Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1
vote
2answers
126 views

A salt hashed with user password is anonymous data for GDPR?

I want to use a scheme to track the user in a anonymous way. My idea is to use the user password to hash a salt to create a identify hash and track the user through this. Theoretically, the only way ...
2
votes
1answer
61 views

Do I need to ask an Android user to opt-into push notifications as per GDPR?

On Android, we do not need to explicitly ask a user to opt into push notifications. They are presumed to be opted in and can manually opt out. This is different from iOS where users must explicitly ...
0
votes
1answer
129 views

Can you legally use eye tracking on your website?

If user visits your website, can you legally use their camera to track where they are looking at and then transform this data to heatmaps? If yes, under what circumstances? Our company created a web ...
8
votes
1answer
3k views

Is storing records of chess games a violation of GDPR?

Many amateur chess players store the notations of their games in electronic format (like pgn) so that they can later reference the game for analytical and historical reasons. Information in this file ...
0
votes
2answers
42 views

How to handle account deletion of user with financial information and/or otherwise liability related information

So, I read a post on reddit the other day about a user unhappy with Binance (crypto currency exchange company) for only being able to "disable" his account but not "delete" it. ...
-1
votes
2answers
85 views

Under GDPR's strict consent requirement rules, could a criminal/hacker/troll remain anonymous in all his activities?

Since GDPR strictly requires consent to Personal Identifiable Information (PII), could a criminal exploit online services by remaining anonymous in all his criminal activities? Providers are not ...
12
votes
5answers
4k views

Does the law give provisions for well known service providers to deny service if users don't accept their privacy policy?

Service providers like Google and Facebook are pretty much part of people's lives. Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
1
vote
1answer
60 views

Can you opt out of use of your personal information by your country's registry?

I was changing my address a week ago and I noticed that it said in tiny letters that the information I provide may be used for direct advertising, marketting, scientific research, data collection and &...
2
votes
1answer
65 views

Count visitor per day with GDPR & Cookies in EU

My question is: how is it possible calculate visitors per day without gathering some information about the users in order to be able to identify them as revisits? We have a cookie consent banner in ...
2
votes
1answer
108 views

Can you preemptively check local storage before user agrees under Cookie Law?

I am pretty new to the idea of asking for consent for storage for a website because I'm American. I understand that if I want to store anything, I need to ask users for consent. However, I'm confused ...
-2
votes
1answer
97 views

Is this Cookie scenario GDPR compliant?

I noticed that many websites, including StackExchange websites just have a banner while full functionality is provided by the website, which is probably not GDPR compliant. Is this true? As far as I ...
2
votes
1answer
47 views

Date Privacy and Twitch; Do I have the right to access my chat logs?

Under Data Privacy laws, the user has a right to access their data, erasure, etc. Yet under Twitch the users have no way to access their own logs, only the streamer and a team of mods. This has always ...
0
votes
1answer
37 views

GDPR Compliance - Password Protected Documents in AutoRecovery

I'm working with personnel data in my job, including lots of details which I know to be sensitive and most certainly covered by GDPR. In order to maintain compliance with the regulations while ...
3
votes
1answer
57 views

Site user posts data under licnese, can user demand erasure?

Suppose that a site, run as a free service, allows communication between users (a chat site). Suppose that the site also permits users to optionally upload text documents or images, which will be ...
-1
votes
2answers
231 views

Is Apple scanning user content for child abuse a violation of GDPR?

According to this article Apple is scanning all the photos users have on their devices to detect possible child abuse. The article explains that a NeuralHash of each image will be uploaded to Apple ...
0
votes
1answer
69 views

May I publish source code of my project without notifications about use of personal data and cookies and not break laws during it?

I have created the demo software project (frontend and backend modules) for manage staff. I want to publish source code of the project on GitHub. I know that according to GPDR page must have ...
0
votes
2answers
79 views

The Right to be Forgotten: can it be used to hide past public (news) information?

In the EU there is a "Right to be forgotten" This was created by Directive 95/46/EC in 2012 as a right to insist that search engines not link to personal data, and subsumed into tech "...
1
vote
1answer
97 views

Are firm's vendors liable in case the firm deliberately and openly shuns GDPR compliance?

This is hypothetical and it's only meant to ask about the extent of the law, not ask for a particular legal advice. Let's say a US merchant's website uses exclusively regional US banks. Because they ...
12
votes
1answer
855 views

Is an email enumeration vulnerability a breach of GDPR?

I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows: User inputs their email If the email belongs to an existing user, ...
5
votes
1answer
2k views

Is this a valid approach to ask consent under GDPR?

I'm trying to figure out the best way to gather user consent to use third-party services in a mobile app for users under the GDPR. Let's say that I have an app that uses third party services (...
0
votes
1answer
109 views

Can you track those who denied tracking on a website?

I'm coordinating a website project where we are implementing Analytics and a GDPR compliant Cookie Banner. I was asked if we had a way to track how many users have declined analytics in case we needed ...
1
vote
1answer
35 views

DSGVO: Saving adress data

According to GDPR (DSGVO in germany), would it be allowed to save an adress without a name of the person? Would it also be allowed to do the same with a hash of the persons name? The name of the ...
8
votes
2answers
2k views

Are there ways of storing personal data beyond standard GDPR limitations?

So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data. ...
0
votes
1answer
79 views

Is Google's Consent Management Platform not GDPR compliant since it does not show a consent form when 'personalised ads' are disabled?

This question borders the line between technical and legal but I am posting here because it is not a coding problem in itself. Apologies if this is the wrong forum. I have set up my mobile app to use ...
2
votes
2answers
102 views

Would a VPN user still be under GDPR protection?

I got a client that wants to remove the 'GDPR please accept our cookies' banner when the user is NOT in the EU. (Its an NA based company) So the way we could do it, with PHP, would be to check the IP ...
7
votes
2answers
1k views

Do I still need to check if users are inside of EEA/UK for GDPR consent if my Android app is ONLY released in countries outside of EEA/UK?

Example: A US user downloads the Android app from the US Google Play Store The user does not view any consent form and begins using the app and viewing ads The user then travels to EEA/UK and ...
4
votes
1answer
471 views

Should registered users accept cookie consent in GDPR?

I want to use cookie consent for saving user language, currency and affiliate marketing purpose. Can I store data without consent of the registered users? They are registered so do I need to take ...
0
votes
1answer
30 views

Responsibilities and GDPR reporting in case of hacked email marketing platforms

Company A allows subscription to its newlsletter via email, and their email list and newsletter is taken care of by company X. So A is hosting the page where one can subscribe, X handles list and list ...
2
votes
2answers
84 views

Is it legal to process PII in EU of customers which are not in EU?

So I have an app that processes the PII of users and their interests, the app is south Asia based. The app doesn't support EU customers and is geo-blocked by default. I would like to process and store ...
1
vote
1answer
82 views

How long can a company take to answer my GDPR request to download my data?

In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be ...
1
vote
1answer
50 views

Is email verification required before asking users to enter personal details? GDPR-related

Is email verification step required before asking users to enter personal details? A bit lost in GDPR documents. Should contract between user and the app be signed (via phone number + sms or email + ...
1
vote
0answers
37 views

Data representatives in EU, UK, Switzerland - are there more countries requiring this?

The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
4
votes
1answer
84 views

Are there privacy laws other than GDPR which consider IP addresses as personal data?

In EU's GDPR the IP address is considered personal data (lots of discussions about it, but this seems to be the correct interpretation at the moment). Several countries have now privacy laws which are ...
2
votes
1answer
92 views

Is the Vilnius-Lublin portal a violation of GDPR?

Don’t get me wrong, I love it! But is it GDPR compliant given that people walk up to a camera that will broadcast their image outside of their country? See also this news story and this one
0
votes
1answer
67 views

The Data ownership for an automated server running for years prior to GDPR Regulations

Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various ...
2
votes
2answers
117 views

The scope of GDPR and the right to be forgotten

I have three doubts about GDPR compliance in modern systems, specifically about the "Right to be forgotten" section in the GDPR. What I would really like to understand is whether the right ...
0
votes
1answer
55 views

Can a pre-ticked checkbox be used to RECALL/REVOKE consent under GDPR and/or ePrivacy/cookie law?

I wonder, can a pre-ticked checkbox be used to recall/revoke consent, or does revoking/recalling consent need to be a separate, explicit action? I have made a specific consent function like this: When ...
8
votes
2answers
2k views

Does The "Right To Be Forgotten" Include Sent Emails?

Say that you maintain an email service, and person A, sends an email to person B who is also on your email service. If person A deletes their account would that mean that person B no longer can view ...
0
votes
1answer
94 views

Is there any chance of getting a penalty for cookies with no notification for a private person with small site?

I am planning a small demo application using DRF and when using the DRF web interface csrftoken cookies are saved by default. After reading tons of material about GDPR and cookies I completely disable ...
1
vote
1answer
146 views

Impact of GDPR on remote work outside of the EU (as LLC)?

I do remote work for clients in the EU. The legal foundation is a B2B contract between two EU legal entities, one of which is the client's limited company, the other my limited company. Since both ...
0
votes
1answer
87 views

GDPR - Are the typical lists of examples for personal data misleading?

Article 4 of the EU GDPR states ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); The explanation for the term ‘personal data’ as ...
0
votes
1answer
98 views

Identifying attackers and GDPR. In which cases is it legal?

Various techniques can be used to identify stalkers, malicious hackers et al. that are either gathering data for their target or use the target's digital items without consent. Canary files They are '...
0
votes
0answers
51 views

Is securely storing and using customer credentials and passwords in customer-commissioned software GDPR compliant?

My team is in charge of developing integration software for our customers. The customer integrates their system with our platform in order to use our services. Numerous customers avoid managing their ...
5
votes
1answer
947 views

Talent consent withdrawal in film in Europe

Consider the following scenario of right to erasure in film-making in Europe. Person A makes amateur live-action films, for example theater performances. Person B is in one of those performances and ...
1
vote
1answer
52 views

What laws should I be aware of if I were to start a business scraping profile content from a website and using this content to build another website? [closed]

The idea is to build websites for people (in the UK (at least to start with)) using content that they have uploaded to another website. I will cold-call them, ask them if they would like a website and ...
0
votes
1answer
84 views

Legal obligations of a company in case of GDPR-related vulnerability

First of all I would like to state that my question occurs in a context of EU laws and EU citizen. I found a vulnerability in a product distributed in a few companies of EU countries. This ...
1
vote
2answers
83 views

Privacy and GDPR on Facebook

I have a doubt regarding the privacy on Facebook and the law application. Also lawyers That I have spoken with, seem not very sure about the matter. In particular I would like to know if it is my ...
4
votes
2answers
828 views

If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?

I used to work for a company, where they have a team of moderators, who actively monitor which accounts are scammers etc. To monitor this they can find links between user accounts via a users password,...
2
votes
1answer
38 views

What are the limits of service provision/PII consent for compliance with GDPR?

Most of the internet business model can be described as providing data in exchange for seeing adverts. These adverts are worth a lot more if they can be targeted. The GDPR applies to this, such that ...
1
vote
1answer
63 views

Is it GDPR compliant to hide a competition entry behind a requirement to sign up to a newsletter

I'm looking to run a giveaway competition on my website. The main aim of the competition is to get signups to our email newsletter. I'm therefore proposing that 1. a user signs up to my newsletter (...

1
2 3 4 5
15