Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
433
questions
0
votes
1answer
40 views
Hiding order invoice information, GDPR
I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like:
Name Surname
...
1
vote
2answers
42 views
Is an auto-submitting form GDPR/DPA-compliant?
TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant?
An organisation I am part of has an online form on their intranet for reporting incidents ...
0
votes
2answers
50 views
Is anonymous analytics data subject to GDPR?
I am reading the definition of "personal data" here https://gdpr-info.eu/issues/personal-data/. My understanding is that GDPR comes into play when information is about personal data.
Let's say there ...
1
vote
1answer
51 views
GDPR in a scientific, transborder scenario
Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole ...
1
vote
1answer
46 views
User-solicited personal information beyond consent
What does the GDPR say about personal information provided by a user of a service about themselves, in the case that the service sign-up process and ToS have always asked of the users not to provide ...
0
votes
2answers
46 views
GDPR compliance in ads SDK for iOS/Android
I have opened this question in SO, but was suggested to ask here, as the solution might come from a lawyer, rather than developer.
I work on a native ads SDK for iOS/Android (banner, interstitial, ...
0
votes
1answer
55 views
GDPR - We're a global company and are expanding to Europe, do we need to save data there?
We're a global company and are expanding to Europe. We have users log in to our service and then they can use it.
If a user is from the EU, do we have to store all of their personal information ...
1
vote
1answer
71 views
Can the GDPR be used to ask free race photographs?
A lot of time pictures of participants are taken during a sports event. These are often sold afterwards for e.g. 10 euro each. Some people just share the watermarked image on social media.
But my ...
2
votes
3answers
114 views
What an employer can legally ask to monitor about user activity
I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's ...
4
votes
2answers
229 views
Are Blizzard breaking GDPR by charging people for changing their usernames?
I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago.
I now want to change it again because searching it on Google ...
3
votes
1answer
181 views
Is it legal for Blizzard to demand a copy of my government id before deleting my account?
I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so.
I've seen a somewhat related question about Twitter at How can I get Twitter to delete my ...
1
vote
1answer
75 views
How can I get Twitter to delete my account?
I want to delete my old (7 years unused, never logged in) Twitter account. I lost the email to it, but it has my name so I would like to delete it. I wrote Twitter support twice and told them "This is ...
0
votes
0answers
43 views
Does USA have a law similar to GDPR that gives you the right to a copy of the information a religious organization has on you?
For some background: the EU "Data Protection Directive" is a European Union directive which regulates the processing of personal data within the European Union, as explained in this Wikipedia article. ...
0
votes
1answer
46 views
GDPR on Proxy Users
I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc...
My questions here are about the scope of GDPR.
Does GDPR apply to people who:
...
15
votes
1answer
2k views
Can Slack really claim not to be a data controller?
I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response:
Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
0
votes
0answers
43 views
Question Regarding GDPR
I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
0
votes
0answers
13 views
Are previous communiication preferences retained with form submissions?
I'm trying to understand the correct procedure when dealing with storing a users email subscription types, and the behaviour in relation to legitimate interest and consent to communicate.
And the ...
0
votes
0answers
13 views
Complying with GDPR when storing emails and IPs for a refferal campaign
I want to start an email referral campaign to collect emails for the upcoming launch of a videogame and was warned that I need to comply with the GDPR rules of privacy.
I'll be storing the email ...
3
votes
1answer
26 views
Identity verification prior granting access to personal data [GDPR]
When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
2
votes
2answers
68 views
When is pseudonymization insufficient in terms of GDPR compliance when storing and processing data for research purposes?
I am working on a project where data needs to be stored and kept for further processing. It's primarily for research purposes. I know that in order to be GDPR compliant, this data has to be anonymized....
2
votes
1answer
100 views
Under GDPR EU law, can I sue big tech companies (Facebook, Google, Apple) for acquiring and storing my personal data without my consent?
Many of my friends have social media accounts (Instagram, Facebook, etc.) where they regularly post photos of them and where occasionally I appear in them.
Many of my friends have their personal ...
2
votes
2answers
218 views
Company retained my card details after payment completed and suffered a breach. What are my options?
A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications.
After the breach, when the company was ...
3
votes
2answers
67 views
Site does not provide the option to disallow cookies in a notification
Is this a typical behavior for websites to provide only one option, and doing so, forces the user clicking "accept"? Isn't it so that they must provide both, accept and reject?
1
vote
2answers
75 views
Does creating an account or making a purchase apply consent for all marketing communications?
Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent.
For example, I created an account using my email and hired a bike from ...
1
vote
1answer
137 views
What can i do if my GDPR requests are being ignored?
I have requested my personal data removal from one shady company that has gotten to my email somehow.
They said they've complied, but i am still getting newsletters from them.
What can i do as a ...
2
votes
1answer
44 views
Data processing locations post-Brexit
I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients.
I have several UK-based clients, all ...
1
vote
1answer
44 views
Is sending log data + customer name + location compatible with data privacy and GDPR?
I've written an updater program. Our customer downloads it to update our software with database. It would be helpful if we would know who has already updated our software. For this purpose I've added ...
3
votes
1answer
49 views
Data deletion requirements
I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it.
I never ...
2
votes
2answers
67 views
Under GDPR, Is a Hashed URL Enough to Protect Customer Data?
Does a hashed URL (sent via email) provide enough security to safeguard customer data? For example, if we publish our customer data online with a hashed URL that we send to the customer (in other ...
1
vote
0answers
33 views
Is it obligatory to store ToS and Privacy Policy consent for a web app?
I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should".
So my ...
4
votes
1answer
104 views
Under GDPR can I avoid divulging a customer's data to the government?
Scenario:
A business has a legal requirement to obtain a license from a government agency relating to its business activities.
The business activities have already being undertaken and there is no ...
1
vote
1answer
68 views
does the GDPR apply to publicly available data?
There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little ...
1
vote
1answer
119 views
Can I sue a company for testing Captcha when unsubscribing from email?
With all the data protection stuff these days I was wondering if it is possible to sue a company for making a user pass a CAPTCHA test when unsubscribing from email.
I don't know the law surrounding ...
2
votes
1answer
37 views
Does GDPR affect personal projects with family data?
My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a ...
-2
votes
1answer
68 views
Is a GDPR flashmob legal?
If users decide to run a viral laege scale flashmob to get their data in terms of GDPR from a company, is this procedure legal?
Like, competing who manages to make a request to inform about their ...
3
votes
1answer
85 views
A user has supplied personal information in an anonymous form. What is this information's status under GDPR?
I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form.
If a user includes personal information (e.g. their ...
17
votes
4answers
6k views
Under GDPR, can I give permission once to allow everyone to store and process my data?
If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
2
votes
0answers
54 views
Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?
From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
1
vote
1answer
62 views
Do I violate GDRP if install WhatsApp as a private user?
As far as I can understand, if I install WhatsApp, the app sends my contact list to the server.
Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
1
vote
1answer
61 views
Cookie expiration time per GDPR guidelines
I am working on a task that requires to set cookie expiry date to Jan 2038. This cookie is used for showing personalized content to end user e.g. If user is on Home page and he clicks on Business ...
2
votes
1answer
43 views
Can you request your personal data from a government agency under GDPR?
Can you address a request to a government agency (let's say for example the French "Ministry of education") to access the data they store about you under GDPR ?
Does GDPR requirements apply to states ...
1
vote
1answer
49 views
Can GDPR be used to reset an account?
I have an issue with AirBnb:
My account is something like 7-8 years old and I didn't use it for 6+ year.
I don't have the password anymore so I did a password reset, but it wants me to confirm my ...
0
votes
4answers
154 views
Data Protection Laws
Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/...
1
vote
3answers
62 views
Does GDPR apply to personal information entered in a password-field?
If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply?
For example if someone enters their email, phone number or name in a password-field? If so, ...
0
votes
2answers
73 views
Is a company still required to pay fines if the applicability of a law changes during the investigation?
This question was inspired by this question on Security.SE, regarding a data breach in a UK-based company.
In short, the data of a UK-based company was leaked by an US-based contractor. Since the UK ...
1
vote
1answer
78 views
Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications
I originally posted this on another Stack Exchange website but was advised this might be a better place for it. Original is here: https://security.stackexchange.com/questions/215300/is-it-ok-to-assume-...
1
vote
0answers
45 views
Replace User ID with pseudonym, still need consent?
I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy.
My goal is to avoid collecting any ...
0
votes
1answer
30 views
Does anonymised Google Analytics require positive opt-in under GDPR/PECR?
The EU defines personal data as:
‘personal data’ means any information relating to an identified or
identifiable natural person (‘data subject’); an identifiable natural
person is one who can ...
1
vote
1answer
32 views
Am I responsible of the personal data of a second degree user according to GDPR
Suppose we have an flight ticket booking system. As with many of these systems the account booking the ticket doesn't have to be the one using the ticket (i.e. you can book for someone else the ticket)...
4
votes
2answers
89 views
Opting out of cookies by emailing a company
Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than ...
