Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
1
vote
3answers
22 views
Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?
I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
2answers
50 views
GDPR: Is giving out customer name and implied existence of customership legal?
I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable.
The purpose is to ...
2
votes
3answers
83 views
Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?
GDPR Article 39(1)(b) states:
The data protection officer shall have at least the following tasks:
(b) to monitor compliance with this Regulation, with other Union or
Member State data ...
1
vote
1answer
27 views
If we anonymize Google Analytics IPs do we still need to ask for Cookie consent?
Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent?
If so ...
1
vote
1answer
22 views
What data processing requires opt-in consent for an existing customer under GDPR?
I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where ...
1
vote
0answers
48 views
To achieve ECTS credits at my school a student is forced to drop his/her right of privacy
Some background about the situation:
I attend a vocational university (university of applied sciences)
I live in the Netherlands - Europe
We have a mandatory activity that provides us with ECTS ...
1
vote
1answer
35 views
Does the GDPR mandate that web sites provide access to cookie settings?
Cross referenced this question with SO just to get more technical perspective
In this article it says with respect to:
Google Analytics and GDPR consent to cookies and tracking:
Based on a true ...
1
vote
2answers
46 views
Does CNNs cookie consent banner comply with the GDPR?
I just got done reading this cookie consent material and it says that we need to keep a record of cookie consent. It also says that the notification needs to allows users to opt in and out of ...
1
vote
1answer
59 views
to be in photo and video, and right to ask for removal these data relying on GDPR
At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs.
Now, I want my pictures to be erased, or any data, ...
1
vote
1answer
19 views
Handling medical data received from outside the EU
If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU?
In particular, does ...
1
vote
2answers
50 views
GitHub pages and GDPR - controller, processor and DPA
I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain.
The only potentially personal data that the site will ...
1
vote
1answer
16 views
GDPR and date of fields creation / update
Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields :
client_id
name
first_name
and that I want to be GPDR Complient does I ...
3
votes
1answer
58 views
How to make data brokers delete my information without providing more information? Can I take legal action?
I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
2
votes
1answer
42 views
What is “a place where Member State law applies by virtue of public international law”?
Art. 3 (3) GDPR mentions that:
This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of ...
1
vote
0answers
42 views
Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?
It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
13
votes
3answers
2k views
Why can't I add a governing law to my terms of service to avoid GDPR?
I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
9
votes
1answer
1k views
Does GDPR cover the collection of data by websites that crawl the web and resell user data
I have found that a lot of my personal info is now available on a bunch of websites that collect data and resell it.
I'm talking about those 'find anything about anyone' websites.
A lot of the data ...
0
votes
1answer
62 views
Does GDPR require consent for a processor to confirm or deny the existence of data?
Assume we have two separate lists of emails handled by two different processors. List A is gathered by company A in a way that the subject has given their consent for its processing for marketing ...
1
vote
1answer
46 views
Does allowing users to see user tracking on my analytics software violate GDPR?
I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard:
However, you can click on a user ID (right) like abaer and see ...
3
votes
1answer
53 views
Requesting to see holiday rota and GDPR
my partner has asked if she can see the holiday rota and was told she couldn't because of GDPR. Is that correct? I know anything that identifies you needs to be secure but the rota of when people are ...
2
votes
0answers
51 views
Removing my personal data ex-employer (RGPD/GPDR ?)
I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
3
votes
1answer
3k views
Salesman text me from his personal phone
I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me ...
1
vote
1answer
38 views
Do you have to provide the name and email address of your data protection officer?
Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them:
You can contact Valve's data protection officer at the address below.
While we ...
6
votes
1answer
913 views
Is it okay to store user locations?
I know it might sound quite bad. But here I explain the whole situation.
I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
2
votes
1answer
36 views
GDPR data portability when no data stored
My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have ...
1
vote
1answer
20 views
GDPR collecting vs storing
I have a website that stores no personal data, however it does use ($_SERVER['REMOTE_ADDR']), a code that scans the IP address of visitors, but the IP address isn't stored anywhere. It's only scanned ...
0
votes
1answer
115 views
GDPR: Can a website not process personal data?
I want to have a website where I publish my own articles.
When a user requests a webpage, I receive an HTTP request from their browser, which contains the IP.
Now, for a split second while the ...
1
vote
1answer
53 views
Identity photographs under GDPR
Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018?
...
2
votes
1answer
34 views
Is it a violation of GDPR law to email personnel gathered from hunter.io?
I'm a web developer working on a project for a client. The project is a directory of sustainable companies (enviromental-friendly companies). The project is only launching now.
The companies listed ...
2
votes
1answer
35 views
GDPR Requirements for restricted use corporate webapp [closed]
The GDPR is very complicated, and while its requirements may be crystal clear to those who are intimately familiar with it, it is not at all clear to most as to what the exact requirements are in all ...
1
vote
1answer
35 views
What are the types of personal data?
In the GDPR, the concept of data categories is used and examples of such categories are given. The concept of data types is also used, but I do not know what they are.
Example of data categories, ...
3
votes
1answer
75 views
As a customer, am i liable for messaging another customer found on a Facebook business page?
I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company.
I have received a ...
1
vote
0answers
53 views
A company finds out that it has made a material decision based on incorrect personal data, what should it do?
A company terminates an employee based on what it believes to be a record of the actions of person gained from log files.
Months later the company finds out that this information is not correct.
...
0
votes
1answer
21 views
When to authorize someone and when to sign a contract for processing personal data
There are two ways for the data controller to let someone else process the data he controls:
authorise him or her to do so,
sign a legal contract making him or her a 'processor' (Article 28 GDPR).
...
-2
votes
1answer
167 views
Google AdWords banned my account. Can I request complete deletion under GDPR?
GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on ...
5
votes
1answer
45 views
The circumvention of terms and conditions
There are sites, for example 'moodys.com', which require an explicit agreement to the terms and conditions on every vist (e.g. https://www.moodys.com/research/Moodys-affirms-Chang-Hwa-Commercial-Banks-...
0
votes
1answer
31 views
Data Portability in GDPR
I've reading:
https://gdpr-info.eu/art-20-gdpr/
It says:
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, ...
0
votes
0answers
30 views
How does GDPR apply for normal email communication?
I am a member in an association and in charge of membership management and general IT. We exchange information about the work of the association by email using private mailing lists the association ...
1
vote
1answer
46 views
Users counting and GDPR
Do I need a GDPR "coockie" banner if I implement not a unique identifier but only a naive counter?
My web app check a key presence in local storage. Key is the same for all. If it's not found - call /...
2
votes
2answers
53 views
Is it allowed to collect additional personal data to comply with the information obligation (Article 14 GDPR)?
True story. A bank erroneously sends its clients' data to a company: name, surname, national identification number. The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and ...
3
votes
1answer
64 views
Is it legal to have a opt-out of marketing emails checkbox under GDPR?
As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-...
1
vote
2answers
87 views
Is it legal to ignore “Do Not Track” for data subjects who fall under the GDPR?
The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different ...
1
vote
1answer
42 views
The case of creating personal data by combining non-personal data
In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
6
votes
2answers
190 views
If photos are PII under GDPR, how are most photos on the web legal?
It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal ...
0
votes
0answers
14 views
GDPR the other way arround [duplicate]
Let's say that there is a site with a list of people that did one thing. Once with GDPR rules, those people can ask to be removed from that site. I was wondering if that site changes the way it makes ...
1
vote
1answer
18 views
Is information only about financial transactions personally identifiable in terms of GDPR?
I am creating application where you can manage your incomes/expenses e.g. on eBay. Main functionality is:
create new item and specify price you've payed to get it
set price that you've
All other ...
4
votes
1answer
40 views
Should all gdpr related documents be translated to all official EU languages?
I wrote application localized in Ukrainian language , which is not one of the official European Union languages. Since I reside in the EU territory I need to comply with gdpr. This application is ...
3
votes
2answers
103 views
anonymisation/redaction of public website content as response to 'right to erasure'
An organisation runs some public email lists. These are archived, and the archives are also publically available from its website.
A user of the mailing list asserts their "right to be forgotten" and ...
0
votes
1answer
48 views
Data Scraping public athlete name and performance data. Does this need to be treated as personal data?
Consider the following data for amateur/professional athletes:
Athlete name,
Athletic event + best performance data
e.g.:
Joe Bloggs
5k 19:00
10k 40:00
Half Marathon 85:00
other events etc...
and ...
1
vote
0answers
34 views
Minimal GDPR requirements for a website
Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options:
Agree
Decline
"Read more" link to a common page "What are cookies?"
Additionally I ...
