As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1 vote
1 answer
57 views

Receive written confirmation about non-breached data

Context: I am working for an institution which has recently suffered a data breach. There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
Vassilis Markos's user avatar
1 vote
1 answer
80 views

Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR? [duplicate]

Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR? Any help on this questions would be much appreciated!
fini-stair's user avatar
0 votes
1 answer
31 views

How is the information retention for shared data to be interpreted?

I don't quite understand the part of the GDPR regarding data retention duration when applied to shared data.. I'm using Google AdMob to display (personalized) ads on my app. Device data and possibly ...
Gamer2015's user avatar
  • 109
1 vote
3 answers
211 views

Can i request a religious forum to delete my posts for GDPR compliance?

It's a forum discussing religious stances and personal practice. Is it possible to request posts to be removed along with the account registry? As i understand it, forums in general don't have to ...
Knowmore's user avatar
1 vote
1 answer
48 views

Can one make a Subject Access Request of a telephone Communications Provider?

I have received a suspected scam telephone call. Searching the internet for the number I found that "phone block 247520 is operated by DIDWW Ireland Limited". Searching this I came across ...
User65535's user avatar
  • 4,135
5 votes
1 answer
126 views

Does a US company moving its PII and web servers to the EU solve the Meta fine problem?

As discussed in this question about the Meta fine it is a problem for companies that host websites with access to EU user registration data in US datacenters. This is based on the 'Schrems II' ...
User65535's user avatar
  • 4,135
21 votes
2 answers
4k views

Are global user account systems now illegal following the EU's May 2023 fine of Meta?

The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta Like any website, we have an account system where people log in to access their ...
Per's user avatar
  • 313
2 votes
0 answers
49 views

What are the limits to what the information commissioner can take action upon?

It is in the news that a doctor inappropriately accessed and distributed a patients medical records. They did this through their employer, Cambridge University Hospitals (CUH) at Addenbrookes. The ...
User65535's user avatar
  • 4,135
9 votes
1 answer
3k views

Can a non-profit organization record attendance by name without permission?

I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
Tripartio's user avatar
  • 211
1 vote
1 answer
134 views

I have found my email address online in a .txt file. What should be my next step? [closed]

A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails ...
Ahania's user avatar
  • 23
4 votes
1 answer
82 views

What does "Household Exception" to the GDPR mean?

GDPR Section 2 Recital 18 (?) reads: Not Applicable to Personal or Household Activities This Regulation does not apply to the processing of personal data by a natural person in the course of a purely ...
User65535's user avatar
  • 4,135
2 votes
0 answers
28 views

Search engine data breaches, osint

Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
J.G.'s user avatar
  • 43
2 votes
1 answer
97 views

Do US companies need a cookie consent banner for EU traffic?

Example: US website, targeting customers in the US. They use Google Analytics and Google Ads cookies etc. Do they need a cookie consent banner for EU traffic? Or should they just not load any tracking ...
Henrik's user avatar
  • 23
8 votes
3 answers
4k views

On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?

I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in ...
Nik's user avatar
  • 183
-1 votes
1 answer
103 views

Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?

Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls. The fact that it's now allowed again makes me wonder if Italy (and the ...
GDPR's user avatar
  • 45
0 votes
1 answer
67 views

Utilizing Browser IP for Service Security

Suppose a web designer plans to use IPs for security purposes to prevent botting unique clicks and brute force attempts. And, the site only stores a hash of the IP address for a limited amount of time ...
Davis Ray's user avatar
2 votes
1 answer
36 views

GDPR protection for non-EU individuals by using EU services through VPN use?

REASON FOR QUESTION: I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
Bruno Genovese's user avatar
5 votes
1 answer
242 views

Choosing DPA to submit data breach complaint (EU-specific)

Context The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it. The offenders ...
Vassilis Markos's user avatar
5 votes
1 answer
73 views

How does GDPR's right to erasure apply to deduplicated storage?

I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case: Company A offers a online data storage service that is intended to be used by the users ...
Tomas's user avatar
  • 53
1 vote
1 answer
65 views

Do any other consumer rights laws have extraterritorial applicability to international organisations that cater to British or European customers?

The GDPR purports to bind any organisation, wheresoever it may be based, that serves individuals based in the EU, or (as the case may be) the UK. The GDPR governs the obligations of organisations and ...
Seeking answers's user avatar
0 votes
1 answer
30 views

Can two or more different entities simultaneously be data controllers for the same data?

Suppose Alice is a customer of a business ACME who holds data on her like email correspondence. ACME uses a third party to manage their email, suppose Fastmail.fm. Fastmail.fm in turn delegates their ...
Seeking answers's user avatar
7 votes
2 answers
585 views

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
Seeking answers's user avatar
0 votes
2 answers
105 views

Publishing personal data obtained on a Swedish server - GDPR implications

Imagine a small social media chat platform is hosted in Sweden and subject to GDPR. Party A sends personal information to party B using the platform, using a private message. The information was ...
user49938's user avatar
0 votes
1 answer
57 views

Can a user opt-out of embedded services without prior account-linking?

Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
Martin Braun's user avatar
-2 votes
1 answer
55 views

Old backups containing login information [closed]

I've been keeping an old website backup of a website that I used to work on on my PC for the last year or so. It was all my own work and wanted to just keep it in case I ever wanted to reuse it or use ...
AnotherUser's user avatar
-1 votes
2 answers
64 views

What would constitute personal data? [duplicate]

For example, would a name in the form first initial last name be considered personal data, considering this could apply to many people? What about if we added in a hobby, perhaps that they watch ...
AnotherUser's user avatar
0 votes
0 answers
50 views

What is the legality and consequence of blocking one who submits a SAR? [duplicate]

Alice submits a subject access request to Bob via WhatsApp, Bob responds to this by blocking Alice, but otherwise ignores her. What is the legality and consequences of Bob’s response to her SAR?
Seeking answers's user avatar
3 votes
2 answers
93 views

Access rights to professional photographs

An independent professional photographer uses a sales tactic of candidly taking photos of others in public and then approaching them and offering them copies for a price. Suppose one of these ...
Seeking answers's user avatar
1 vote
1 answer
71 views

Who is the data controller of footage taken on a retail worker’s personal phone?

An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer ...
Seeking answers's user avatar
0 votes
2 answers
71 views

Can a customer of a business make a recording of an employee on the business’s privately premises?

Suppose a customer enters a store. The business, through an employee, treats the customer unlawfully. Perhaps this is by verbally or physically abusing them, discriminating against them, or denying ...
Seeking answers's user avatar
-1 votes
2 answers
43 views

Can data protection rights of a subject be voluntarily waived?

Presumably not on protrusion by a service provider as a condition of their service. But what if someone writes to someone super busy whom they admire and says “look I really respect you and don’t want ...
Seeking answers's user avatar
2 votes
2 answers
90 views

Is training an AI on the internet processing personal information?

There is an article on El Reg where the author asks ChatGPT about themselves, and they get back some information. If this data acquisition and dissemination process was being performed specifically ...
User65535's user avatar
  • 4,135
0 votes
1 answer
47 views

EU and CLOUD Act [closed]

I can't find anything what's on this in 2023 - is EU anyhow working towards and agreement with US to allow not to give away private data? - As I see on Wikipedia, so far only UK has got this agreement ...
J. Doe's user avatar
  • 447
0 votes
1 answer
76 views

Is just embedding YouTube thumbs GDPR conform?

Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?
Johann Heyne's user avatar
1 vote
3 answers
91 views

What does "necessary" mean with regards GDPR and cookie consent

The GDPR makes use of the word "necessary". For example article 6. Lawfulness of processing 1. (f) says "processing is necessary for the purposes of the legitimate interests pursued by ...
User65535's user avatar
  • 4,135
0 votes
1 answer
46 views

If I have concurrent user consents then can I combine these consents?

I have an app that supports concurrent user consents. Assume that I have: Consent A that gives access to https://example.com/resources/a Consent B that gives access to https://example.com/resources/b....
Szyszka947's user avatar
14 votes
1 answer
2k views

How can consent-banner as a service be GDPR compliant?

A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
Samuel's user avatar
  • 243
2 votes
2 answers
87 views

Is a bank account history of transactions considered personal data in the sense of GDPR?

For archival purposes, I'm trying to get the full history of transactions on my bank account since I opened it in 2019. I know my bank still has it since it's visible in the mobile app (I can scroll ...
zdimension's user avatar
1 vote
1 answer
36 views

GDPR When using an external CV formatting company

As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
Sara's user avatar
  • 11
0 votes
1 answer
79 views

Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?

ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
Seeking answers's user avatar
4 votes
1 answer
143 views

What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?

What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server? The social network Mastodon https://en.wikipedia.org/wiki/Mastodon_(social_network) ...
markratledge's user avatar
6 votes
3 answers
3k views

GDPR: Do I have to IP log "every" login for a customer?

IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. ...
cagatay117's user avatar
0 votes
1 answer
44 views

GDPR @ ePrivacy & Data Controller & Local processing PII & Mobile App

I'm developing an open source client mobile app that allows user to use third-party social media. So the app logs in directly to the interface with the credentials entered by the user and makes direct ...
HenryFin123's user avatar
10 votes
2 answers
1k views

GDPR - Are technical identifiers personal data?

I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
kol's user avatar
  • 203
1 vote
1 answer
79 views

What are GDPR Laws concerning requirement to back up data

I want to create an application where I want to act as a data controller & data processor. The only data I want to record myself is basic user data like username, address , etc. But I want to run ...
Shaurya Chaudhuri's user avatar
0 votes
1 answer
35 views

Can a Data Controller refuse a second SAR from the same person?

Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
David Siegel's user avatar
4 votes
2 answers
1k views

What is the U.K. GDPR?

I understand that the DPA implemented the GDPR in British law as an act of Parliament. Then there was Brexit, and the U.K. GDPR was introduced to stand in for the no longer binding EU GDPR, with only ...
Seeking answers's user avatar
2 votes
0 answers
65 views

Is there anything to stop a subject access requester from being barred by a business?

A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
Seeking answers's user avatar
5 votes
1 answer
385 views

Is it a breach of GDPR and DPA to say a colleague is sick and off work?

This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer ...
Heddy's user avatar
  • 783
-2 votes
1 answer
59 views

How shall I handle user consent "remember" option [closed]

I get consent from user for some operation. While consenting user can check "remember consent" option and this is handled as below: Consent is saved to db Some action is done and consent is ...
Szyszka947's user avatar

1
2 3 4 5
19