Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0 votes
0 answers
48 views

What is the legality and consequence of blocking one who submits a SAR? [duplicate]

Alice submits a subject access request to Bob via WhatsApp, Bob responds to this by blocking Alice, but otherwise ignores her. What is the legality and consequences of Bob’s response to her SAR?
3 votes
2 answers
79 views

Access rights to professional photographs

An independent professional photographer uses a sales tactic of candidly taking photos of others in public and then approaching them and offering them copies for a price. Suppose one of these ...
0 votes
0 answers
28 views

Who is the data controller of footage taken on a retail worker’s personal phone?

An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer ...
0 votes
2 answers
59 views

Can a customer of a business make a recording of an employee on the business’s privately premises?

Suppose a customer enters a store. The business, through an employee, treats the customer unlawfully. Perhaps this is by verbally or physically abusing them, discriminating against them, or denying ...
-1 votes
2 answers
33 views

Can data protection rights of a subject be voluntarily waived?

Presumably not on protrusion by a service provider as a condition of their service. But what if someone writes to someone super busy whom they admire and says “look I really respect you and don’t want ...
1 vote
2 answers
73 views

Is training an AI on the internet processing personal information?

There is an article on El Reg where the author asks ChatGPT about themselves, and they get back some information. If this data acquisition and dissemination process was being performed specifically ...
  • 3,338
0 votes
1 answer
46 views

EU and CLOUD Act [closed]

I can't find anything what's on this in 2023 - is EU anyhow working towards and agreement with US to allow not to give away private data? - As I see on Wikipedia, so far only UK has got this agreement ...
  • 447
0 votes
1 answer
49 views

Is just embedding YouTube thumbs GDPR conform?

Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?
1 vote
3 answers
80 views

What does "necessary" mean with regards GDPR and cookie consent

The GDPR makes use of the word "necessary". For example article 6. Lawfulness of processing 1. (f) says "processing is necessary for the purposes of the legitimate interests pursued by ...
  • 3,338
0 votes
1 answer
45 views

If I have concurrent user consents then can I combine these consents?

I have an app that supports concurrent user consents. Assume that I have: Consent A that gives access to https://example.com/resources/a Consent B that gives access to https://example.com/resources/b....
14 votes
1 answer
2k views

How can consent-banner as a service be GDPR compliant?

A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
  • 243
2 votes
2 answers
72 views

Is a bank account history of transactions considered personal data in the sense of GDPR?

For archival purposes, I'm trying to get the full history of transactions on my bank account since I opened it in 2019. I know my bank still has it since it's visible in the mobile app (I can scroll ...
1 vote
1 answer
34 views

GDPR When using an external CV formatting company

As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
  • 11
0 votes
1 answer
71 views

Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?

ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
4 votes
1 answer
110 views

What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?

What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server? The social network Mastodon https://en.wikipedia.org/wiki/Mastodon_(social_network) ...
6 votes
3 answers
2k views

GDPR: Do I have to IP log "every" login for a customer?

IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. ...
0 votes
1 answer
37 views

GDPR @ ePrivacy & Data Controller & Local processing PII & Mobile App

I'm developing an open source client mobile app that allows user to use third-party social media. So the app logs in directly to the interface with the credentials entered by the user and makes direct ...
10 votes
2 answers
1k views

GDPR - Are technical identifiers personal data?

I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
  • 203
1 vote
1 answer
78 views

What are GDPR Laws concerning requirement to back up data

I want to create an application where I want to act as a data controller & data processor. The only data I want to record myself is basic user data like username, address , etc. But I want to run ...
0 votes
1 answer
34 views

Can a Data Controller refuse a second SAR from the same person?

Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
4 votes
2 answers
1k views

What is the U.K. GDPR?

I understand that the DPA implemented the GDPR in British law as an act of Parliament. Then there was Brexit, and the U.K. GDPR was introduced to stand in for the no longer binding EU GDPR, with only ...
2 votes
0 answers
64 views

Is there anything to stop a subject access requester from being barred by a business?

A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
5 votes
1 answer
321 views

Is it a breach of GDPR and DPA to say a colleague is sick and off work?

This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer ...
  • 620
-2 votes
1 answer
59 views

How shall I handle user consent "remember" option [closed]

I get consent from user for some operation. While consenting user can check "remember consent" option and this is handled as below: Consent is saved to db Some action is done and consent is ...
0 votes
1 answer
63 views

Practical implications of failing to follow GDPR for online businesses

Suppose a person based in UK has started a one-man business online, for example, a web blog where people can read articles and post comments. Now, the business owner is focused on testing out the ...
  • 35
0 votes
1 answer
49 views

SAR before claim: tactical and legal considerations [closed]

A claimant C intends to sue a business B, which is also a data controller. Independently of the prospect of any civil action, C is entitled to make a SAR (Subject Access Request) to B under the Data ...
3 votes
1 answer
81 views

Processing screenshots of people's browser windows on a web server

Suppose that a software developer (April) living in the UK,has created a simple browser plug-in that takes screenshots of a user's browser windows and allows the user to enhance and "prettify&...
  • 35
-1 votes
1 answer
33 views

Restricting processing of data provided to police

Suppose that a person A would like to report a crime of which they’ve become a victim, to the police. For this purpose the police typically require the victim’s date of birth in order to create a ...
8 votes
1 answer
684 views

Does gdpr.eu violate GDPR compliancy?

As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
-1 votes
1 answer
50 views

Choosing region for database to be US / EU compliant

I wanted to ask about how one should go about choosing region for database / cloud provider when working on an application that stores user data for EU and US customers. Business behind the app is a ...
  • 101
0 votes
2 answers
54 views

Can a mobile app save data about a user without a user giving the permission?

Is it allowed to store a user id to remember him, his settings, preferences and history, without asking for his permission? Is there anyknowledge about that how that goes with privacy laws like GDPR ...
0 votes
2 answers
102 views

How restrictive is the General Data Protection Regulation (GDPR) in Europe?

Lets say that I want to take a picture or record a video of a city I am visiting in Europe and like its inevitable people will appear in the picture or video. I cannot do this before asking permission ...
5 votes
1 answer
1k views

Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?

Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)? I am following the current issue ...
  • 119
0 votes
2 answers
65 views

Can I legally sync and save YouTube comments on my website

I own a YouTube channel and a website that belongs to it. On the website, I am also displaying the YouTube videos. For various reasons, I want to create a plugin to sync the comments on my YouTube ...
2 votes
2 answers
54 views

Is nickname on an android app consider as personal Information for GDPR policy

I am currently developing a puzzle game where the player initially has the option to enter a "NIckname" of his choice ( might also be his name - its up to him what to enter) so that his time ...
  • 21
0 votes
1 answer
137 views

Would it be illegal to forward CCTV footage of someone committing a crime to their employer? (UK)

An incident has occurred where an individual in a private business committed an offence (common assault/battery). As expected the police seem fairly unmotivated or interested however a quick Google ...
  • 145
5 votes
2 answers
4k views

Is displaying the user first name and last name a breach of GDPR?

We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
  • 151
0 votes
1 answer
91 views

The GDPR and how it treats online game character names

I am writing a MUD server - a multiplayer game where people connect and create characters. I am unsure if the GDPR applies to me - offering a game to the public is not a household task, but I am also ...
  • 103
3 votes
1 answer
815 views

In GDPR terms is the hash of a user ID considered personal data?

“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, ...
0 votes
1 answer
88 views

Using AI to identify similar browsing pattern

I understand that storing any hash or IP that can identify "user uniquely" is against GDPR. I am planning to use user browsing patterns to see if a similar or the same user had previously ...
  • 61
6 votes
2 answers
2k views

Emailing a publicly available address posted by the same person

I understand that emailing a person without consent is illegal under GDPR. But is it okay to email someone if the person has made the mail address public? For example if a university professor posted ...
  • 61
0 votes
1 answer
60 views

When need I to display consent and should deprecated consents be stored?

When the law requires consent screen to be displayed for user? Should it be displayed only for third party applications (e.g. signing to stackoverflow by google account) or is it also necessary for ...
1 vote
1 answer
72 views

GDPR: Alternatives to 3rd party cookie-based analytical systems?

Cookie-based solutions became challenging to leverage due to the GDPR law. As an analyst, it's hard because my work depends on these metrics that will no longer be available with cookie-based tracking ...
12 votes
2 answers
2k views

Are users' personal notes about other users subjected to the GDPR right of access?

Some applications, like Discord or Mastodon, allow a user A to put private notes (only accessible to A) next to the profile of another user B. This data is very probably Personal Identifiable ...
1 vote
2 answers
71 views

Can one require data of which one is the subject to be erased as well as disclosed?

Under the GDPR, one is entitled to receive any data including CCTV footage that one may feature in if it still exists. However, can one as the data subject also require by request for such footage to ...
1 vote
2 answers
57 views

Is the local presence of a foreign non-GDPR state a data controller subject to the provisions of the Data Protection Act 2018?

Consider that state X is not subject to the gdpr, however, it has a diplomatic presence in the UK. If the state were a tech company that operated in or even simply offered services to people in, the ...
1 vote
1 answer
84 views

Webhosts' legal obligations to remove publicly available content associated with specific IP addresses

Let's say one builds a website allowing users to post text content that is publicly available and searchable via the IP address of the users who submitted it. Would the owner of that website be ...
2 votes
1 answer
30 views

Privacy Policy change for different Countries / Continents on Website

I'm currently researching the GDPR Terms for a European Website. The Company has its headquarters and registration in Europe. If someone from, let's say US, visits the website, do I have to cover the ...
3 votes
1 answer
134 views

Am I allowed to use US web hosting according to GDPR

I live in UK, and I own a super simple website (web blog). The users of my website are not required to log in or provide any kind of personal information, they are just readers of my content. I used ...
  • 31
-2 votes
1 answer
58 views

Why do some data controllers require two forms of ID and others only one?

Meet Bob. Bob has submitted a number of subject access requests to various data controlling bodies, including businesses and several police forces. Some police forces simply require scan of id with ...

1
2 3 4 5
18