Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
772
questions
0
votes
1
answer
80
views
Are javascript keyloggers on websites legal?
I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
- 1,245
0
votes
0
answers
68
views
Self-set needs-based salary
Is it legal, in regard to GDPR and Norwegian/European law, for an employer to ask their employees to
List their yearly monetary needs
Present their needs, to management for approval
Set their salary ...
- 101
2
votes
2
answers
52
views
Limits of automated decision making WRT workplace surveys
As part of the GDPR, if personal data is used for automated decision making a number of rules apply, particularly regarding consent and access to data.
A number of companies offer workplace surveys, ...
- 1,245
3
votes
1
answer
42
views
UK - Privacy Policy requirements for website with no tracking
Essentially I run a website which is a microblog for anyone to use. The user who creates the content does so on one domain which requires login, stores a cookie etc..
The reader (user) of the blog ...
- 161
0
votes
1
answer
47
views
My previous employer had a data breach
It seems my bank account details. Passport information. Address etc have been leaked. I left the company 3 years and 4 months ago.
It’s a private law firm. They have offered me a 12 month credit ...
10
votes
2
answers
3k
views
Can I store the names of arbitrary business associates in my CRM system?
I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships.
For example, "Gina works on reception."
Is this allowed ...
- 111
1
vote
1
answer
46
views
Collecting statistics from online gaming and GDPR obligations
I am looking to to build an interface within a sandbox pc game environment that will allow for the collection of tabletop wargaming game stats in addition to player online ID(steam name).
This data ...
- 13
1
vote
1
answer
73
views
Is it possible to send an additional email to people who didn't confirm their subscription?
We are wondering if we can send another email to people who subscribed to our newsletter but never clicked on the confirmation link sent afterwards. Is it ok GDPR-wise?
- 113
0
votes
1
answer
29
views
should a website show cookies popup in following context?
I am a part of developers team in a software as service project hosted and HQ-ed in United States.
Why I asking my question
I personally tasked to improve our analytics and one of tasks is to find an ...
0
votes
3
answers
76
views
Is there any restriction in the GDPR on creating a Whatsapp group?
I work with an assistance entity that helps people in situations of social vulnerability (poverty).
Surprisingly everyone has a cell phone and uses Whatsapp. Taking this facility into account, I ...
- 101
0
votes
2
answers
71
views
Is it possible to receive copy of deleted facebook messenger messages under GDPR?
Is it possible to receive copy of deleted private facebook messenger messages under GDPR if two recipients deleted them?
-1
votes
1
answer
103
views
Where is it stated in the GDPR that the GDPR only applies to EU citizens?
I recently came to the shocking realization that the GDPR does not apply to natural persons who are not EU citizens. I looked up the GDPR to find the Article or GDPR item that mentions this but could ...
- 109
1
vote
1
answer
41
views
Does an email hop in the US count as an international data transfer?
Alice is a data subject, Bob Inc. is a data controller processing her PII, both located in the UK. In responding to a subject access request, Bob Inc. sends some PII in plain text in an email. ...
- 1,245
0
votes
2
answers
47
views
Is Browser-Fingerprinting legal when I transfer/ store only the hash of user related attributes?
Is the following pseudo code, being executed within the browser, compatible with GDPR?
sha256(fonts + useragent + plugins + ..)
Notice: It doesnt store the actual attributes on the server, only the ...
0
votes
1
answer
74
views
Does the GDPR apply to reference managers?
Reference managers are software products that record the details of scientific papers that one interacts with. All academics and many others use them as a crucial tool of their work. Common examples ...
- 1,245
1
vote
1
answer
74
views
Is my name and email address being sent to another customer a GDPR violation?
An agency, to which I provided my personal email address (contains my full name), has emailed me and another of their customers (both emails in "TO" field).
The other customer and I have ...
- 153
1
vote
2
answers
40
views
Under The EU General Data Protection Regulation (GDPR,) do I need a legal obligation in order to divulge information to law enforcement?
Suppose I get a request from a law enforcement agency, for data that I'm already processing legally. Can I just give the information to the agency, or do I need to verify that I am under a legal ...
- 2,340
22
votes
2
answers
3k
views
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
- 231
3
votes
1
answer
82
views
Trans-Atlantic Data Privacy Framework - defined national security objectives
According to this release from the White House they state:
the United States is to put in place new safeguards to ensure that
signals surveillance activities are necessary and proportionate in the
...
- 133
2
votes
1
answer
61
views
Does the GDPR cover reference to court proceedings?
On this site many good answers are referenced by real court cases, usually in the form Surname vs. Surname [date] <link to further details>. There also exist documents (example is US so as not ...
- 1,245
3
votes
1
answer
89
views
Do sites need to explicitly ask for cookie consent as of 2022?
I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the ...
- 211
13
votes
2
answers
2k
views
Does the Companies Act 2006 trump an individual's right to be forgotten?
I once was a contractor and ran a limited company.
At the time all my details and my secretary's were published on the Companies House website.
edit: This information includes full names and addresses....
- 241
1
vote
2
answers
78
views
Penalties for requesting GDPR data you are not entitled to
Looking at Accessing public CCTV footage about you I could see a scenario where a stalker might request GDPR data & footage on a person they are stalking who has passed the camera.
So, imagine ...
- 121
1
vote
2
answers
2k
views
How does the personal/household activity exemption not apply to domestic CCTV pointed to the street?
I am surprised to learn that, in the UK, private/domestic CCTV cameras pointed to the public street make the owner GDPR controller — with all the consequences like having to respond to data requests ...
- 19.8k
29
votes
2
answers
5k
views
Accessing public CCTV footage about you
Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
- 429
1
vote
1
answer
69
views
If one requests bodycam footage of a police encounter involving another person, would they be notified of the request?
If party A calls the police on party B and they attend, then party B is entitled to request the bodycam footage of the encounter under the GDPR. If party B performs such a request, and party A appears ...
- 817
1
vote
2
answers
46
views
Do EU GDPR demands on a web hosting service extend to its clients?
If a web hosting service like GoDaddy or Wordpress.com is subject to GDPR, does it require they impose GDPR requirements on their clients?
Does it matter whether the client is subject to the GDPR or ...
- 357
1
vote
1
answer
62
views
Is it ok to use slack in EU without data residency option?
Since you can only setup Slack data residency in EU on the most expensive plans, is it ok to use their service still under GDPR rules without that option?
Would signing a DPA stating they are ...
- 113
1
vote
1
answer
62
views
GDPR: Storing consent for non-personal data cookie
According to GDPR you need to store information about consent given to using cookies. We don't process any personal data, but we place an analytic cookie (to recognize returning visitors) so we need ...
- 111
2
votes
1
answer
90
views
Is posting another persons PI on social media a GDPR violation?
If Alice posts Bobinators private information like full name and address on a Facebook group, in an attempt to warn others of bad experience with him, is it a GDPR violation?
Does it matter if a group ...
- 143
0
votes
1
answer
68
views
What are the limits of ID requirements for a subject access request?
When one makes a subject access request it is required that the data controller is required to ensure the identity of the requestor, to prevent unauthorised individuals accessing personal data of ...
- 1,245
2
votes
1
answer
582
views
Does the IP logging + user data apply to GDPR?
I read a lot about logging IP addresses, and it applies to GDPR:
Do default Apache logs violate the GDPR?
How to satisfy GDPR's consent requirement for IP logging?
My question is slightly ...
- 131
2
votes
1
answer
97
views
Is MailChimp compliant with GDPR?
In light of recent news of Facebook not being compliant with GDPR because it processes data in USA and not in europe, would a website using MailChimp for newsletter be GDPR compliant since it is based ...
- 143
1
vote
3
answers
96
views
How to avoid having problem with data protection regulations (GDPR)?
I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by ...
- 113
0
votes
1
answer
55
views
What global big tech does to comply with data protection laws all over the world?
Give this scenario...
A user in Germany, a user in US.
Each one decides to create an account on Facebook and facebook is located in US...
According with GDPR, US cannot store data from EU Citizens. So,...
- 111
0
votes
1
answer
36
views
What is the correct responce of a data processor to a SAR if they have multiple controllers?
In the case where a subjects data handled both by a data controller and a data processor, and the subject makes a data subject access request (SAR) of the processor the usual procedure if for the data ...
- 1,245
1
vote
1
answer
29
views
What references are available for the GDPR legitimate interests balancing test?
A basis for the processing of personally identifiable data (PII) is legitimate interest. According to the UK ICO data controllers who rely on this basis should conduct a legitimate interests ...
- 837
0
votes
1
answer
51
views
How does GDPR Art. 14 apply to large scale B2B data transfer
Article 14 of the GDPR appears to require any data controller to inform the data subject when a business to business transfer of personal data occurs. Business to business transfer of personal data ...
- 1,245
3
votes
1
answer
63
views
Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever
I have a small static personal website, where I publish some technical articles and my personal CV.
Do I need to include a privacy-policy if:
There are no (third- or first party) tracking services ...
- 33
1
vote
1
answer
61
views
Under GDPR can a company give out the demographics of employees e.g. ethnic background without anonymising it?
If a client asks for the demographics of a company's employees e.g. female to male ratio or ethnicity. Does this have to be anonymised so it is compliant with the GDPR or can the names be revealed?
- 231
2
votes
1
answer
77
views
Can I use forum posts related to user to analyze them?
I would like to create an app, which would make analyses based on user behaviors, posts, comments.
I can gather those data from sites, forums because e.g twitter and so are public websites, they are ...
- 123
3
votes
1
answer
103
views
Does failure to provide photo of face count as breach of GDPR in UK?
I have requested that an aesthetic clinic send me the 'before' images taken of my face before a procedure two times via email. They have ignored my requests while responding to other questions in the ...
- 343
3
votes
1
answer
44
views
"Destiny" of issued certificates after account deletion
Lets say I have a online-training platform where I issue "completion certificates" to users who complete the course (like Udemy, Coursera, etc.).
One day a user wants to delete their account....
- 133
0
votes
1
answer
58
views
Is GDPR consent as part of Terms & Conditions valid?
In the terms and conditions of the kite festival consent for use of footage of the audience is written into the Terms & Conditions:
5.c: Ticket Holders consent to being photographed, filmed and ...
- 1,245
1
vote
1
answer
182
views
Is it obligatory to make my name and address known publicly in compliance with Art 13 GDPR?
I'm a private individual. I live in EU. I'd like to create a personal blog on blogger.com and put there Google AdSense advertisements. Do I have to state there also publicly my given name, surname, ...
- 13
2
votes
1
answer
81
views
A scholarship organization is publishing my personal information on their website
In February 2018, I received a one-time scholarship (1000 €) from a private association in the EU. A few months ago, I noticed the organization published on their website private information of the ...
- 21
1
vote
1
answer
46
views
GDPR (and data protection laws in general) in regard to non-commercial, personal database
(this is the closest StackExchange site I could find, even so, I'm sorry if the Q is still a bit out of place).
So, I've just finished building an application for better handling some of my needs and ...
- 113
1
vote
2
answers
148
views
Is blocking third-party phone numbers GDPR-compliant?
To be compliant with GDPR you have to process phone numbers as personal data.
Suppose there is a service which users can subscribe to in order to block calls from numbers which the users nominate. The ...
- 21
12
votes
5
answers
4k
views
How can I get more than 10 years of transaction history from my bank?
I will shamefully admit that it was only in the year 2021 that I finally built my own bookkeeping system. Yes, I should have done it 10-20 years ago, but I didn't. So now I'm in this situation:
First ...
- 147
0
votes
3
answers
55
views
GDPR - access to transaction data
Is it within my rights as a user of a payment service like Paypal or Western Union, to ask for the full details of a transaction that I did (namely the card number of the recipient) ?
edited : bank ...
