Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
589
questions
5
votes
1answer
105 views
Are there temporal limits to data requirements for a GDPR SAR?
Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data?
The particular case I am thinking about is SAR made to the 3 credit ...
-6
votes
0answers
41 views
Is there any app on play that is completely legal? [closed]
Is there any app on play store that perfectlyr follows all laws including GDPR and other app law tga that apps have to follow and also uses AdMob.
2
votes
1answer
42 views
Do I need to track when a user declines to consent to analytics to meet GDPR?
Suppose a user visits a website. They are informed that the site is using cookies and analytics, and the user can either allow cookies or decline. If the user declines (and therefore is not tracked), ...
13
votes
2answers
3k views
Have any GDPR (or other) laws been breached during this scenario?
This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member.
I will explain the best I can:
...
0
votes
3answers
2k views
Is hyperlinking legal in Europe?
This is why I am asking such a strange question:
Europe has a law called GDPR which imposes responsibility of processing on the person who decides the means of processing of personal data. Now, if ...
0
votes
1answer
77 views
Online meetings and GDPR
If a tutor asks someone to use an online service for doing class meetings could a student have just sued the tutor saying that he must take liability of the fact that he is forcing every one to ...
0
votes
2answers
66 views
Is user opinion personal infotmation according to gdpr?
If I ask user to enter their faviourite laptop and transmit that information am I being GDPR non-compliant?Basically is user opion voluantarily given and o;ptional PII under GDPR
1
vote
1answer
33 views
How to answer GDPR requests when part of the information is accessible?
Lets say a company stores information in Catagory 1 , 2 , 3 .Catagory 1 in formation is assciated with email , Cata gory 2 with user name and catagory 3 with phone number.A user sends a request via ...
4
votes
1answer
140 views
GDPR Representatives of controllers or processors not established in the Union - Is this basically a simple mail-forwarding activity?
Art. 27 of GDPR says that whoever processes data of people located inside the EU (includes storing and deleting in the GDPR definition, with a few exceptions) needs a Representative located inside the ...
1
vote
1answer
32 views
What to answer to a GDPR-related user request about his data if it is fully encryped and only the user has the private key for decryption
We wrote an App where private data can be sent from one phone to another phone one by temporarily storing the encrypted data file on our database server. The data file will sit there for less than a ...
2
votes
1answer
46 views
GDPR outside the web: no need to provide a privacy policy?
Consider a freelancer like a web developer, or a consultant, or a lawyer, etc. Their jobs involve, one way or another, handling some personal data: contents of databases, authentication data, private ...
-1
votes
1answer
56 views
Can the POPI act land the CEO of a tech giant in a South African jail?
The South African POPI Act could impose imprisonment on companies processing data unlawfully.
Most tech giants do business in South Africa and do collect data and have faced fines for GDPR violations.
...
-3
votes
0answers
46 views
Role of server renters with respect to GDPR VB?
Let's say there are three companies A O and Z.
O owns a data center and produces various kinds of software.
A rents the data center at the following terms:
A will run servers using O's software.
A ...
2
votes
1answer
186 views
Privacy Policy if App's internal data, probably containing private data in terms of GDPR, is automatically backed up in Google Cloud
If I develop an Android App, the per-default setting is that the App's internal data, probably containing private data in terms of GDPR, is automatically backed up in Google Cloud (unless the phone ...
7
votes
2answers
582 views
As per GDPR, how are the agree/disagree to cookie buttons to be designed?
I just stumbled over this very... interesting cookie dialogue on the Ansible site:
How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
3
votes
1answer
48 views
GDPR: Can I make a subject access request for information that I obviously already know?
The GDPR guidance states that subject access requests can only be refused if they are manifestly unfounded or excessive.
The detailed guidance on what constitutes manifestly unfounded or excessive can ...
0
votes
0answers
37 views
Mandatory languages for privacy policies in Japan (APPI)
I work on Apps, currently Android, which are distributed via Google Play.
As the EU has GDPR, in Japan they have APPI (Act on the Protection of Personal Information) which is something like the ...
0
votes
2answers
81 views
Isn't it impossible to respond to certain data access requests?
There is an european named A. He goes to a website and tells the website "under my GDPR right to access (given by this one) I hereby ask for my ip address which you logged on september 4, 2018.&...
0
votes
2answers
47 views
Can data processors charge a fee?
Under GDPR can data processors charge a fee over their normal charge just because they have to perform GDPR requests on request of data controller?
One scenario->
Data subject asks controller to ...
2
votes
1answer
36 views
What subject access rights exist when only some of the data relates to you?
If some data record exists where some of the data relates to person A (eg. telephone number) while other data does not (eg. name), what right of access does person A have to that record under the GDPR?...
0
votes
0answers
30 views
Very simple static website with Google Analytics. How to make it GDPR compliant?
There is a very simple static website for a commerce. That website only shows information. It has Google Analytics to count visits with the default GA script placed in :
<head>
<script>...
-1
votes
2answers
95 views
EU refunds law for Play Store
According to EU refund law, if a person releases an app on the Google Play Store, does the person need to even give the payment he received back? Can one specify no refunds by putting it after the app ...
0
votes
0answers
23 views
GDPR legitimate interest and Contact Picker API
There is a draft web standard Contact Picker API see here and here. An explicit use case is "bootstrapping a userās social graph for social networks". I'm interested in what ways this can ...
-1
votes
1answer
57 views
Does Excessive consents clause hold up against consent requests in GDPR
GDPR states that one must record consent https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/how-should-we-obtain-record-and-...
0
votes
1answer
47 views
Does EU geoblocking apply to businesses outside EU?
This
: https://support.stripe.com/questions/eu-geo-blocking-regulation-changes
states that EU has passed a law preventing geoblocking .Does this
apply to businesses outside EU. It is favourable to ...
-1
votes
1answer
62 views
How can I implement GDPR in a simple program?
I would like to get some analytics from a simple program that I wrote to manage a game server.
The data I want are (collected every 15 min):
operative system (windows/linux 32/64bit)
machine id (...
-5
votes
1answer
59 views
How is S.E. a processor of data according to GDPR? [closed]
This states that S.E. is a data processor and customers are the data controller . However after we enter data it is S.E. which determines how it is shown and/or delivered (i) to their servers . So ...
0
votes
2answers
42 views
GDPR compliance cookie-less Google Analytics and consent banner
I've been reading about GDPR a lot, and I have a bit of a confusion. I know I have to show a consent banner with an opt-in for enabling cookies related to Google Analytics.
Frankly I would like to ...
-1
votes
1answer
82 views
GDPR and HTTP requests
A person A makes an app and publishes it to play store. The app requests a page from a server not under his control as a part of the app . The users ip address is transmitted and logged in the servers ...
-1
votes
2answers
97 views
Blocking certain countries
Due to some laws one wants to block certain countries from accessing his app which he uploaded on play console.One turns off those countries in GOOGLE play console so it cannot be downloaded in those ...
-3
votes
0answers
43 views
GDPR applicablity for browsers
Making an analogy with apps using AdMob where the app maker is liable for GOOGLE'S use of data as they are joint controllers.Similarly every browser is joint controller for all websites. Thus Mozilla ...
7
votes
1answer
85 views
As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?
The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
6
votes
2answers
3k views
Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user's jurisdiction?
Can one add a clause stating
Do not use this application if the terms demanded cannot be provided by law
For example, let's say one term of use states that information collected may be retained ...
0
votes
2answers
60 views
Are search keywords seen as non-personal information?
For example someone is browsing a popular shop like Amazon, what does GDPR say about this?
-2
votes
1answer
132 views
GDPR liability for data that is no longer under the developer's control
Let's say AdMob is used in a mobile app. AdMob collects data and transfers it to Google. There is no longer any access possible to the data by the developer. Is the app creator liable for Google's ...
0
votes
2answers
61 views
Does information related to client IP address is been allowed as per GDPR policies. Without asking user's location
We need implement user's nearby store locator. Where we have code to get user's ISP location from where the client request is been triggered.
But getting lat-long & city details by checking client ...
-1
votes
1answer
42 views
Do I need GDPR contracts/agreements?
We use a service (Meetup.com) to post our events publicly. We do not store/collect/process any information about any attendants except for the number of sandwiches to order. Everything is kept in ...
0
votes
0answers
59 views
GDPR - Who Called Me type of situation
I would like to ask how does it work with GDPR and a service like "who called me".
Basically there are no publicly listed phone numbers as these kind of websites are using pretty much every ...
3
votes
1answer
220 views
Is a cookie notice required for analytics?
Note: I've been directed here from Meta.SE
I'm using GoSquared for my website analytics.
I've visited quite a few sites using Google Analytics but they don't have a cookie policy or a cookie banner/...
2
votes
2answers
73 views
Can a German employer force employees to submit personal data to a contractor?
A German higher-education institution recently introduced a new measure to facilitate Covid-19 contact tracing: next to each door (i.e. entrances to the building, the lecture rooms, the labs and some ...
21
votes
1answer
5k views
Am I obligated to decrypt lots of data for GDPR requests?
I am providing a B2B service where customer data of businesses are stored in an SQL table.
As I never need to query for this personal data, the data at rest there is asymmetrically encrypted with the ...
0
votes
0answers
59 views
How to describe your experience in your CV/Resume without breaking copyright / GDPR rules?
Are there rules (EU & US) defining how far one can go in decribing his professional experience as a software developer, and telling about the projects he worked on?
For example, if I do not ...
0
votes
1answer
64 views
Why is my GDPR (a.17) request not fulfilled?
For over a year, I'm trying to get "wordpress.org" to delete my personal data from their bugtracker (the pseudonym is linked to my full personal address).
According to https://wordpress.org/...
0
votes
2answers
75 views
Inactive account deleted under GDPR (data retention) laws. Should the credit on it have been refunded to the account holder?
I have a situation where a UK utility (mobile phone) account has been inactive for more than 7 years.
The account was deleted under data retention laws (GDPR) but had a positive credit balance at the ...
-1
votes
1answer
42 views
GDPR account verification
I am having trouble in deciding what information I should be recording in order to verify an account user in the event that
a) the user is locked out of their account for some reason
b) they make an ...
0
votes
0answers
88 views
Is it illegal to refuse to fix a hacked website?
Suppose there's a website or a server that has been hacked. There is no personal data stored anywhere, so there hasn't been a real data breach, because basically there's no valuable data to steal at ...
1
vote
2answers
95 views
GDPR, PII, and UUIDs
GDPR states that
An individual is āidentifiedā or āidentifiableā if you can distinguish them from other individuals.
and also that
The GDPR provides a non-exhaustive list of identifiers, including:
...
1
vote
0answers
52 views
What is the penalty for not respecting GDPR outside EU? [duplicate]
What happens when a newspaper website in USA or in Australia or in Japan does not comply with GDPR?
Can EU punish them in any way?
0
votes
1answer
46 views
What's the rationale for “joint controller” instead of keeping every entity doing stricly separate?
After reading Case C-40/17 and Case C-210/16 I still cannot figure out why GDPR would require "joint controller" decision.
Wouldn't it be much simpler to decide that e.g. in "Fashion ID&...
0
votes
1answer
66 views
Who needs to implement Cookie Consent for embedded content?
Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <iframe>...
