Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
630
questions
1
vote
1answer
41 views
GPDR/ICO registration. Do I need to register? (Their site is inconsistent.)
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-fee/exemptions/ lists exemptions as:
Staff administration
...
2
votes
1answer
64 views
After the Brexit, can we store UK data in EU region?
Can you please tell me, whether we can store PII data belong to UK in EU region? I know the other way round is illegal. But I could not find a place where this problem address properly. Can you please ...
3
votes
2answers
73 views
Storing IP's and GDPR Compliance
Suppose a web designer plans to store hashed IP's in a database for analytical purposes of tracking unique clicks, and for security purposes to prevent botting unique clicks. Suppose the site only ...
2
votes
1answer
107 views
Are Facebook Pixel GDPR compliant?
GDPR states that a data subject have the right to get a copy of the data about the subject the data controller has collected, and in some cases deletion of said data. If I understand correctly, this ...
2
votes
1answer
67 views
Are businesses required to try every possible combination of methods for verification under GDPR?
A site maintains accounts containing:
email
password
display name
account preferences
Two accounts containing the same password, display name, and account preferences may or may not exist but they ...
6
votes
1answer
2k views
Californian resident travelling in EU - which privacy law applies?
If a Californian resident is travelling within the EU, it seems both European GDPR and Californian CCPA privacy laws will apply.
Sometimes businesses have single privacy emails, so if a deleting ...
-2
votes
1answer
60 views
Data processing to fall out of scope of a law
If we process personal data ( country information ) for following :
Blocking users from countries we do not have patent or copyright in .
Removing content where the authority has asked .
Is this ...
0
votes
1answer
54 views
Canceling a GDPR request
If a user informs us that they no longer want to delete their data before we process the order deletion request, are we legally required to cancel it? Or can we modify, meaning delete the data ...
3
votes
1answer
117 views
In case a company is flooded by “asymmetric” GDPR-related requests (request via email, preferred answer via postal mail), how should a company react?
Concerning the individual's right about information about one's data, Art. 12 GDPR ("Transparent information, communication and modalities for the exercise of the rights of the data subject")...
1
vote
1answer
84 views
How does GDPR deal with combined personal data?
There is a person named aa 1 where aa is their first name and 1 is their surname. Now some other person makes an email named aa.1@somemailingcompany.com. Whose personal data is this? aa 1's or that ...
1
vote
1answer
43 views
Does legitimate interest need to be justified in response to a GDPR DSAR?
In the response to a GDPR Data Subject Access Request, in describing the lawful basis under which the data controller is processing my data, I got this:
We process your personal data for our ...
0
votes
1answer
87 views
Was Mendeley really compelled by GDPR to encrypt my database?
Mendeley 1.19 encrypted my data on my HDD with a key that only Mendeley has.
On Twitter Mendeley claimed that:
To comply with GDPR & keep your data safe, Mendeley has encrypted your
databases. ...
1
vote
0answers
63 views
Mendeley is encrypting my data on my hard disk with a key only available to them: can I ask for unencrypted data under GDPR?
I use Mendeley Desktop to manage my bibliography. Now I want to switch to Zotero.
Zotero used to be able to import the Mandeley's database. However, Mendeley 1.19 encrypted my data on my HDD with a ...
27
votes
2answers
8k views
Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?
So, I've been receiving a lot of spammails recently and I'm pretty fed up with them.
I've also been wondering, how they got access to my mail-address, so I sent a request of information so I can see, ...
0
votes
1answer
35 views
Shoud a company send to customers of its clients notice when getting data about them under GDPR Article 14?
A SaaS company (A) provides services, (e.g. web hosting) for its clients, (e.g. web agency B).
The clients can create websites for their customers (C) and host them using the web hosting.
Web agencies ...
2
votes
1answer
49 views
Should the client be informed every time when more personal data is requested under GDPR Article 13?
A SaaS company offers some services, which require registration. Its clients are notified about Terms of Service and Privacy Policy during the registration process.
Should the company send to the ...
0
votes
1answer
62 views
Twitter and account deactivation - Do you have to explicitly ask for account to be deleted if company nowhere says that it will do so? [duplicate]
I am trying to delete my Twitter account.
Twitter only has a "deactivate" account button, and no "delete" account button, as I posted here.
It looks like in the guides posted by ...
1
vote
2answers
67 views
GDPR: What data am I allowed to keep after a user requests deletion?
I struggle to find an insightful article on what, specifically, I have to delete and what I don't have to delete when a user requests deletion of their data.
Some things are obvious to me: personal ...
0
votes
0answers
161 views
Twitter has no “delete account” button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement
I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that.
But Twitter has no "delete account" button. There is only a "...
1
vote
1answer
53 views
How to determine what frequency of GDPR SAR is not excessive?
Repeat Subject Access Requests are limited in frequency by the Manifestly unfounded and excessive requests rules. The critical bit seems to be "A request may be excessive if it: repeats the ...
0
votes
1answer
59 views
Can ISPs in the EU (covered by GDPR) record the device IDs on a home network?
In theory an ISP who provides a integrated router/Wifi point could sniff and record the traffic from individual devices on a home network. These devices (like PCs, phones and tablets) could be ...
0
votes
1answer
24 views
Access device contact but show names as they exist from an app' servers
Someone has created an app that asks users if it can have access to their contacts from their smartphone. If the user grants this access the app uploads the email addresses and telephone numbers of ...
0
votes
1answer
24 views
Who is responsible for fulfilling GDPR in university projects with EU-based industry partners - the university or the professor?
Based on a discussion with a friend who is university professor in Switzerland (which is not EU member): The professor's institute ("Research Lab", part of the engineering department) is ...
1
vote
1answer
77 views
Are there any complications in hosting an Italian website on a server in the USA? [closed]
I own a webserver that resides in the USA. This server hosts different websites but they all have users mostly from Italy.
One of the websites, a blog made with Drupal, has a .it domain registered ...
23
votes
3answers
9k views
In Europe, can I refuse to use Gsuite / Office365 at work?
See above. In a country where GDPR applies (Italy in my case), do I have the right to refuse giving consent to Google and Microsoft to store my personal data, if this account is for work use? Or, in ...
2
votes
1answer
97 views
Is the Signal App, although recommended by the EU for internal use, in violation of GDPR?
There are articles commenting that the European Commission has recently told its staff to switch to the encrypted Signal messaging app. When I look into Signal's privacy policy, as linked from their ...
-3
votes
1answer
66 views
Does the GDPR allow data to be moved to outside the EU?
Does the GDPR allow the transfer of data to outside the EU? For example, from Germany to the US?
0
votes
1answer
61 views
“Delete Account” button and GDPR related request by a user to delete his data
Assuming I provide something like a "Delete Account" button on my webpage and/or App, which, after pressed by the user, deletes all his data, and I point this out in my privacy policy. If ...
5
votes
1answer
50 views
GDPR rights of person who moves into the EU
Suppose that a person not resident in the EU, say in Mexico, obtains services from a provider located in the US, and provides personal information in connection with those services, including filling ...
-2
votes
2answers
100 views
The GDPR loop of physical mail requests ( Is there a way to stop it ? )
It is confusing how this kind of a malacious person an be stopped:
A person does this:
A GDPR request is sent asking for right to access . The request itself bundles some personal information with ...
0
votes
1answer
73 views
Will GDPR override local privacy laws?
Here it seems all european(EEA) countries and iceland have their own privacy laws . Do we have to follow all of the laws as many do not seem to allow legitimate interest. I mean, is following GDPR ...
0
votes
0answers
40 views
I do not understand the EU's requirement to have a GDPR representative located in the EU
I do not really understand the EU's requirement to have a GDPR representative located in the EU for a data controller and/or processor located outside the EU.
From the EU's point of view they ...
1
vote
1answer
38 views
GDPR and speech recognition of text spoken into an App's microphone
In one of our Apps we use a Java-Class called "SpeechRecognizer" for doing some speech control. Technically, it is up to the settings of the smartphone (operating system) if the speech from ...
2
votes
1answer
219 views
GDPR concerning IP logging by hosting company inside EU
If I, located outside the EU, use a server of a hosting company, which is located in the EU (as well as their servers), for a simple website without any data collection, forms, cookies and the like, ...
0
votes
1answer
43 views
Does GDPR apply to data of users who lied about their country of residence?
Imagine a website which requires users to register in order to use all its features. In order to avoid exposure to GDPR complains, would any of the following tactics work?
Ask the user for their ...
-1
votes
1answer
54 views
Is it possible to embed a PayPal donation button and still be GDPR compliant? [closed]
I've read that PayPal embeds a pixel in its button which tracks every user that visits the website. Is that true?
More generally, is it possible to embed a PayPal donation button and still be GDPR ...
1
vote
1answer
44 views
Google Photos Takeout - machine learning classification missing
I did a Google takeout of Google Photos and was able to download all stored images including some meta data, but not the classification data Google is most likely doing, because I can search for ...
5
votes
3answers
120 views
Can the GDPR be used to obtain US voting information
This grows out of a comment in the question Who Has the Right to Access State Voter Records and How May That Right be Expediently Exercised?
If a US citizen is currently resident in the EU, can that ...
0
votes
2answers
81 views
GDPR: Can I use an IP-address to show country pop-up without consent?
I've a question. We would like to show a pop-up to users outside Europe to inform them we also have an American website as soon as they visit the website. We check the location based on their IP-...
0
votes
1answer
41 views
User consent for Google Ads snippet under GDPR?
Let's assume I run a website that doesn't place any cookies and doesn't track visitor's information. However, it uses Google Ads to attract visitors. And Google demands that advertisers disclose ...
2
votes
2answers
198 views
How can you block GDPR users from US based sites?
(I originally asked this question on Server Fault with GDPR tag, but due to minimal response was advised to try asking here)
As I understand it, GDPR is European legislation promoted as protecting EU ...
1
vote
2answers
96 views
According to GDPR, does privacy decision made on website legally affect mobile app settings also?
We're implementing the EU's GDPR regulations on a certain project and I'm wondering about the following:
Company A develops an App, which also has a website version available to customers. The website ...
1
vote
1answer
48 views
Legality of Network companies scanning TCP ports - how has my consent been obtained?
In my firewall and IIS logs I constantly see entries for servers from companies like ZenLayer, Dedipath, DigitalOcean and other Network-related businesses that appear to ping/scan my systems to ...
0
votes
1answer
65 views
UK - Does a foreign, non-EU company's ToS Override GDPR
MiHoyo is a Chinese company that has recently produced the hugely popular online game, Genshin Impact. However, terrible online security has led to thousands of user details, emails, phone numbers, ...
0
votes
1answer
45 views
As per GDPR, can i request the creation date of an account i made on a website on a legal base?
Basically title, i want to know when i created my Microsoft account, they replied saying that this info is part of the verification process and thus they cant give it to me.
1
vote
1answer
32 views
What restrictions can organisations impose on the method of making a DSAR?
From the ICO "An individual can make a [Subject Access request] SAR verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their ...
5
votes
1answer
129 views
Are there temporal limits to data requirements for a GDPR SAR?
Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data?
The particular case I am thinking about is SAR made to the 3 credit ...
2
votes
1answer
78 views
Do I need to track when a user declines to consent to analytics to meet GDPR?
Suppose a user visits a website. They are informed that the site is using cookies and analytics, and the user can either allow cookies or decline. If the user declines (and therefore is not tracked), ...
15
votes
2answers
3k views
Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?
This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member.
I will explain the best I can:
...
1
vote
1answer
75 views
Does uploading a project to GitHub make a person joint data controller according to gdpr?
Does uploading an open source GitHub repository intended for commercial purpose make the person who uploaded the code joint data controller?
What is meant is that if code is uploaded to GitHub I have ...
