Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
452
questions
0
votes
0answers
10 views
How does the GDPR differ from national data protection law?
Before the GDPR came into effect, I had to deal with both the German Bundesdatenschutzgesetz and the Italian Codice in materia di dati personali, and recall them having very similar provisions (though ...
2
votes
2answers
41 views
Process IP address without GDPR consent
We are trying to log the location of our visitors, without storing their actual IP address on our servers.
To geolocate the IP address, we use an external service, to which we make an API request ...
1
vote
0answers
28 views
Cookie opt-in required on paid-for web-based software-as-a-service application?
Context:
We provide a paid-for web-based software-as-a-service application. This application requires users to register an account, and agree to our terms & conditions and privacy policy to be ...
0
votes
2answers
58 views
What should I reply when someone ask about their GDPR information against a cold marketing email?
I recently received an email says "..please send me a GDPR information about all my data you have assigned to this email.."
I collect the email address from a public domain (say GitHub) and ...
0
votes
1answer
14 views
GDPR & CCPA compliance involving terms of service violation
If a user writes a comment on a website that gets flagged and removed+archived are we still obligated to delete the user content and/or the association of that comment with the person? According to ...
1
vote
1answer
74 views
Is it possible to create data subject to the GDPR without any involvement by the person in question?
Say I email a colleague, in a professional capacity:
I have been thinking about offering John Smith, who currently works at Big Corp, a job
John Smith has had no involvement with my organisation. ...
1
vote
0answers
32 views
Company acquired a website with existing users. Is GDPR announcement obligatory?
When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
24
votes
5answers
14k views
Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?
I have recently come across this part of an app from a well-known US company:
Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of ...
0
votes
0answers
44 views
Is WhatsApp legally obligated to remove my chat on every device, based on the GDPR? [duplicate]
Dear Law StackExchange community,
I'm attempting to get chat history removed with another party dating back a long time ago. I don't want the chats to remain existent on any device whatsoever, so I ...
-2
votes
0answers
41 views
What legal instruments can be used to obtain details held you by a wholesale utility? [closed]
United Energy (UE) in the south eastern suburbs of Melbourne wholesale Energy company (it's a lot like Enron as shall soon become apparent) that sells electricity and gas (Multinet).
I believe that ...
0
votes
1answer
43 views
Which EU-related jurisdictions in Americas apply the GDPR regulation?
According to some information, a person will need to be a resident in an EU country in order to be protected by the GDPR regulation.
Are there jurisdictions in North or South America where residency ...
0
votes
1answer
41 views
Does GDPR disclosure apply to European citizen temporarily in United States?
For some background: the EU "[Data Protection Directive][1]" is a European Union directive which regulates the processing of personal data within the European Union, as explained in [this Wikipedia ...
0
votes
1answer
140 views
Right to be forgotten in US legal system. Practical approach for erasure?
As it commonly known, the right to be forgotten is a fundamental right in the modern informational society. It is the right of an individual to obtain erasure of his personal data from the online and ...
0
votes
0answers
34 views
Data Privacy: Should a user be allowed to change another users profile information?
In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)?
What laws (US & EU) would give guidance either way? ...
1
vote
1answer
60 views
GDPR dilemma: Does a full name contained in a URL constitute PII as stated by Google Analytics?
But wait, it gets better: This full name belongs to person who was interviewed in an article under this URL.
https://support.google.com/analytics/answer/7686480?hl=en
What Google considers PII: ......
-1
votes
1answer
72 views
My hashed IPV4 was published by an administrator on an anonymous imageboard (EU country)
some days ago it on an anonymous imageboard it was opened by an administrator a thread with a .png showing all my posts on that website, and each posts had my hashed ipv4 attached to it.
Since i ...
0
votes
2answers
77 views
Is it illegal to NOT store logs within the UK? (VPN related)
Introduction:
I co-run a VPN company. I have a few legal questions since our service has a strict NO-LOG policy enforced.
Question:
In the UK, it is illegal to store sensitive and private customer ...
4
votes
1answer
82 views
Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?
I work at a SME.
When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
2
votes
1answer
127 views
A website is refusing or failing to remove personal data I've requested removed: is this against GRPR?
I have been a member of a website for 13 years and would like all of my old posts removed. I have contacted their support team however the experience has been dreadful:
it look a lot of back and ...
1
vote
1answer
36 views
Can someone enlighten me about the main task of the independent supervision of data protection law
So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
0
votes
1answer
51 views
Which Cookies require consent for GDPR
I use a number of different cookies on my website for tracking and saving preference. I'm very confused about which can and cannot be set with and without consent under GDPR
I'm certain I need ...
0
votes
1answer
49 views
Hiding order invoice information, GDPR
I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like:
Name Surname
...
1
vote
2answers
47 views
Is an auto-submitting form GDPR/DPA-compliant?
TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant?
An organisation I am part of has an online form on their intranet for reporting incidents ...
0
votes
2answers
57 views
Is anonymous analytics data subject to GDPR?
I am reading the definition of "personal data" here https://gdpr-info.eu/issues/personal-data/. My understanding is that GDPR comes into play when information is about personal data.
Let's say there ...
1
vote
1answer
58 views
GDPR in a scientific, transborder scenario
Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole ...
1
vote
1answer
61 views
User-solicited personal information beyond consent
What does the GDPR say about personal information provided by a user about themselves, in the case that the service sign-up process and ToS have always asked of the users not to provide personal ...
0
votes
2answers
63 views
GDPR compliance in ads SDK for iOS/Android
I have opened this question in SO, but was suggested to ask here, as the solution might come from a lawyer, rather than developer.
I work on a native ads SDK for iOS/Android (banner, interstitial, ...
0
votes
1answer
57 views
GDPR - We're a global company and are expanding to Europe, do we need to save data there?
We're a global company and are expanding to Europe. We have users log in to our service and then they can use it.
If a user is from the EU, do we have to store all of their personal information ...
1
vote
1answer
74 views
Can the GDPR be used to ask free race photographs?
A lot of time pictures of participants are taken during a sports event. These are often sold afterwards for e.g. 10 euro each. Some people just share the watermarked image on social media.
But my ...
2
votes
3answers
117 views
What an employer can legally ask to monitor about user activity
I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's ...
4
votes
2answers
239 views
Are Blizzard breaking GDPR by charging people for changing their usernames?
I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago.
I now want to change it again because searching it on Google ...
3
votes
1answer
223 views
Is it legal for Blizzard to demand a copy of my government id before deleting my account?
I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so.
I've seen a somewhat related question about Twitter at How can I get Twitter to delete my ...
1
vote
1answer
87 views
How can I get Twitter to delete my account?
I want to delete my old (7 years unused, never logged in) Twitter account. I lost the email to it, but it has my name so I would like to delete it. I wrote Twitter support twice and told them "This is ...
0
votes
0answers
47 views
Does USA have a law similar to GDPR that gives you the right to a copy of the information a religious organization has on you?
For some background: the EU "Data Protection Directive" is a European Union directive which regulates the processing of personal data within the European Union, as explained in this Wikipedia article. ...
0
votes
1answer
51 views
GDPR on Proxy Users
I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc...
My questions here are about the scope of GDPR.
Does GDPR apply to people who:
...
16
votes
1answer
2k views
Can Slack really claim not to be a data controller?
I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response:
Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
1
vote
0answers
46 views
Question Regarding GDPR
I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
0
votes
0answers
13 views
Are previous communiication preferences retained with form submissions?
I'm trying to understand the correct procedure when dealing with storing a users email subscription types, and the behaviour in relation to legitimate interest and consent to communicate.
And the ...
0
votes
0answers
14 views
Complying with GDPR when storing emails and IPs for a refferal campaign
I want to start an email referral campaign to collect emails for the upcoming launch of a videogame and was warned that I need to comply with the GDPR rules of privacy.
I'll be storing the email ...
3
votes
1answer
28 views
Identity verification prior granting access to personal data [GDPR]
When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
2
votes
2answers
84 views
When is pseudonymization insufficient in terms of GDPR compliance when storing and processing data for research purposes?
I am working on a project where data needs to be stored and kept for further processing. It's primarily for research purposes. I know that in order to be GDPR compliant, this data has to be anonymized....
2
votes
1answer
104 views
Under GDPR EU law, can I sue big tech companies (Facebook, Google, Apple) for acquiring and storing my personal data without my consent?
Many of my friends have social media accounts (Instagram, Facebook, etc.) where they regularly post photos of them and where occasionally I appear in them.
Many of my friends have their personal ...
2
votes
2answers
221 views
Company retained my card details after payment completed and suffered a breach. What are my options?
A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications.
After the breach, when the company was ...
3
votes
2answers
69 views
Site does not provide the option to disallow cookies in a notification
Is this a typical behavior for websites to provide only one option, and doing so, forces the user clicking "accept"? Isn't it so that they must provide both, accept and reject?
1
vote
2answers
78 views
Does creating an account or making a purchase apply consent for all marketing communications?
Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent.
For example, I created an account using my email and hired a bike from ...
1
vote
1answer
139 views
What can i do if my GDPR requests are being ignored?
I have requested my personal data removal from one shady company that has gotten to my email somehow.
They said they've complied, but i am still getting newsletters from them.
What can i do as a ...
2
votes
1answer
46 views
Data processing locations post-Brexit
I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients.
I have several UK-based clients, all ...
1
vote
1answer
44 views
Is sending log data + customer name + location compatible with data privacy and GDPR?
I've written an updater program. Our customer downloads it to update our software with database. It would be helpful if we would know who has already updated our software. For this purpose I've added ...
3
votes
1answer
58 views
Data deletion requirements
I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it.
I never ...
2
votes
2answers
73 views
Under GDPR, Is a Hashed URL Enough to Protect Customer Data?
Does a hashed URL (sent via email) provide enough security to safeguard customer data? For example, if we publish our customer data online with a hashed URL that we send to the customer (in other ...
