Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
804
questions
3
votes
1
answer
59
views
Tenancies and the GDPR
If Tim the tenant and Larry the landlord enter into a tenancy, then do either of them become a data controller of the others name and address? Does the landlord as the "provider" of the ...
- 3,880
5
votes
2
answers
1k
views
Under GDPR, does blurhash of a profile picture count as personal data
Suppose I have a web service where users can have a profile page with name and picture. Blurhash is a technology that allows me to create a significantly blurred representation of an image, as a ...
- 161
1
vote
1
answer
65
views
"Find my device" and GDPR compliance
Google and Apple both offer a "Find my Device" service which allows to track or even remotely wipe a stolen device. Yet some companies claim that tracking stolen devices is not a legitimate ...
- 1,249
0
votes
2
answers
56
views
Server side analytics events
If I track a 'questionnaire started' event with a user's GUID for analytics purposes server side, could that contravene any UK data laws such as GDPR or the ePrivacy / cookie consent law?
The reason I ...
- 101
2
votes
2
answers
74
views
Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?
Suppose I check into a German hotel and a Johann stayed in room 123 on the previous night.
Presumably, he is the only Johann who stayed in the room on that night.
There are many Johanns within Germany ...
- 2,370
22
votes
2
answers
2k
views
Other use of profile photos: legality fair-use and permissions
I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). ...
- 329
0
votes
2
answers
38
views
If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?
Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with ...
- 1,770
1
vote
1
answer
87
views
Under what circumstances is it lawful or unlawful for police to disclose one's information to third parties, e.g. complainants?
Is it basically neither prohibited nor required and thus entirely to police discretion as to whether or not to disclose parties' details to either their purported victims, or to other parties like ...
- 3,880
0
votes
1
answer
70
views
Do I need to worry about GDPR, CCPA, CalOPPA, if collecting anonymous usage for a non-commercial, no-ads app?
I am developing a free, non-commercial Android App that does not use Ads or in anyway attempt to share their information with a third-party. However, I would like to include both Google Analytics and ...
- 103
0
votes
2
answers
101
views
Any obligation to disclose one's name and address to private parties for service of civil claims after a street altercation?
Suppose A is walking down the street and B punches A in the nose, thus committing assault. Legally, A is entitled to claim civil damages against B, and can practically do so if they know A's name and ...
- 3,880
1
vote
2
answers
160
views
Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?
(Apologies in advance for the lengthy epistle)
Background:
A colleague is planning to launch a social media and forum website which will appeal to a relatively narrow audience. For the sake of ...
- 195
15
votes
3
answers
3k
views
GDPR & Blocking EU Visitors?
I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
- 195
0
votes
1
answer
36
views
Under GDPR, do organisations have to tell the ICO (or similar) the email address they use for GDPR deletion requests?
As is well known, websites (illegally) use deliberately misleading and frustrating web design to slow down users who want to tell them not to collect information for marketing purposes.
If they ...
- 233
12
votes
5
answers
1k
views
Are auto-generated identifiers PII if they cannot be linked to an identity?
The reason for this post is to express a contradiction that seems to be widespread in some places on the internet.
I'm not a lawyer, I'm a software developer doing my best to comply with the GDPR and ...
- 303
2
votes
3
answers
73
views
Is storing on EU-based servers sufficient to be GDPR-compliant with regard to the Schrems II arrest if they're controlled by a U.S. company?
After the Schrems II decision, data transfers to US data processors are increasingly risky at best, for example to public cloud providers such as GCP, Azure, and AWS.
A very common suggestion is to ...
- 123
2
votes
1
answer
225
views
Do pastebin sites have to delete content on request?
A pastebin site, hosted in the US, allows users to post data anonymously. However, its intended purpose is for sharing information about one's computer, including the username (which is sometimes PII)....
- 4,826
1
vote
1
answer
63
views
Does the ePrivacy directive apply to general JavaScript code?
Sweden have a "cookie law" that requires constent for non-necessary cookies. But the law seems way more general.
Information may be stored in or accessed from a subscriber's or user's ...
- 13
2
votes
2
answers
81
views
GDPR and personal data reselling
The situation is following:
I had an account in company A which then was sold to company B, both conduct online services.
I wasn't aware of this because I didn't log in to my account for several years,...
- 145
14
votes
2
answers
3k
views
Why does the GDPR matter to me, a US citizen with no property in Europe?
I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
- 4,826
0
votes
1
answer
34
views
Do you need to remove a customer's data for GDPR or the like, if that data has been anonymized and used as part of an aggregate?
Say I have a SaaS which collects users financial information, or location information, or other random information, and aggregates it in an anonymous way. Say for example I present to my users "...
- 101
0
votes
1
answer
34
views
GDPR - When does data become personal data, and what exactly comprises personal data?
As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following:
...
- 103
2
votes
1
answer
69
views
Data backups, data loss, the GDPR right to be forgotten, and timing
This question concerns the timing of GDPR demands in regard to the "right to be forgotten", and data loss.
I am considering creating a web app that allows users to play a game against one ...
- 135
-2
votes
1
answer
111
views
GDPR Compliance for Application That Guesses Email Addresses
I live in the U.S. and am developing a browser extension that grabs a person's first name, last name, and company name from their LinkedIn profile and then attempts to guess their email address based ...
- 13
4
votes
1
answer
318
views
What is the most comparable American law to GDPR right to subject access? Privacy Act?
HIPAA seems comparable but only applies to medical data, but is there anything more general than that?
How does privacy act compare to data subject access rights under gdpr? Is it that it only applies ...
- 3,880
1
vote
1
answer
85
views
Are terms of use considered a contract from GDPR point of view?
If service terms of use doesn’t talk about setting up a contract between the company and the user, can you use «execution of contract» as the lawfulness for GDPR processing ?
If signup data is ...
- 137
1
vote
1
answer
36
views
What’s the internal DPO access level?
Since the internal Data Protection Officer (DPO) should be independent, he needs to have access to all company files. But should he have access to everything at all time, or can the company only allow ...
- 137
0
votes
1
answer
103
views
How does Facebook justify non-compliance with GDPR subject access requests?
At first when Max Schrems started doing it they complied in good faith completely.
Now they don't. Do they have some legal theory or workaround as to why they were required to back then but no longer ...
- 3,880
1
vote
1
answer
66
views
Legality of Credit Bureaus selling information without consent
I recently had a hard pull for a mortgage done (USA based). Since then, my personal phone number has been bombarded with calls and texts related to "better offers", despite being registered ...
- 440
1
vote
1
answer
46
views
Google CCPA Request
In Google's CCPA report, it claims that users can request data deletion via this link. However, the link provides no way to submit a request, and Google claims that there is no Google-wide support ...
- 139
0
votes
1
answer
147
views
Why does Clearview AI get multimillion dollar fines while Pimeyes is allowed to operate freely?
Yesterday the UK has fined Clearview AI 7.5 million pounds for a string of breaches of local privacy laws. The main reason for the fine is that Clearview has never asked individuals whether it can use ...
- 133
2
votes
1
answer
125
views
GDPR - asking for consent indefinitely if respondent says no, until respondent say yes by exhaustion. Confirming choices allegedly forcing behaviour?
Under EU regulation, GDPR concerns dealing of personal data and describes the different parties that are responsible for handling those data.
While navigating on the internet, a pop-up is prompted ...
- 121
2
votes
1
answer
48
views
GDPR on 3 attributes of scraped data
I have scraped horse rating data with the intent of hosting an API users can subscribe to and query the dataset in various different forms e.g. Excel, JSON etc... with added analytics applied as well.
...
- 123
1
vote
1
answer
58
views
Essential cookies - legal responsibilities
I'm using Stripe to process payments on my site
The only cookies the site uses are set and processed entirely by Stripe
The cookies would only apply to users who have 1) created an account, and 2) ...
- 111
0
votes
1
answer
110
views
Are javascript keyloggers on websites legal?
I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
- 1,770
0
votes
0
answers
78
views
Self-set needs-based salary
Is it legal, in regard to GDPR and Norwegian/European law, for an employer to ask their employees to
List their yearly monetary needs
Present their needs, to management for approval
Set their salary ...
- 101
2
votes
2
answers
53
views
Limits of automated decision making WRT workplace surveys
As part of the GDPR, if personal data is used for automated decision making a number of rules apply, particularly regarding consent and access to data.
A number of companies offer workplace surveys, ...
- 1,770
3
votes
1
answer
49
views
UK - Privacy Policy requirements for website with no tracking
Essentially I run a website which is a microblog for anyone to use. The user who creates the content does so on one domain which requires login, stores a cookie etc..
The reader (user) of the blog ...
- 171
0
votes
1
answer
52
views
My previous employer had a data breach
It seems my bank account details. Passport information. Address etc have been leaked. I left the company 3 years and 4 months ago.
It’s a private law firm. They have offered me a 12 month credit ...
10
votes
2
answers
3k
views
Can I store the names of arbitrary business associates in my CRM system?
I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships.
For example, "Gina works on reception."
Is this allowed ...
- 111
1
vote
1
answer
55
views
Collecting statistics from online gaming and GDPR obligations
I am looking to to build an interface within a sandbox pc game environment that will allow for the collection of tabletop wargaming game stats in addition to player online ID(steam name).
This data ...
- 13
1
vote
1
answer
75
views
Is it possible to send an additional email to people who didn't confirm their subscription?
We are wondering if we can send another email to people who subscribed to our newsletter but never clicked on the confirmation link sent afterwards. Is it ok GDPR-wise?
- 113
0
votes
1
answer
32
views
should a website show cookies popup in following context?
I am a part of developers team in a software as service project hosted and HQ-ed in United States.
Why I asking my question
I personally tasked to improve our analytics and one of tasks is to find an ...
- 103
0
votes
3
answers
83
views
Is there any restriction in the GDPR on creating a Whatsapp group?
I work with an assistance entity that helps people in situations of social vulnerability (poverty).
Surprisingly everyone has a cell phone and uses Whatsapp. Taking this facility into account, I ...
- 101
0
votes
2
answers
107
views
Is it possible to receive copy of deleted facebook messenger messages under GDPR?
Is it possible to receive copy of deleted private facebook messenger messages under GDPR if two recipients deleted them?
-1
votes
1
answer
107
views
Where is it stated in the GDPR that the GDPR only applies to EU citizens?
I recently came to the shocking realization that the GDPR does not apply to natural persons who are not EU citizens. I looked up the GDPR to find the Article or GDPR item that mentions this but could ...
- 109
1
vote
1
answer
46
views
Does an email hop in the US count as an international data transfer?
Alice is a data subject, Bob Inc. is a data controller processing her PII, both located in the UK. In responding to a subject access request, Bob Inc. sends some PII in plain text in an email. ...
- 1,770
0
votes
2
answers
61
views
Is Browser-Fingerprinting legal when I transfer/ store only the hash of user related attributes?
Is the following pseudo code, being executed within the browser, compatible with GDPR?
sha256(fonts + useragent + plugins + ..)
Notice: It doesnt store the actual attributes on the server, only the ...
0
votes
1
answer
81
views
Does the GDPR apply to reference managers?
Reference managers are software products that record the details of scientific papers that one interacts with. All academics and many others use them as a crucial tool of their work. Common examples ...
- 1,770
1
vote
1
answer
77
views
Is my name and email address being sent to another customer a GDPR violation?
An agency, to which I provided my personal email address (contains my full name), has emailed me and another of their customers (both emails in "TO" field).
The other customer and I have ...
- 163
1
vote
2
answers
44
views
Under The EU General Data Protection Regulation (GDPR,) do I need a legal obligation in order to divulge information to law enforcement?
Suppose I get a request from a law enforcement agency, for data that I'm already processing legally. Can I just give the information to the agency, or do I need to verify that I am under a legal ...
- 2,370