EU GDPR states
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);
The explanation for the term ‘personal data’ as
...
0
votes
1answer
98 views
Identifying attackers and GDPR. In which cases is it legal?
Various techniques can be used to identify stalkers, malicious hackers et al. that are either gathering data for their target or use the target's digital items without consent.
Canary files
They are '...
0
votes
0answers
51 views
Is securely storing and using customer credentials and passwords in customer-commissioned software GDPR compliant?
My team is in charge of developing integration software for our customers. The customer integrates their system with our platform in order to use our services.
Numerous customers avoid managing their ...
5
votes
1answer
947 views
Talent consent withdrawal in film in Europe
Consider the following scenario of right to erasure in film-making in Europe. Person A makes amateur live-action films, for example theater performances. Person B is in one of those performances and ...
1
vote
1answer
52 views
What laws should I be aware of if I were to start a business scraping profile content from a website and using this content to build another website? [closed]
The idea is to build websites for people (in the UK (at least to start with)) using content that they have uploaded to another website. I will cold-call them, ask them if they would like a website and ...
0
votes
1answer
84 views
Legal obligations of a company in case of GDPR-related vulnerability
First of all I would like to state that my question occurs in a context of EU laws and EU citizen.
I found a vulnerability in a product distributed in a few companies of EU countries. This ...
1
vote
2answers
83 views
Privacy and GDPR on Facebook
I have a doubt regarding the privacy on Facebook and the law application.
Also lawyers That I have spoken with, seem not very sure about the matter.
In particular I would like to know if it is my ...
4
votes
2answers
828 views
If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?
I used to work for a company, where they have a team of moderators, who actively monitor which accounts are scammers etc. To monitor this they can find links between user accounts via a users password,...
2
votes
1answer
38 views
What are the limits of service provision/PII consent for compliance with GDPR?
Most of the internet business model can be described as providing data in exchange for seeing adverts. These adverts are worth a lot more if they can be targeted. The GDPR applies to this, such that ...
1
vote
1answer
63 views
Is it GDPR compliant to hide a competition entry behind a requirement to sign up to a newsletter
I'm looking to run a giveaway competition on my website. The main aim of the competition is to get signups to our email newsletter. I'm therefore proposing that 1. a user signs up to my newsletter (...
