We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0
votes
1answer
27 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
0
votes
2answers
46 views

Is anonymous analytics data subject to GDPR?

I am reading the definition of "personal data" here https://gdpr-info.eu/issues/personal-data/. My understanding is that GDPR comes into play when information is about personal data. Let's say there ...
1
vote
0answers
41 views

GDPR in a scientific, transborder scenario

Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole ...
1
vote
1answer
43 views

User-solicited personal information beyond consent

What does the GDPR say about personal information provided by a user of a service about themselves, in the case that the service sign-up process and ToS have always asked of the users not to provide ...
0
votes
2answers
45 views

GDPR compliance in ads SDK for iOS/Android

I have opened this question in SO, but was suggested to ask here, as the solution might come from a lawyer, rather than developer. I work on a native ads SDK for iOS/Android (banner, interstitial, ...
0
votes
1answer
52 views

GDPR - We're a global company and are expanding to Europe, do we need to save data there?

We're a global company and are expanding to Europe. We have users log in to our service and then they can use it. If a user is from the EU, do we have to store all of their personal information ...
1
vote
1answer
70 views

Can the GDPR be used to ask free race photographs?

A lot of time pictures of participants are taken during a sports event. These are often sold afterwards for e.g. 10 euro each. Some people just share the watermarked image on social media. But my ...
2
votes
2answers
96 views

What an employer can legally ask to monitor about user activity

I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's ...
4
votes
2answers
226 views

Are Blizzard breaking GDPR by charging people for changing their usernames?

I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago. I now want to change it again because searching it on Google ...
3
votes
1answer
180 views

Is it legal for Blizzard to demand a copy of my government id before deleting my account?

I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so. I've seen a somewhat related question about Twitter at How can I get Twitter to delete my ...
1
vote
1answer
75 views

How can I get Twitter to delete my account?

I want to delete my old (7 years unused, never logged in) Twitter account. I lost the email to it, but it has my name so I would like to delete it. I wrote Twitter support twice and told them "This is ...
0
votes
0answers
42 views

Does USA have a law similar to GDPR that gives you the right to a copy of the information a religious organization has on you?

For some background: the EU "Data Protection Directive" is a European Union directive which regulates the processing of personal data within the European Union, as explained in this Wikipedia article. ...
0
votes
1answer
46 views

GDPR on Proxy Users

I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc... My questions here are about the scope of GDPR. Does GDPR apply to people who: ...
15
votes
1answer
2k views

Can Slack really claim not to be a data controller?

I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response: Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
0
votes
0answers
43 views

Question Regarding GDPR

I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
0
votes
0answers
13 views

Are previous communiication preferences retained with form submissions?

I'm trying to understand the correct procedure when dealing with storing a users email subscription types, and the behaviour in relation to legitimate interest and consent to communicate. And the ...
0
votes
0answers
13 views

Complying with GDPR when storing emails and IPs for a refferal campaign

I want to start an email referral campaign to collect emails for the upcoming launch of a videogame and was warned that I need to comply with the GDPR rules of privacy. I'll be storing the email ...
3
votes
1answer
26 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
2
votes
2answers
67 views

When is pseudonymization insufficient in terms of GDPR compliance when storing and processing data for research purposes?

I am working on a project where data needs to be stored and kept for further processing. It's primarily for research purposes. I know that in order to be GDPR compliant, this data has to be anonymized....
2
votes
1answer
100 views

Under GDPR EU law, can I sue big tech companies (Facebook, Google, Apple) for acquiring and storing my personal data without my consent?

Many of my friends have social media accounts (Instagram, Facebook, etc.) where they regularly post photos of them and where occasionally I appear in them. Many of my friends have their personal ...
2
votes
2answers
218 views

Company retained my card details after payment completed and suffered a breach. What are my options?

A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications. After the breach, when the company was ...
3
votes
2answers
67 views

Site does not provide the option to disallow cookies in a notification

Is this a typical behavior for websites to provide only one option, and doing so, forces the user clicking "accept"? Isn't it so that they must provide both, accept and reject?
1
vote
2answers
75 views

Does creating an account or making a purchase apply consent for all marketing communications?

Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent. For example, I created an account using my email and hired a bike from ...
1
vote
1answer
137 views

What can i do if my GDPR requests are being ignored?

I have requested my personal data removal from one shady company that has gotten to my email somehow. They said they've complied, but i am still getting newsletters from them. What can i do as a ...
2
votes
1answer
44 views

Data processing locations post-Brexit

I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients. I have several UK-based clients, all ...
1
vote
1answer
44 views

Is sending log data + customer name + location compatible with data privacy and GDPR?

I've written an updater program. Our customer downloads it to update our software with database. It would be helpful if we would know who has already updated our software. For this purpose I've added ...
3
votes
1answer
49 views

Data deletion requirements

I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it. I never ...
2
votes
2answers
67 views

Under GDPR, Is a Hashed URL Enough to Protect Customer Data?

Does a hashed URL (sent via email) provide enough security to safeguard customer data? For example, if we publish our customer data online with a hashed URL that we send to the customer (in other ...
1
vote
0answers
33 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
4
votes
1answer
103 views

Under GDPR can I avoid divulging a customer's data to the government?

Scenario: A business has a legal requirement to obtain a license from a government agency relating to its business activities. The business activities have already being undertaken and there is no ...
1
vote
1answer
68 views

does the GDPR apply to publicly available data?

There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little ...
1
vote
1answer
119 views

Can I sue a company for testing Captcha when unsubscribing from email?

With all the data protection stuff these days I was wondering if it is possible to sue a company for making a user pass a CAPTCHA test when unsubscribing from email. I don't know the law surrounding ...
2
votes
1answer
37 views

Does GDPR affect personal projects with family data?

My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a ...
-2
votes
1answer
68 views

Is a GDPR flashmob legal?

If users decide to run a viral laege scale flashmob to get their data in terms of GDPR from a company, is this procedure legal? Like, competing who manages to make a request to inform about their ...
3
votes
1answer
85 views

A user has supplied personal information in an anonymous form. What is this information's status under GDPR?

I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form. If a user includes personal information (e.g. their ...
17
votes
4answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
2
votes
0answers
54 views

Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?

From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
1
vote
1answer
62 views

Do I violate GDRP if install WhatsApp as a private user?

As far as I can understand, if I install WhatsApp, the app sends my contact list to the server. Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
1
vote
1answer
57 views

Cookie expiration time per GDPR guidelines

I am working on a task that requires to set cookie expiry date to Jan 2038. This cookie is used for showing personalized content to end user e.g. If user is on Home page and he clicks on Business ...
2
votes
1answer
43 views

Can you request your personal data from a government agency under GDPR?

Can you address a request to a government agency (let's say for example the French "Ministry of education") to access the data they store about you under GDPR ? Does GDPR requirements apply to states ...
1
vote
1answer
49 views

Can GDPR be used to reset an account?

I have an issue with AirBnb: My account is something like 7-8 years old and I didn't use it for 6+ year. I don't have the password anymore so I did a password reset, but it wants me to confirm my ...
0
votes
4answers
154 views

Data Protection Laws

Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/...
1
vote
3answers
61 views

Does GDPR apply to personal information entered in a password-field?

If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply? For example if someone enters their email, phone number or name in a password-field? If so, ...
0
votes
2answers
73 views

Is a company still required to pay fines if the applicability of a law changes during the investigation?

This question was inspired by this question on Security.SE, regarding a data breach in a UK-based company. In short, the data of a UK-based company was leaked by an US-based contractor. Since the UK ...
1
vote
1answer
78 views

Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications

I originally posted this on another Stack Exchange website but was advised this might be a better place for it. Original is here: https://security.stackexchange.com/questions/215300/is-it-ok-to-assume-...
1
vote
0answers
45 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
0
votes
1answer
29 views

Does anonymised Google Analytics require positive opt-in under GDPR/PECR?

The EU defines personal data as: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can ...
1
vote
1answer
32 views

Am I responsible of the personal data of a second degree user according to GDPR

Suppose we have an flight ticket booking system. As with many of these systems the account booking the ticket doesn't have to be the one using the ticket (i.e. you can book for someone else the ticket)...
4
votes
2answers
89 views

Opting out of cookies by emailing a company

Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than ...
-1
votes
1answer
62 views

Do I have to include a GDPR in my app even tho I don't collect data from users? [closed]

I have written an android app The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user? Is is ...