Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
686
questions
0
votes
1answer
26 views
Responsibilities and GDPR reporting in case of hacked email marketing platforms
Company A allows subscription to its newlsletter via email, and their email list and newsletter is taken care of by company X. So A is hosting the page where one can subscribe, X handles list and list ...
2
votes
2answers
65 views
Is it legal to process PII in EU of customers which are not in EU?
So I have an app that processes the PII of users and their interests, the app is south Asia based. The app doesn't support EU customers and is geo-blocked by default.
I would like to process and store ...
1
vote
1answer
59 views
How long can a company take to answer my GDPR request to download my data?
In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be ...
0
votes
1answer
27 views
Is email verification required before asking users to enter personal details? GDPR-related
Is email verification step required before asking users to enter personal details?
A bit lost in GDPR documents.
Should contract between user and the app be signed (via phone number + sms or email + ...
1
vote
0answers
34 views
Data representatives in EU, UK, Switzerland - are there more countries requiring this?
The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
4
votes
1answer
74 views
Are there privacy laws other than GDPR which consider IP addresses as personal data?
In EU's GDPR the IP address is considered personal data (lots of discussions about it, but this seems to be the correct interpretation at the moment). Several countries have now privacy laws which are ...
2
votes
1answer
89 views
Is the Vilnius-Lublin portal a violation of GDPR?
Don’t get me wrong, I love it!
But is it GDPR compliant given that people walk up to a camera that will broadcast their image outside of their country?
See also this news story and this one
0
votes
1answer
63 views
The Data ownership for an automated server running for years prior to GDPR Regulations
Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various ...
1
vote
2answers
105 views
The scope of GDPR and the right to be forgotten
I have three doubts about GDPR compliance in modern systems, specifically about the "Right to be forgotten" section in the GDPR.
What I would really like to understand is whether the right ...
0
votes
1answer
48 views
Can a pre-ticked checkbox be used to RECALL/REVOKE consent under GDPR and/or ePrivacy/cookie law?
I wonder, can a pre-ticked checkbox be used to recall/revoke consent, or does revoking/recalling consent need to be a separate, explicit action?
I have made a specific consent function like this:
When ...
8
votes
2answers
2k views
Does The “Right To Be Forgotten” Include Sent Emails?
Say that you maintain an email service, and person A, sends an email to person B who is also on your email service. If person A deletes their account would that mean that person B no longer can view ...
0
votes
1answer
87 views
Is there any chance of getting a penalty for cookies with no notification for a private person with small site?
I am planning a small demo application using DRF and when using the DRF web interface csrftoken cookies are saved by default. After reading tons of material about GDPR and cookies I completely disable ...
1
vote
1answer
63 views
Impact of GDPR on remote work outside of the EU (as LLC)?
I do remote work for clients in the EU. The legal foundation is a B2B contract between two EU legal entities, one of which is the client's limited company, the other my limited company. Since both ...
0
votes
1answer
66 views
GDPR - Are the typical lists of examples for personal data misleading?
Article 4 of the EU GDPR states
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);
The explanation for the term ‘personal data’ as
...
0
votes
1answer
93 views
Identifying attackers and GDPR. In which cases is it legal?
Various techniques can be used to identify stalkers, malicious hackers et al. that are either gathering data for their target or use the target's digital items without consent.
Canary files
They are '...
0
votes
0answers
47 views
Is securely storing and using customer credentials and passwords in customer-commissioned software GDPR compliant?
My team is in charge of developing integration software for our customers. The customer integrates their system with our platform in order to use our services.
Numerous customers avoid managing their ...
5
votes
1answer
943 views
Talent consent withdrawal in film in Europe
Consider the following scenario of right to erasure in film-making in Europe. Person A makes amateur live-action films, for example theater performances. Person B is in one of those performances and ...
1
vote
1answer
48 views
What laws should I be aware of if I were to start a business scraping profile content from a website and using this content to build another website? [closed]
The idea is to build websites for people (in the UK (at least to start with)) using content that they have uploaded to another website. I will cold-call them, ask them if they would like a website and ...
0
votes
1answer
82 views
Legal obligations of a company in case of GDPR-related vulnerability
First of all I would like to state that my question occurs in a context of EU laws and EU citizen.
I found a vulnerability in a product distributed in a few companies of EU countries. This ...
1
vote
2answers
80 views
Privacy and GDPR on Facebook
I have a doubt regarding the privacy on Facebook and the law application.
Also lawyers That I have spoken with, seem not very sure about the matter.
In particular I would like to know if it is my ...
4
votes
2answers
817 views
If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?
I used to work for a company, where they have a team of moderators, who actively monitor which accounts are scammers etc. To monitor this they can find links between user accounts via a users password,...
2
votes
1answer
37 views
What are the limits of service provision/PII consent for compliance with GDPR?
Most of the internet business model can be described as providing data in exchange for seeing adverts. These adverts are worth a lot more if they can be targeted. The GDPR applies to this, such that ...
1
vote
1answer
61 views
Is it GDPR compliant to hide a competition entry behind a requirement to sign up to a newsletter
I'm looking to run a giveaway competition on my website. The main aim of the competition is to get signups to our email newsletter. I'm therefore proposing that 1. a user signs up to my newsletter (...
0
votes
3answers
131 views
GDPR Disclaimer On Cold Call Emails
I live in the United States. I am helping someone who just started an online store selling tee shirts. In my research to come up with a plan regarding cold call email marketing, I came across GDPR. ...
10
votes
1answer
694 views
What actions to take when a Data Processor doesn't respect GDPR?
We've recently exchanged emails with one of our Data Processors, because they don't grant the ability to permanently delete hosted documents (pdf, png, etc.) on their platform. Such documents might ...
5
votes
1answer
381 views
Do I need to offer a data processing agreement
I recently created a browser extension that allows you to pretty-format a web page and save it in various formats (Word, PDF, etc). I have made it publicly accessible through the browser extension ...
0
votes
1answer
30 views
Can you request response to SAR by web form?
When one makes a GDPR Subject Access Request (SAR), one can specify a particular form of response, for example by email. Also the data can be requested in a structured, commonly used and machine-...
1
vote
1answer
57 views
Does the Data Protection Act 2018 in UK require users of a website to explicitly
Now that Brexit has happened, GDPR no longer takes effect in UK.
However, the Data Protection Act 2018 will continue to apply.
With GDPR's Article 6, a website is required to request explicit consent ...
5
votes
1answer
128 views
GDPR unbelievable legitimate interest. What action to take?
If a website is claiming legitimate interest in data collection in a way that is unbelievable is there any action that a web site visitor can take?
For example, if one was to visit The Daily Mail you ...
3
votes
2answers
84 views
Creative commons attribution and GDPR
When using content released under an open licence such as creative commons, it might be required to provide attribution to the author.
For instance, if I were to use this image from Wikimedia Commons ...
1
vote
1answer
50 views
How far up the chain of internet provision does my GDPR responsibility go?
Say I host a web page on my computer, and you visit that site from somewhere in Europe. The web server on my computer will know your IP address, and I can choose to "forget" it as soon as ...
1
vote
1answer
83 views
Is client-side encrypted data really personal data
Scenario: My service that is storing customer files is hosted on my own personal physical server, “on-prem”. It is then using one of the popular cloud storage services (Azure blob storage, AWS S3) to ...
1
vote
1answer
54 views
Can I sell the GDPR data I requested?
If I request to download my personal data under GDPR, from sites like Google or Facebook, is it legal for me to sell that data?
0
votes
3answers
66 views
GDPR, personal and political activity
The GDPR does not apply to the processing of personal data that is "by a natural person in the course of a purely personal or household activity". I cannot find a description of "...
1
vote
1answer
89 views
Data deleted prior to GDPR access request
A company recieves a request to access personal data. They realize that they got the request two weeks after data collection; by this time all data is deleted. What would a company reply if such ...
2
votes
1answer
87 views
GDPR and Telecom law broken, mobile network operator refuses to disclose user of a phone number
I got today a very unnerving phone call. It was a telemarketing, but unlike any other I had before, this was automated system and it suggested it knew much more about me than my number. I'm talking ...
5
votes
2answers
2k views
Repercussions of defying the Cookie Law
I was wondering what case law is out there on the subject, or, if there is not much, what real repercussions can website owners who defy the Cookie Law expect?
Say Bob is not only pissed off by the ...
1
vote
2answers
69 views
The UK GDPA article 17 right to erasure. Can I retain the person's ID number if it no longer identifies them?
I manage a small relational database for members of a club with about 600 members. The 'member' table has records holding the memberID , their name, address phone etc. The memberID is then used as a ...
-1
votes
1answer
60 views
Who is data controller for automatic communications under GDPR? [closed]
This is how automatic communications infastructure works :
an automatic communications creator registers with an automatic communications service . Users registered with this automatic communication ...
1
vote
1answer
50 views
Saving websites for archiving
I am looking into archiving certain articles of websites (not the whole website or nothing similar) I'm interested in, to keep a personal archive of information I want to have available or that I want ...
2
votes
2answers
109 views
Scraping FB phone numbers
I am an EU citizen who codes. I have a project, which works this way:
program enters a word into Facebook search
program extracts links to the Facebook pages
program scrapes (gather and save) the ...
0
votes
2answers
92 views
GDPR - does it give the right to unnecessarily ask to be removed from a group?
Can the users of a messaging group ask under GDPR the owners of the group remove them? Then rejoin to repeat (it leads to more processing of their data) if the messaging service provides a "leave ...
1
vote
1answer
60 views
Is the creation of a cookie with a anonymous id a violation of GDPR even if it's not used until consent?
We run a website with a global user base and need to respect GDPR compliance for those visitors that the law applies too. Since we are on Shopify we are currently making a front-end request to check ...
1
vote
2answers
66 views
How long can an employer keep financial details after employee has left under GDPR?
I finished a job in 2019, but just received notification of a data breach at that job in 2021, and my bank account number, sort code, national insurance number, full name, address and date of birth ...
1
vote
1answer
164 views
UK Law Question (England): Can I Sue someone if they post a video of me on social media Without my Consent?
Scenario: Someone starts talking to you while they record you without you knowing it. You notice they're recording you and they tell you the video is going on Youtube. You tell them that this is only ...
1
vote
1answer
57 views
GDPR & Privacy Policy for a personal website where the only potential personal data is IP logs
I'm based in the UK, and I am building a personal website (basically an online resume/portfolio) which I have ensured does not collect any personal information (there are no forms, cookies etc.). I do ...
0
votes
1answer
50 views
Should I blur personally identifiable information on Facebook screen recording for YouTube?
(Global question: EU, US, etc)
I'm recording a video for YouTube where I show how browser extension works while surfing through different Facebook Groups, Business Pages, Personal Profiles, etc.
...
0
votes
1answer
53 views
Are Wix.com and WordPress.com GDPR compliant?
When signing up to Wix.com or WordPress.com there is a bundled consent practice which seems to violate Art.7(4).
Note than even no Privacy Policy mentioned in WP.com
https://automattic.com/privacy/
...
2
votes
1answer
35 views
Can I use Facebook Chat Plugin without asking GDPR consent?
My webpage has no analytics because I don't want to show the GDPR consent popup to users. Would I violate GDPR if I integrate the Facebook Chat Plugin without adding the GDPR consent popup?
1
vote
0answers
30 views
GDPR data deletion: can I ask the company to delete the data it had exported in the United States?
I am located in Italy.
I have subscribed to a service and provided some PII that "could be exported in the United States".
If I send a GDPR request to delete my data, can I ask them to also ...
