Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
896
questions
0
votes
0
answers
48
views
What is the legality and consequence of blocking one who submits a SAR? [duplicate]
Alice submits a subject access request to Bob via WhatsApp, Bob responds to this by blocking Alice, but otherwise ignores her. What is the legality and consequences of Bob’s response to her SAR?
- 4,252
3
votes
2
answers
79
views
Access rights to professional photographs
An independent professional photographer uses a sales tactic of candidly taking photos of others in public and then approaching them and offering them copies for a price. Suppose one of these ...
- 4,252
0
votes
0
answers
28
views
Who is the data controller of footage taken on a retail worker’s personal phone?
An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer ...
- 4,252
0
votes
2
answers
59
views
Can a customer of a business make a recording of an employee on the business’s privately premises?
Suppose a customer enters a store. The business, through an employee, treats the customer unlawfully. Perhaps this is by verbally or physically abusing them, discriminating against them, or denying ...
- 4,252
-1
votes
2
answers
33
views
Can data protection rights of a subject be voluntarily waived?
Presumably not on protrusion by a service provider as a condition of their service. But what if someone writes to someone super busy whom they admire and says “look I really respect you and don’t want ...
- 4,252
1
vote
2
answers
73
views
Is training an AI on the internet processing personal information?
There is an article on El Reg where the author asks ChatGPT about themselves, and they get back some information. If this data acquisition and dissemination process was being performed specifically ...
- 3,338
0
votes
1
answer
46
views
EU and CLOUD Act [closed]
I can't find anything what's on this in 2023 - is EU anyhow working towards and agreement with US to allow not to give away private data? - As I see on Wikipedia, so far only UK has got this agreement ...
- 447
0
votes
1
answer
49
views
Is just embedding YouTube thumbs GDPR conform?
Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?
1
vote
3
answers
80
views
What does "necessary" mean with regards GDPR and cookie consent
The GDPR makes use of the word "necessary". For example article 6. Lawfulness of processing 1. (f) says "processing is necessary for the purposes of the legitimate interests pursued by ...
- 3,338
0
votes
1
answer
45
views
If I have concurrent user consents then can I combine these consents?
I have an app that supports concurrent user consents.
Assume that I have:
Consent A that gives access to https://example.com/resources/a
Consent B that gives access to https://example.com/resources/b....
- 105
14
votes
1
answer
2k
views
How can consent-banner as a service be GDPR compliant?
A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
- 243
2
votes
2
answers
72
views
Is a bank account history of transactions considered personal data in the sense of GDPR?
For archival purposes, I'm trying to get the full history of transactions on my bank account since I opened it in 2019. I know my bank still has it since it's visible in the mobile app (I can scroll ...
- 121
1
vote
1
answer
34
views
GDPR When using an external CV formatting company
As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
- 11
0
votes
1
answer
71
views
Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?
ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
- 4,252
4
votes
1
answer
110
views
What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?
What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?
The social network Mastodon https://en.wikipedia.org/wiki/Mastodon_(social_network) ...
- 161
6
votes
3
answers
2k
views
GDPR: Do I have to IP log "every" login for a customer?
IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. ...
- 63
0
votes
1
answer
37
views
GDPR @ ePrivacy & Data Controller & Local processing PII & Mobile App
I'm developing an open source client mobile app that allows user to use third-party social media. So the app logs in directly to the interface with the credentials entered by the user and makes direct ...
10
votes
2
answers
1k
views
GDPR - Are technical identifiers personal data?
I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
- 203
1
vote
1
answer
78
views
What are GDPR Laws concerning requirement to back up data
I want to create an application where I want to act as a data controller & data processor.
The only data I want to record myself is basic user data like username, address , etc.
But I want to run ...
0
votes
1
answer
34
views
Can a Data Controller refuse a second SAR from the same person?
Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
- 112k
4
votes
2
answers
1k
views
What is the U.K. GDPR?
I understand that the DPA implemented the GDPR in British law as an act of Parliament. Then there was Brexit, and the U.K. GDPR was introduced to stand in for the no longer binding EU GDPR, with only ...
- 4,252
2
votes
0
answers
64
views
Is there anything to stop a subject access requester from being barred by a business?
A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
- 4,252
5
votes
1
answer
321
views
Is it a breach of GDPR and DPA to say a colleague is sick and off work?
This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer ...
- 620
-2
votes
1
answer
59
views
How shall I handle user consent "remember" option [closed]
I get consent from user for some operation. While consenting user can check "remember consent" option and this is handled as below:
Consent is saved to db
Some action is done and consent is ...
- 105
0
votes
1
answer
63
views
Practical implications of failing to follow GDPR for online businesses
Suppose a person based in UK has started a one-man business online, for example, a web blog where people can read articles and post comments. Now, the business owner is focused on testing out the ...
- 35
0
votes
1
answer
49
views
SAR before claim: tactical and legal considerations [closed]
A claimant C intends to sue a business B, which is also a data controller. Independently of the prospect of any civil action, C is entitled to make a SAR (Subject Access Request) to B under the Data ...
- 4,252
3
votes
1
answer
81
views
Processing screenshots of people's browser windows on a web server
Suppose that a software developer (April) living in the UK,has created a simple browser plug-in that takes screenshots of a user's browser windows and allows the user to enhance and "prettify&...
- 35
-1
votes
1
answer
33
views
Restricting processing of data provided to police
Suppose that a person A would like to report a crime of which they’ve become a victim, to the police. For this purpose the police typically require the victim’s date of birth in order to create a ...
- 4,252
8
votes
1
answer
684
views
Does gdpr.eu violate GDPR compliancy?
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
- 181
-1
votes
1
answer
50
views
Choosing region for database to be US / EU compliant
I wanted to ask about how one should go about choosing region for database / cloud provider when working on an application that stores user data for EU and US customers. Business behind the app is a ...
- 101
0
votes
2
answers
54
views
Can a mobile app save data about a user without a user giving the permission?
Is it allowed to store a user id to remember him, his settings, preferences and history, without asking for his permission?
Is there anyknowledge about that how that goes with privacy laws like GDPR ...
- 101
0
votes
2
answers
102
views
How restrictive is the General Data Protection Regulation (GDPR) in Europe?
Lets say that I want to take a picture or record a video of a city I am visiting in Europe and like its inevitable people will appear in the picture or video. I cannot do this before asking permission ...
- 111
5
votes
1
answer
1k
views
Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?
Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)?
I am following the current issue ...
- 119
0
votes
2
answers
65
views
Can I legally sync and save YouTube comments on my website
I own a YouTube channel and a website that belongs to it. On the website, I am also displaying the YouTube videos. For various reasons, I want to create a plugin to sync the comments on my YouTube ...
- 111
2
votes
2
answers
54
views
Is nickname on an android app consider as personal Information for GDPR policy
I am currently developing a puzzle game where the player initially has the option to enter a
"NIckname" of his choice ( might also be his name - its up to him what to enter) so that his
time ...
- 21
0
votes
1
answer
137
views
Would it be illegal to forward CCTV footage of someone committing a crime to their employer? (UK)
An incident has occurred where an individual in a private business committed an offence (common assault/battery).
As expected the police seem fairly unmotivated or interested however a quick Google ...
- 145
5
votes
2
answers
4k
views
Is displaying the user first name and last name a breach of GDPR?
We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
- 151
0
votes
1
answer
91
views
The GDPR and how it treats online game character names
I am writing a MUD server - a multiplayer game where people connect and create characters.
I am unsure if the GDPR applies to me - offering a game to the public is not a household task, but I am also ...
- 103
3
votes
1
answer
815
views
In GDPR terms is the hash of a user ID considered personal data?
“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, ...
- 133
0
votes
1
answer
88
views
Using AI to identify similar browsing pattern
I understand that storing any hash or IP that can identify "user uniquely" is against GDPR. I am planning to use user browsing patterns to see if a similar or the same user had previously ...
- 61
6
votes
2
answers
2k
views
Emailing a publicly available address posted by the same person
I understand that emailing a person without consent is illegal under GDPR.
But is it okay to email someone if the person has made the mail address public? For example if a university professor posted ...
- 61
0
votes
1
answer
60
views
When need I to display consent and should deprecated consents be stored?
When the law requires consent screen to be displayed for user? Should it be displayed only for third party applications (e.g. signing to stackoverflow by google account) or is it also necessary for ...
- 105
1
vote
1
answer
72
views
GDPR: Alternatives to 3rd party cookie-based analytical systems?
Cookie-based solutions became challenging to leverage due to the GDPR law. As an analyst, it's hard because my work depends on these metrics that will no longer be available with cookie-based tracking ...
- 113
12
votes
2
answers
2k
views
Are users' personal notes about other users subjected to the GDPR right of access?
Some applications, like Discord or Mastodon, allow a user A to put private notes (only accessible to A) next to the profile of another user B. This data is very probably Personal Identifiable ...
- 123
1
vote
2
answers
71
views
Can one require data of which one is the subject to be erased as well as disclosed?
Under the GDPR, one is entitled to receive any data including CCTV footage that one may feature in if it still exists. However, can one as the data subject also require by request for such footage to ...
- 1
1
vote
2
answers
57
views
Is the local presence of a foreign non-GDPR state a data controller subject to the provisions of the Data Protection Act 2018?
Consider that state X is not subject to the gdpr, however, it has a diplomatic presence in the UK.
If the state were a tech company that operated in or even simply offered services to people in, the ...
1
vote
1
answer
84
views
Webhosts' legal obligations to remove publicly available content associated with specific IP addresses
Let's say one builds a website allowing users to post text content that is publicly available and searchable via the IP address of the users who submitted it. Would the owner of that website be ...
- 235
2
votes
1
answer
30
views
Privacy Policy change for different Countries / Continents on Website
I'm currently researching the GDPR Terms for a European Website. The Company has its headquarters and registration in Europe.
If someone from, let's say US, visits the website, do I have to cover the ...
- 23
3
votes
1
answer
134
views
Am I allowed to use US web hosting according to GDPR
I live in UK, and I own a super simple website (web blog). The users of my website are not required to log in or provide any kind of personal information, they are just readers of my content.
I used ...
- 31
-2
votes
1
answer
58
views
Why do some data controllers require two forms of ID and others only one?
Meet Bob. Bob has submitted a number of subject access requests to various data controlling bodies, including businesses and several police forces.
Some police forces simply require scan of id with ...