Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
3 votes
1 answer
59 views

Tenancies and the GDPR

If Tim the tenant and Larry the landlord enter into a tenancy, then do either of them become a data controller of the others name and address? Does the landlord as the "provider" of the ...
user avatar
  • 3,880
5 votes
2 answers
1k views

Under GDPR, does blurhash of a profile picture count as personal data

Suppose I have a web service where users can have a profile page with name and picture. Blurhash is a technology that allows me to create a significantly blurred representation of an image, as a ...
user avatar
1 vote
1 answer
65 views

"Find my device" and GDPR compliance

Google and Apple both offer a "Find my Device" service which allows to track or even remotely wipe a stolen device. Yet some companies claim that tracking stolen devices is not a legitimate ...
user avatar
0 votes
2 answers
56 views

Server side analytics events

If I track a 'questionnaire started' event with a user's GUID for analytics purposes server side, could that contravene any UK data laws such as GDPR or the ePrivacy / cookie consent law? The reason I ...
user avatar
2 votes
2 answers
74 views

Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?

Suppose I check into a German hotel and a Johann stayed in room 123 on the previous night. Presumably, he is the only Johann who stayed in the room on that night. There are many Johanns within Germany ...
user avatar
  • 2,370
22 votes
2 answers
2k views

Other use of profile photos: legality fair-use and permissions

I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). ...
user avatar
0 votes
2 answers
38 views

If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?

Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with ...
user avatar
  • 1,770
1 vote
1 answer
87 views

Under what circumstances is it lawful or unlawful for police to disclose one's information to third parties, e.g. complainants?

Is it basically neither prohibited nor required and thus entirely to police discretion as to whether or not to disclose parties' details to either their purported victims, or to other parties like ...
user avatar
  • 3,880
0 votes
1 answer
70 views

Do I need to worry about GDPR, CCPA, CalOPPA, if collecting anonymous usage for a non-commercial, no-ads app?

I am developing a free, non-commercial Android App that does not use Ads or in anyway attempt to share their information with a third-party. However, I would like to include both Google Analytics and ...
user avatar
0 votes
2 answers
101 views

Any obligation to disclose one's name and address to private parties for service of civil claims after a street altercation?

Suppose A is walking down the street and B punches A in the nose, thus committing assault. Legally, A is entitled to claim civil damages against B, and can practically do so if they know A's name and ...
user avatar
  • 3,880
1 vote
2 answers
160 views

Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?

(Apologies in advance for the lengthy epistle) Background: A colleague is planning to launch a social media and forum website which will appeal to a relatively narrow audience. For the sake of ...
user avatar
  • 195
15 votes
3 answers
3k views

GDPR & Blocking EU Visitors?

I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
user avatar
  • 195
0 votes
1 answer
36 views

Under GDPR, do organisations have to tell the ICO (or similar) the email address they use for GDPR deletion requests?

As is well known, websites (illegally) use deliberately misleading and frustrating web design to slow down users who want to tell them not to collect information for marketing purposes. If they ...
user avatar
  • 233
12 votes
5 answers
1k views

Are auto-generated identifiers PII if they cannot be linked to an identity?

The reason for this post is to express a contradiction that seems to be widespread in some places on the internet. I'm not a lawyer, I'm a software developer doing my best to comply with the GDPR and ...
user avatar
  • 303
2 votes
3 answers
73 views

Is storing on EU-based servers sufficient to be GDPR-compliant with regard to the Schrems II arrest if they're controlled by a U.S. company?

After the Schrems II decision, data transfers to US data processors are increasingly risky at best, for example to public cloud providers such as GCP, Azure, and AWS. A very common suggestion is to ...
user avatar
  • 123
2 votes
1 answer
225 views

Do pastebin sites have to delete content on request?

A pastebin site, hosted in the US, allows users to post data anonymously. However, its intended purpose is for sharing information about one's computer, including the username (which is sometimes PII)....
user avatar
  • 4,826
1 vote
1 answer
63 views

Does the ePrivacy directive apply to general JavaScript code?

Sweden have a "cookie law" that requires constent for non-necessary cookies. But the law seems way more general. Information may be stored in or accessed from a subscriber's or user's ...
user avatar
  • 13
2 votes
2 answers
81 views

GDPR and personal data reselling

The situation is following: I had an account in company A which then was sold to company B, both conduct online services. I wasn't aware of this because I didn't log in to my account for several years,...
user avatar
14 votes
2 answers
3k views

Why does the GDPR matter to me, a US citizen with no property in Europe?

I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
user avatar
  • 4,826
0 votes
1 answer
34 views

Do you need to remove a customer's data for GDPR or the like, if that data has been anonymized and used as part of an aggregate?

Say I have a SaaS which collects users financial information, or location information, or other random information, and aggregates it in an anonymous way. Say for example I present to my users "...
user avatar
  • 101
0 votes
1 answer
34 views

GDPR - When does data become personal data, and what exactly comprises personal data?

As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following: ...
user avatar
2 votes
1 answer
69 views

Data backups, data loss, the GDPR right to be forgotten, and timing

This question concerns the timing of GDPR demands in regard to the "right to be forgotten", and data loss. I am considering creating a web app that allows users to play a game against one ...
user avatar
  • 135
-2 votes
1 answer
111 views

GDPR Compliance for Application That Guesses Email Addresses

I live in the U.S. and am developing a browser extension that grabs a person's first name, last name, and company name from their LinkedIn profile and then attempts to guess their email address based ...
user avatar
  • 13
4 votes
1 answer
318 views

What is the most comparable American law to GDPR right to subject access? Privacy Act?

HIPAA seems comparable but only applies to medical data, but is there anything more general than that? How does privacy act compare to data subject access rights under gdpr? Is it that it only applies ...
user avatar
  • 3,880
1 vote
1 answer
85 views

Are terms of use considered a contract from GDPR point of view?

If service terms of use doesn’t talk about setting up a contract between the company and the user, can you use «execution of contract» as the lawfulness for GDPR processing ? If signup data is ...
user avatar
1 vote
1 answer
36 views

What’s the internal DPO access level?

Since the internal Data Protection Officer (DPO) should be independent, he needs to have access to all company files. But should he have access to everything at all time, or can the company only allow ...
user avatar
0 votes
1 answer
103 views

How does Facebook justify non-compliance with GDPR subject access requests?

At first when Max Schrems started doing it they complied in good faith completely. Now they don't. Do they have some legal theory or workaround as to why they were required to back then but no longer ...
user avatar
  • 3,880
1 vote
1 answer
66 views

Legality of Credit Bureaus selling information without consent

I recently had a hard pull for a mortgage done (USA based). Since then, my personal phone number has been bombarded with calls and texts related to "better offers", despite being registered ...
user avatar
  • 440
1 vote
1 answer
46 views

Google CCPA Request

In Google's CCPA report, it claims that users can request data deletion via this link. However, the link provides no way to submit a request, and Google claims that there is no Google-wide support ...
user avatar
  • 139
0 votes
1 answer
147 views

Why does Clearview AI get multimillion dollar fines while Pimeyes is allowed to operate freely?

Yesterday the UK has fined Clearview AI 7.5 million pounds for a string of breaches of local privacy laws. The main reason for the fine is that Clearview has never asked individuals whether it can use ...
user avatar
  • 133
2 votes
1 answer
125 views

GDPR - asking for consent indefinitely if respondent says no, until respondent say yes by exhaustion. Confirming choices allegedly forcing behaviour?

Under EU regulation, GDPR concerns dealing of personal data and describes the different parties that are responsible for handling those data. While navigating on the internet, a pop-up is prompted ...
user avatar
2 votes
1 answer
48 views

GDPR on 3 attributes of scraped data

I have scraped horse rating data with the intent of hosting an API users can subscribe to and query the dataset in various different forms e.g. Excel, JSON etc... with added analytics applied as well. ...
user avatar
1 vote
1 answer
58 views

Essential cookies - legal responsibilities

I'm using Stripe to process payments on my site The only cookies the site uses are set and processed entirely by Stripe The cookies would only apply to users who have 1) created an account, and 2) ...
user avatar
  • 111
0 votes
1 answer
110 views

Are javascript keyloggers on websites legal?

I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
user avatar
  • 1,770
0 votes
0 answers
78 views

Self-set needs-based salary

Is it legal, in regard to GDPR and Norwegian/European law, for an employer to ask their employees to List their yearly monetary needs Present their needs, to management for approval Set their salary ...
user avatar
  • 101
2 votes
2 answers
53 views

Limits of automated decision making WRT workplace surveys

As part of the GDPR, if personal data is used for automated decision making a number of rules apply, particularly regarding consent and access to data. A number of companies offer workplace surveys, ...
user avatar
  • 1,770
3 votes
1 answer
49 views

UK - Privacy Policy requirements for website with no tracking

Essentially I run a website which is a microblog for anyone to use. The user who creates the content does so on one domain which requires login, stores a cookie etc.. The reader (user) of the blog ...
user avatar
0 votes
1 answer
52 views

My previous employer had a data breach

It seems my bank account details. Passport information. Address etc have been leaked. I left the company 3 years and 4 months ago. It’s a private law firm. They have offered me a 12 month credit ...
user avatar
10 votes
2 answers
3k views

Can I store the names of arbitrary business associates in my CRM system?

I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships. For example, "Gina works on reception." Is this allowed ...
user avatar
1 vote
1 answer
55 views

Collecting statistics from online gaming and GDPR obligations

I am looking to to build an interface within a sandbox pc game environment that will allow for the collection of tabletop wargaming game stats in addition to player online ID(steam name). This data ...
user avatar
1 vote
1 answer
75 views

Is it possible to send an additional email to people who didn't confirm their subscription?

We are wondering if we can send another email to people who subscribed to our newsletter but never clicked on the confirmation link sent afterwards. Is it ok GDPR-wise?
user avatar
0 votes
1 answer
32 views

should a website show cookies popup in following context?

I am a part of developers team in a software as service project hosted and HQ-ed in United States. Why I asking my question I personally tasked to improve our analytics and one of tasks is to find an ...
user avatar
0 votes
3 answers
83 views

Is there any restriction in the GDPR on creating a Whatsapp group?

I work with an assistance entity that helps people in situations of social vulnerability (poverty). Surprisingly everyone has a cell phone and uses Whatsapp. Taking this facility into account, I ...
user avatar
0 votes
2 answers
107 views

Is it possible to receive copy of deleted facebook messenger messages under GDPR?

Is it possible to receive copy of deleted private facebook messenger messages under GDPR if two recipients deleted them?
user avatar
-1 votes
1 answer
107 views

Where is it stated in the GDPR that the GDPR only applies to EU citizens?

I recently came to the shocking realization that the GDPR does not apply to natural persons who are not EU citizens. I looked up the GDPR to find the Article or GDPR item that mentions this but could ...
user avatar
  • 109
1 vote
1 answer
46 views

Does an email hop in the US count as an international data transfer?

Alice is a data subject, Bob Inc. is a data controller processing her PII, both located in the UK. In responding to a subject access request, Bob Inc. sends some PII in plain text in an email. ...
user avatar
  • 1,770
0 votes
2 answers
61 views

Is Browser-Fingerprinting legal when I transfer/ store only the hash of user related attributes?

Is the following pseudo code, being executed within the browser, compatible with GDPR? sha256(fonts + useragent + plugins + ..) Notice: It doesnt store the actual attributes on the server, only the ...
user avatar
0 votes
1 answer
81 views

Does the GDPR apply to reference managers?

Reference managers are software products that record the details of scientific papers that one interacts with. All academics and many others use them as a crucial tool of their work. Common examples ...
user avatar
  • 1,770
1 vote
1 answer
77 views

Is my name and email address being sent to another customer a GDPR violation?

An agency, to which I provided my personal email address (contains my full name), has emailed me and another of their customers (both emails in "TO" field). The other customer and I have ...
user avatar
  • 163
1 vote
2 answers
44 views

Under The EU General Data Protection Regulation (GDPR,) do I need a legal obligation in order to divulge information to law enforcement?

Suppose I get a request from a law enforcement agency, for data that I'm already processing legally. Can I just give the information to the agency, or do I need to verify that I am under a legal ...
user avatar
  • 2,370

1
2 3 4 5
17