Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
411
questions
0
votes
1answer
13 views
Does creating an account or making a purchase apply consent for all marketing communications?
Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent.
For example, I created an account using my email and hired a bike from ...
0
votes
1answer
60 views
What can i do if my GDPR requests are being ignored?
I have requested my personal data removal from one shady company that has gotten to my email somehow.
They said they've complied, but i am still getting newsletters from them.
What can i do as a ...
2
votes
1answer
32 views
Data processing locations post-Brexit
I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients.
I have several UK-based clients, all ...
1
vote
1answer
38 views
Is sending log data + customer name + location compatible with data privacy and GDPR?
I've written an updater program. Our customer downloads it to update our software with database. It would be helpful if we would know who has already updated our software. For this purpose I've added ...
3
votes
1answer
44 views
Data deletion requirements
I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it.
I never ...
2
votes
2answers
59 views
Under GDPR, Is a Hashed URL Enough to Protect Customer Data?
Does a hashed URL (sent via email) provide enough security to safeguard customer data? For example, if we publish our customer data online with a hashed URL that we send to the customer (in other ...
1
vote
0answers
25 views
Is it obligatory to store ToS and Privacy Policy consent for a web app?
I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should".
So my ...
4
votes
1answer
100 views
Under GDPR can I avoid divulging a customer's data to the government?
Scenario:
A business has a legal requirement to obtain a license from a government agency relating to its business activities.
The business activities have already being undertaken and there is no ...
1
vote
1answer
42 views
does the GDPR apply to publicly available data?
There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little ...
1
vote
1answer
107 views
Can I sue a company for testing Captcha when unsubscribing from email?
With all the data protection stuff these days I was wondering if it is possible to sue a company for making a user pass a CAPTCHA test when unsubscribing from email.
I don't know the law surrounding ...
2
votes
1answer
34 views
Does GDPR affect personal projects with family data?
My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a ...
-4
votes
0answers
29 views
Is it legible to make a single request to get data report every day?
Can I expect by GDPR that I can require a company to send me my data every day, if it changes or gets sent anywhere?
-2
votes
1answer
65 views
Is a GDPR flashmob legal?
If users decide to run a viral laege scale flashmob to get their data in terms of GDPR from a company, is this procedure legal?
Like, competing who manages to make a request to inform about their ...
3
votes
1answer
74 views
A user has supplied personal information in an anonymous form. What is this information's status under GDPR?
I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form.
If a user includes personal information (e.g. their ...
17
votes
4answers
6k views
Under GDPR, can I give permission once to allow everyone to store and process my data?
If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
2
votes
0answers
53 views
Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?
From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
1
vote
1answer
60 views
Do I violate GDRP if install WhatsApp as a private user?
As far as I can understand, if I install WhatsApp, the app sends my contact list to the server.
Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
1
vote
1answer
32 views
Cookie expiration time per GDPR guidelines
I am working on a task that requires to set cookie expiry date to Jan 2038. This cookie is used for showing personalized content to end user e.g. If user is on Home page and he clicks on Business ...
2
votes
1answer
42 views
Can you request your personal data from a government agency under GDPR?
Can you address a request to a government agency (let's say for example the French "Ministry of education") to access the data they store about you under GDPR ?
Does GDPR requirements apply to states ...
1
vote
1answer
46 views
Can GDPR be used to reset an account?
I have an issue with AirBnb:
My account is something like 7-8 years old and I didn't use it for 6+ year.
I don't have the password anymore so I did a password reset, but it wants me to confirm my ...
0
votes
4answers
146 views
Data Protection Laws
Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/...
1
vote
3answers
59 views
Does GDPR apply to personal information entered in a password-field?
If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply?
For example if someone enters their email, phone number or name in a password-field? If so, ...
0
votes
2answers
70 views
Is a company still required to pay fines if the applicability of a law changes during the investigation?
This question was inspired by this question on Security.SE, regarding a data breach in a UK-based company.
In short, the data of a UK-based company was leaked by an US-based contractor. Since the UK ...
1
vote
1answer
76 views
Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications
I originally posted this on another Stack Exchange website but was advised this might be a better place for it. Original is here: https://security.stackexchange.com/questions/215300/is-it-ok-to-assume-...
1
vote
0answers
42 views
Replace User ID with pseudonym, still need consent?
I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy.
My goal is to avoid collecting any ...
0
votes
1answer
23 views
Does anonymised Google Analytics require positive opt-in under GDPR/PECR?
The EU defines personal data as:
‘personal data’ means any information relating to an identified or
identifiable natural person (‘data subject’); an identifiable natural
person is one who can ...
0
votes
1answer
24 views
Am I responsible of the personal data of a second degree user according to GDPR
Suppose we have an flight ticket booking system. As with many of these systems the account booking the ticket doesn't have to be the one using the ticket (i.e. you can book for someone else the ticket)...
4
votes
2answers
87 views
Opting out of cookies by emailing a company
Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than ...
-1
votes
1answer
60 views
Do I have to include a GDPR in my app even tho I don't collect data from users? [closed]
I have written an android app The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user?
Is is ...
0
votes
2answers
38 views
GDPR Information and consent
I am building a game that stores score/level on the local device and uses non-personalized AdMob.
Do I need to inform the user about storing the score locally?
Do I need consent for using non-...
0
votes
0answers
19 views
Application of the GDPR to emails one has sent [duplicate]
Reading https://gdpr-info.eu/issues/personal-data/, it seems you could use the GDPR for, well, unexpected request. For example, if I ask Google to remove any email from me I have send, not only from ...
1
vote
1answer
85 views
Can I use GDPR to read an Airbnb review about me before I post mine?
I just had a bad experience with Airbnb. The circumstances would be too long to describe and not relevant to my question. The fact is that I just have had an email that the host (I am the guest) let ...
10
votes
1answer
2k views
GDPR Compliance - notification of data breach
In Art. 33, the GDPR specifies that a controller must notify a personal data breach to the supervisory authority after having become aware of it.
Case 1: A database dump with personal data is hosted ...
0
votes
1answer
53 views
Allowing access to data before employment
If a company wishes to allow access to their system (e.g a new manager to view HR records, salary etc) before their employment start date, does this break any privacy, GDPR laws etc?
Lets say they ...
0
votes
2answers
46 views
GDPR - Service storing other people's clients' emails
I am working on a service that allows people to import data regarding their sales within a particular platform.
This data is imported in an excel format (CSV) and contains all sales informations for a ...
1
vote
1answer
40 views
Google Analytics on mobile: possible to use without consent?
I saw this thread where it's possible to use Google Analytics without consent on websites:
Is it really possible to use Google Analytics without consent, and if so, why exactly?
My question is: does ...
1
vote
2answers
99 views
Does GDPR's physical address rule apply to my real world hobby art group?
I run an art group (in the UK) that meets up every other month to give feedback on each others' work. To share the meeting dates and to share the work we're giving feedback on that month, I have an ...
-1
votes
1answer
40 views
Is there a proper lexicon for legal documents? [closed]
My apologies in advance for such a childish manner of asking a question here. If it deserves a downvote - go ahead. Yet for me it is that simple, but so lethal.
As far as we all human beings, I am ...
1
vote
1answer
74 views
Is it illegal to state in your website that an employee of a company emailed you?
I have an open source project regarding software used in banking and I have received emails about it from employees working in top banks/consultancies.
I am considering to mention this in the website,...
3
votes
1answer
50 views
GDPR: Transfer (chapter V)
I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web ...
1
vote
1answer
66 views
GDPR: Can I collect non-personally identifiable information?
I'm creating a game that collects data in two ways: Unity Analytics for usage stats, and bug reports that sends me a report of an issue along with several files to help me diagnose the issue. However, ...
3
votes
2answers
42 views
GDPR - am I the processor if I don't host the website?
I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase ...
17
votes
1answer
3k views
GDPR rights when subject dies; does family inherit subject rights?
Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.).
What if the subject is deceased? Does the widow/widower or do the children ...
0
votes
1answer
80 views
Is deterministic anonymization of test data ok?
Deterministic anonymization of test data?
When anonymizing multiple data sources and preserving data consistency we usually end up with a mapping table for "real to anonymized" values. Typically ...
-1
votes
1answer
68 views
Is identification of an employee by another employee restricted by GDPR? [closed]
Does GDPR require anonymization of user idents when used in testing and development?
User idents will identify an employee by other employees because it's linked to login system. Outside of the ...
3
votes
1answer
97 views
Under GDPR, why is google not considering the index entries as personal data?
I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling.
Following this, I make the assumption that this qualifies as personal data under GDPR ...
3
votes
1answer
52 views
Do I need user consent to respond to their email sent through my website's contact form?
I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message.
I'm not storing any of the data in a database or in cookies.
When the user ...
2
votes
2answers
58 views
Under GDPR, are service operators allowed to record all clicks of logged in users?
Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either:
The user consents to having ...
-2
votes
2answers
81 views
GDPR no opt out option [closed]
Is it legal if we do not offer an explicit opt-out option in our app for non-persnonal data collection?
We planned to explain to the user what data we collect and at the bottom of the screen there ...
3
votes
2answers
111 views
Do default Apache logs violate the GDPR?
Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
