Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
0
votes
1answer
36 views
Does GDPR require consent for a processor to confirm or deny the existence of data?
Assume we have two separate lists of emails handled by two different processors. List A is gathered by company A in a way that the subject has given their consent for its processing for marketing ...
0
votes
0answers
72 views
Is Facebook exempt from requiring consent for its “Like” button? [on hold]
I've been reading this EU court case which involves a website embedding the Facebook "Like" button.
The court's answer was that "The consent of the data subject obtained under Article 7(a) of ...
1
vote
1answer
41 views
Does allowing users to see user tracking on my analytics software violate GDPR?
I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard:
However, you can click on a user ID (right) like abaer and see ...
3
votes
1answer
46 views
Requesting to see holiday rota and GDPR
my partner has asked if she can see the holiday rota and was told she couldn't because of GDPR. Is that correct? I know anything that identifies you needs to be secure but the rota of when people are ...
2
votes
0answers
43 views
Removing my personal data ex-employer (RGPD/GPDR ?)
I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
3
votes
1answer
3k views
Salesman text me from his personal phone
I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me ...
1
vote
1answer
34 views
Do you have to provide the name and email address of your data protection officer?
Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them:
You can contact Valve's data protection officer at the address below.
While we ...
6
votes
1answer
896 views
Is it okay to store user locations?
I know it might sound quite bad. But here I explain the whole situation.
I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
2
votes
1answer
32 views
GDPR data portability when no data stored
My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have ...
1
vote
1answer
16 views
GDPR collecting vs storing
I have a website that stores no personal data, however it does use ($_SERVER['REMOTE_ADDR']), a code that scans the IP address of visitors, but the IP address isn't stored anywhere. It's only scanned ...
0
votes
1answer
109 views
GDPR: Can a website not process personal data?
I want to have a website where I publish my own articles.
When a user requests a webpage, I receive an HTTP request from their browser, which contains the IP.
Now, for a split second while the ...
1
vote
1answer
51 views
Identity photographs under GDPR
Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018?
...
2
votes
1answer
31 views
Is it a violation of GDPR law to email personnel gathered from hunter.io?
I'm a web developer working on a project for a client. The project is a directory of sustainable companies (enviromental-friendly companies). The project is only launching now.
The companies listed ...
2
votes
1answer
32 views
GDPR Requirements for restricted use corporate webapp [closed]
The GDPR is very complicated, and while its requirements may be crystal clear to those who are intimately familiar with it, it is not at all clear to most as to what the exact requirements are in all ...
1
vote
1answer
29 views
What are the types of personal data?
In the GDPR, the concept of data categories is used and examples of such categories are given. The concept of data types is also used, but I do not know what they are.
Example of data categories, ...
3
votes
1answer
73 views
As a customer, am i liable for messaging another customer found on a Facebook business page?
I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company.
I have received a ...
1
vote
0answers
52 views
A company finds out that it has made a material decision based on incorrect personal data, what should it do?
A company terminates an employee based on what it believes to be a record of the actions of person gained from log files.
Months later the company finds out that this information is not correct.
...
0
votes
1answer
21 views
When to authorize someone and when to sign a contract for processing personal data
There are two ways for the data controller to let someone else process the data he controls:
authorise him or her to do so,
sign a legal contract making him or her a 'processor' (Article 28 GDPR).
...
-2
votes
1answer
162 views
Google AdWords banned my account. Can I request complete deletion under GDPR?
GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on ...
5
votes
1answer
43 views
The circumvention of terms and conditions
There are sites, for example 'moodys.com', which require an explicit agreement to the terms and conditions on every vist (e.g. https://www.moodys.com/research/Moodys-affirms-Chang-Hwa-Commercial-Banks-...
0
votes
1answer
30 views
Data Portability in GDPR
I've reading:
https://gdpr-info.eu/art-20-gdpr/
It says:
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, ...
0
votes
0answers
28 views
How does GDPR apply for normal email communication?
I am a member in an association and in charge of membership management and general IT. We exchange information about the work of the association by email using private mailing lists the association ...
1
vote
1answer
45 views
Users counting and GDPR
Do I need a GDPR "coockie" banner if I implement not a unique identifier but only a naive counter?
My web app check a key presence in local storage. Key is the same for all. If it's not found - call /...
2
votes
2answers
53 views
Is it allowed to collect additional personal data to comply with the information obligation (Article 14 GDPR)?
True story. A bank erroneously sends its clients' data to a company: name, surname, national identification number. The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and ...
3
votes
1answer
45 views
Is it legal to have a opt-out of marketing emails checkbox under GDPR?
As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-...
1
vote
2answers
83 views
Is it legal to ignore “Do Not Track” for data subjects who fall under the GDPR?
The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different ...
1
vote
1answer
42 views
The case of creating personal data by combining non-personal data
In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
6
votes
2answers
181 views
If photos are PII under GDPR, how are most photos on the web legal?
It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal ...
0
votes
0answers
14 views
GDPR the other way arround [duplicate]
Let's say that there is a site with a list of people that did one thing. Once with GDPR rules, those people can ask to be removed from that site. I was wondering if that site changes the way it makes ...
1
vote
1answer
18 views
Is information only about financial transactions personally identifiable in terms of GDPR?
I am creating application where you can manage your incomes/expenses e.g. on eBay. Main functionality is:
create new item and specify price you've payed to get it
set price that you've
All other ...
4
votes
1answer
38 views
Should all gdpr related documents be translated to all official EU languages?
I wrote application localized in Ukrainian language , which is not one of the official European Union languages. Since I reside in the EU territory I need to comply with gdpr. This application is ...
3
votes
2answers
98 views
anonymisation/redaction of public website content as response to 'right to erasure'
An organisation runs some public email lists. These are archived, and the archives are also publically available from its website.
A user of the mailing list asserts their "right to be forgotten" and ...
0
votes
1answer
45 views
Data Scraping public athlete name and performance data. Does this need to be treated as personal data?
Consider the following data for amateur/professional athletes:
Athlete name,
Athletic event + best performance data
e.g.:
Joe Bloggs
5k 19:00
10k 40:00
Half Marathon 85:00
other events etc...
and ...
0
votes
0answers
29 views
Minimal GDPR requirements for a website
Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options:
Agree
Decline
"Read more" link to a common page "What are cookies?"
Additionally I ...
0
votes
0answers
27 views
Is geocoding an IP address but not storing it considered processing under GDPR?
As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address.
If I geocode the IP address to get the visitor's country and ...
2
votes
1answer
44 views
Can DPO do an internal audit of information security according to ISO 27001?
In one company, due to GDPR, a DPO was designated, who was later given additional role and a new task: to conduct an internal audit of information security according to ISO 27001. Is there a conflict ...
2
votes
0answers
25 views
How to notify the use of cookies (Cookie Law Notice)
I have been investigating notifications about the use of cookies and a question has come up:
Why 99.9% of websites do not report correctly about the use of cookies and nothing happens?
With "...
2
votes
1answer
63 views
Do Bitcoin nodes need consent to store EU citizen's personal data?
The Bitcoin blockchain stores data about bitcoin users. This includes:
There bitcoin address, which is linkable to their identity via blockchain analysis
Transactions they have made
This would seem ...
4
votes
1answer
43 views
Would revealing/storing whether or not an EU customer uses a service violate the GDPR?
Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
2
votes
1answer
81 views
Can't GDPR compliance be trivially bypassed?
For large tech firms such as Facebook, at least, wouldn't it be a trivial matter for these companies to avoid EU GDPR compliance altogether?
Many big companies don't actually "sell" any tangible ...
0
votes
0answers
12 views
Do you have to provide information about processing personal data for contact persons?
Two companies write a legal agreement between themselves and contain contact details of their representatives in its content. Assuming that these contact details are personal data, are these companies ...
0
votes
0answers
17 views
Does sending email with personal data require agreement with email provider under GDPR? [duplicate]
It's common practice to allow users of your service to get email notifications about interesting events. For example user Joe subscribes to notifications to email address joe@emailprovider.com about ...
0
votes
0answers
23 views
Cause of action for data processor where the data controller neglects to notify supervisory authority
By reading the GDPR I have gathered that a data processor is obligated to notify the data controller of a breach within 72 hours and the data controller is likewise obligated to notify the supervisory ...
3
votes
1answer
56 views
In which jurisdictions outside the EU can the GDPR be enforced?
The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens.
Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
0
votes
1answer
39 views
Replication of user data a violation of GDPR
I'm in the planing staging of building game service provider, kind of like Xbox Live, PSN, Steam, etc.
As far as I understand in the terms of the GDPR, information that can directly identify users ...
7
votes
1answer
69 views
Is it sufficient to provide a privacy policy only in english language?
Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language?
Is a translation necessary for every country of the EU ...
1
vote
1answer
69 views
Can my employer gather personal data without written consent
I'm located in the EU.
My employer recently became a contractor for an american company. We deal with software.
A requirement of the american company was that on all machine of the people working ...
1
vote
1answer
71 views
In the EU, with GDPR in force, can a company refuse service if a customer doesn't want marketing emails?
I am having an argument with a local discount airline in the EU:
They have been sending 3 up-sell emails for a single flight. Under GDPR, it is my right to revoke any consent to receive marketing ...
5
votes
1answer
96 views
Company makes confidential CV publicly available and searchable. Legal recourse?
A friend of mine was looking for a job last August. She sent CVs for various positions.
Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
3
votes
1answer
63 views
Are artificially generated personal data covered by the GDPR?
According to Article 2(1) GDPR:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be ...
