Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
4
votes
2answers
77 views
“no logs” website in eu - is it illegal?
As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
0
votes
2answers
54 views
Do I need permission to publish a FOI response in a blog post or open letter?
I recently submitted a FOI request to my local council, and had a response.
Part of the response stated the following:
You are free to use this information for your own use, including for non-...
0
votes
1answer
31 views
Proof of Consent under GDPR, HOW TO?
One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent.
Companies must have documented proof of Consent as per defined under GDPR ...
29
votes
4answers
8k views
ISP is not hashing the password I log in with online. Should I take any action?
I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
1
vote
1answer
23 views
Copy of ID card: blacken / hide fields that are not relevant (Switzerland)
In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht.
In article there is written that ...
0
votes
2answers
72 views
Are Steam account IDs (and telemetry data associated with Steam IDs) deemed personal data?
A few friends and were having an argument on the following situation:
People can sign up for Steam accounts for free, letting them purchase games and play games over their network. Users are able to ...
2
votes
1answer
45 views
Can liability for data disclosure be waived by T&Cs under GDPR?
I live in Ireland, an EU county subject to the GDPR.
I see in a service T&Cs the line:
"Despite our use of commercially reasonable efforts to protect your
Personal Information from ...
1
vote
3answers
103 views
How often does a website have to ask for cookie consent?
I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or ...
0
votes
1answer
53 views
Locate me data obtained from european register
There is an entry on locatefamily.com that I know because it has certain details that were used on a European domain register in 2014. I an EU citizen living in the states. Does the GDPR apply to them ...
0
votes
1answer
45 views
Do corporations have any legal liability for XSS exploits that can harvest private/payment info?
So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
0
votes
0answers
27 views
Single sign on via cookies and GDPR compliance?
Going to call my two sites "identity provider" and "WordPress site".
Flow is:
User logs in on identity provider
User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token ...
3
votes
4answers
77 views
Is a Blood sample considered Personal Data under GDPR?
Just that simple question:
Is a Blood sample considered Personal Data under GDPR?
0
votes
2answers
46 views
GDPR: can we ask the building owner to share and/or destroy data about one's RFID activity?
this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways
It seems most buildings store the activity of one's RFID key activity.
...
0
votes
2answers
60 views
Is a public IP address classified as “personal data” for a third party under EU law?
Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
0
votes
1answer
55 views
GDPR: Can I do anything that touches a system with live customer data if I have no instructions at all
I have just become aware of this particular Article 29, which has one good side: it is short.
The processor and any person acting under the authority of the controller or of the processor, who has ...
0
votes
4answers
103 views
Is it okay for letting agency to deny me viewing for not telling them my employer name and how long I had been in a profession?
Is it okay for a letting agency to ask me these questions ?
What is the name of company I work for ?
The property I am renting at the present is through agency or a landlord?
How long I have been ...
1
vote
1answer
32 views
GDPR and collecting politician's social media posts
I am interested in collecting tweets and social media posts from politicians in the USA. Specifically from their political social media accounts.
After reading this finextra article, I believe this ...
2
votes
2answers
54 views
Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)?
Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)?
For example, on Stack Exchange, do the questions, answers, comments, messages and ...
3
votes
4answers
48 views
Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?
I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
3answers
79 views
GDPR: Is giving out customer name and implied existence of customership legal?
I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable.
The purpose is to ...
3
votes
4answers
103 views
Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?
GDPR Article 39(1)(b) states:
The data protection officer shall have at least the following tasks:
(b) to monitor compliance with this Regulation, with other Union or
Member State data ...
1
vote
2answers
46 views
If we anonymize Google Analytics IPs do we still need to ask for Cookie consent? [duplicate]
Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent?
If so ...
1
vote
1answer
24 views
What data processing requires opt-in consent for an existing customer under GDPR?
I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where ...
1
vote
0answers
52 views
To achieve ECTS credits at my school a student is forced to drop his/her right of privacy
Some background about the situation:
I attend a vocational university (university of applied sciences)
I live in the Netherlands - Europe
We have a mandatory activity that provides us with ECTS ...
1
vote
1answer
37 views
Does the GDPR mandate that web sites provide access to cookie settings?
Cross referenced this question with SO just to get more technical perspective
In this article it says with respect to:
Google Analytics and GDPR consent to cookies and tracking:
Based on a true ...
1
vote
2answers
48 views
Does CNNs cookie consent banner comply with the GDPR?
I just got done reading this cookie consent material and it says that we need to keep a record of cookie consent. It also says that the notification needs to allows users to opt in and out of ...
1
vote
1answer
61 views
to be in photo and video, and right to ask for removal these data relying on GDPR
At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs.
Now, I want my pictures to be erased, or any data, ...
1
vote
1answer
20 views
Handling medical data received from outside the EU
If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU?
In particular, does ...
1
vote
2answers
56 views
GitHub pages and GDPR - controller, processor and DPA
I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain.
The only potentially personal data that the site will ...
1
vote
1answer
16 views
GDPR and date of fields creation / update
Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields :
client_id
name
first_name
and that I want to be GPDR Complient does I ...
3
votes
1answer
59 views
How to make data brokers delete my information without providing more information? Can I take legal action?
I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
2
votes
1answer
44 views
What is “a place where Member State law applies by virtue of public international law”?
Art. 3 (3) GDPR mentions that:
This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of ...
1
vote
0answers
45 views
Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?
It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
13
votes
3answers
2k views
Why can't I add a governing law to my terms of service to avoid GDPR?
I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
9
votes
1answer
1k views
Does GDPR cover the collection of data by websites that crawl the web and resell user data
I have found that a lot of my personal info is now available on a bunch of websites that collect data and resell it.
I'm talking about those 'find anything about anyone' websites.
A lot of the data ...
0
votes
1answer
63 views
Does GDPR require consent for a processor to confirm or deny the existence of data?
Assume we have two separate lists of emails handled by two different processors. List A is gathered by company A in a way that the subject has given their consent for its processing for marketing ...
1
vote
1answer
49 views
Does allowing users to see user tracking on my analytics software violate GDPR?
I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard:
However, you can click on a user ID (right) like abaer and see ...
3
votes
1answer
55 views
Requesting to see holiday rota and GDPR
my partner has asked if she can see the holiday rota and was told she couldn't because of GDPR. Is that correct? I know anything that identifies you needs to be secure but the rota of when people are ...
2
votes
0answers
51 views
Removing my personal data ex-employer (RGPD/GPDR ?)
I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
3
votes
1answer
3k views
Salesman text me from his personal phone
I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me ...
1
vote
1answer
40 views
Do you have to provide the name and email address of your data protection officer?
Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them:
You can contact Valve's data protection officer at the address below.
While we ...
6
votes
1answer
916 views
Is it okay to store user locations?
I know it might sound quite bad. But here I explain the whole situation.
I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
2
votes
1answer
38 views
GDPR data portability when no data stored
My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have ...
1
vote
1answer
21 views
GDPR collecting vs storing
I have a website that stores no personal data, however it does use ($_SERVER['REMOTE_ADDR']), a code that scans the IP address of visitors, but the IP address isn't stored anywhere. It's only scanned ...
0
votes
1answer
125 views
GDPR: Can a website not process personal data?
I want to have a website where I publish my own articles.
When a user requests a webpage, I receive an HTTP request from their browser, which contains the IP.
Now, for a split second while the ...
1
vote
1answer
54 views
Identity photographs under GDPR
Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018?
...
2
votes
1answer
37 views
Is it a violation of GDPR law to email personnel gathered from hunter.io?
I'm a web developer working on a project for a client. The project is a directory of sustainable companies (enviromental-friendly companies). The project is only launching now.
The companies listed ...
2
votes
1answer
46 views
GDPR Requirements for restricted use corporate webapp [closed]
The GDPR is very complicated, and while its requirements may be crystal clear to those who are intimately familiar with it, it is not at all clear to most as to what the exact requirements are in all ...
1
vote
1answer
39 views
What are the types of personal data?
In the GDPR, the concept of data categories is used and examples of such categories are given. The concept of data types is also used, but I do not know what they are.
Example of data categories, ...
3
votes
1answer
76 views
As a customer, am i liable for messaging another customer found on a Facebook business page?
I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company.
I have received a ...
