Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
922
questions
1
vote
1
answer
57
views
Receive written confirmation about non-breached data
Context:
I am working for an institution which has recently suffered a data breach.
There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
0
votes
1
answer
31
views
How is the information retention for shared data to be interpreted?
I don't quite understand the part of the GDPR regarding data retention duration when applied to shared data..
I'm using Google AdMob to display (personalized) ads on my app. Device data and possibly ...
- 1
3
votes
1
answer
276
views
GDPR and Storing Non-EU Citizen Data as an EU-based company
I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
- 23.5k
1
vote
1
answer
80
views
Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR? [duplicate]
Our company is based in the UK. We have users who are located in the USA, are these users protected by GDPR?
Any help on this questions would be much appreciated!
- 23.5k
1
vote
3
answers
211
views
Can i request a religious forum to delete my posts for GDPR compliance?
It's a forum discussing religious stances and personal practice.
Is it possible to request posts to be removed along with the account registry?
As i understand it, forums in general don't have to ...
- 1
4
votes
1
answer
124
views
Does the GDPR's "right to be forgotten" extend to Google's search results?
I have recently "googled" my own full name and found out that some comments I made during my teens have been indexed by Google. Back then I have used my full name as a user-name on that ...
- 1
1
vote
1
answer
48
views
Can one make a Subject Access Request of a telephone Communications Provider?
I have received a suspected scam telephone call. Searching the internet for the number I found that "phone block 247520 is operated by DIDWW Ireland Limited". Searching this I came across ...
- 4,138
21
votes
2
answers
4k
views
Are global user account systems now illegal following the EU's May 2023 fine of Meta?
The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta
Like any website, we have an account system where people log in to access their ...
- 137
5
votes
1
answer
126
views
Does a US company moving its PII and web servers to the EU solve the Meta fine problem?
As discussed in this question about the Meta fine it is a problem for companies that host websites with access to EU user registration data in US datacenters. This is based on the 'Schrems II' ...
- 23.5k
2
votes
0
answers
49
views
What are the limits to what the information commissioner can take action upon?
It is in the news that a doctor inappropriately accessed and distributed a patients medical records. They did this through their employer, Cambridge University Hospitals (CUH) at Addenbrookes. The ...
- 4,135
9
votes
1
answer
3k
views
Can a non-profit organization record attendance by name without permission?
I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
- 23.5k
1
vote
1
answer
134
views
I have found my email address online in a .txt file. What should be my next step? [closed]
A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails ...
- 11.9k
4
votes
1
answer
82
views
What does "Household Exception" to the GDPR mean?
GDPR Section 2 Recital 18 (?) reads:
Not Applicable to Personal or Household Activities
This Regulation does not apply to the processing of personal data by a natural person in the course of a purely ...
- 23.5k
2
votes
0
answers
28
views
Search engine data breaches, osint
Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
- 43
2
votes
1
answer
97
views
Do US companies need a cookie consent banner for EU traffic?
Example:
US website, targeting customers in the US. They use Google Analytics and Google Ads cookies etc.
Do they need a cookie consent banner for EU traffic? Or should they just not load any tracking ...
- 23.5k
8
votes
3
answers
4k
views
On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?
I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in ...
- 465
4
votes
3
answers
211
views
Is storing on EU-based servers sufficient to be GDPR-compliant with regard to the Schrems II arrest if they're controlled by a U.S. company?
After the Schrems II decision, data transfers to US data processors are increasingly risky at best, for example to public cloud providers such as GCP, Azure, and AWS.
A very common suggestion is to ...
- 101
-1
votes
1
answer
103
views
Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?
Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls.
The fact that it's now allowed again makes me wonder if Italy (and the ...
- 45
0
votes
1
answer
67
views
Utilizing Browser IP for Service Security
Suppose a web designer plans to use IPs for security purposes to prevent botting unique clicks and brute force attempts. And, the site only stores a hash of the IP address for a limited amount of time ...
- 3,026
2
votes
1
answer
36
views
GDPR protection for non-EU individuals by using EU services through VPN use?
REASON FOR QUESTION:
I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
- 23.5k
1
vote
1
answer
71
views
Who is the data controller of footage taken on a retail worker’s personal phone?
An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer ...
CommunityBot
- 1
5
votes
1
answer
242
views
Choosing DPA to submit data breach complaint (EU-specific)
Context
The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
The offenders ...
- 23.5k
5
votes
1
answer
73
views
How does GDPR's right to erasure apply to deduplicated storage?
I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case:
Company A offers a online data storage service that is intended to be used by the users ...
- 103
1
vote
1
answer
65
views
Do any other consumer rights laws have extraterritorial applicability to international organisations that cater to British or European customers?
The GDPR purports to bind any organisation, wheresoever it may be based, that serves individuals based in the EU, or (as the case may be) the UK.
The GDPR governs the obligations of organisations and ...
- 31.2k
0
votes
1
answer
30
views
Can two or more different entities simultaneously be data controllers for the same data?
Suppose Alice is a customer of a business ACME who holds data on her like email correspondence. ACME uses a third party to manage their email, suppose Fastmail.fm. Fastmail.fm in turn delegates their ...
- 27.4k
7
votes
2
answers
585
views
Is a sent email in someone else’s inbox subject to data subject rights of the sender?
Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
- 3,026
0
votes
2
answers
105
views
Publishing personal data obtained on a Swedish server - GDPR implications
Imagine a small social media chat platform is hosted in Sweden and subject to GDPR. Party A sends personal information to party B using the platform, using a private message. The information was ...
- 11.9k
0
votes
1
answer
57
views
Can a user opt-out of embedded services without prior account-linking?
Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
- 23.5k
-2
votes
1
answer
55
views
Old backups containing login information [closed]
I've been keeping an old website backup of a website that I used to work on on my PC for the last year or so. It was all my own work and wanted to just keep it in case I ever wanted to reuse it or use ...
- 11.9k
-1
votes
2
answers
64
views
What would constitute personal data? [duplicate]
For example, would a name in the form first initial last name be considered personal data, considering this could apply to many people?
What about if we added in a hobby, perhaps that they watch ...
- 23.5k
0
votes
1
answer
76
views
Is just embedding YouTube thumbs GDPR conform?
Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?
CommunityBot
- 1
0
votes
0
answers
50
views
What is the legality and consequence of blocking one who submits a SAR? [duplicate]
Alice submits a subject access request to Bob via WhatsApp, Bob responds to this by blocking Alice, but otherwise ignores her. What is the legality and consequences of Bob’s response to her SAR?
- 5,862
3
votes
2
answers
93
views
Access rights to professional photographs
An independent professional photographer uses a sales tactic of candidly taking photos of others in public and then approaching them and offering them copies for a price. Suppose one of these ...
- 27.4k
0
votes
2
answers
71
views
Can a customer of a business make a recording of an employee on the business’s privately premises?
Suppose a customer enters a store. The business, through an employee, treats the customer unlawfully. Perhaps this is by verbally or physically abusing them, discriminating against them, or denying ...
- 27.4k
-1
votes
2
answers
43
views
Can data protection rights of a subject be voluntarily waived?
Presumably not on protrusion by a service provider as a condition of their service. But what if someone writes to someone super busy whom they admire and says “look I really respect you and don’t want ...
- 23.5k
2
votes
2
answers
90
views
Is training an AI on the internet processing personal information?
There is an article on El Reg where the author asks ChatGPT about themselves, and they get back some information. If this data acquisition and dissemination process was being performed specifically ...
- 27.4k
2
votes
4
answers
1k
views
Is it legal to ignore "Do Not Track" for data subjects who fall under the GDPR?
The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different ...
- 23.5k
0
votes
1
answer
47
views
EU and CLOUD Act [closed]
I can't find anything what's on this in 2023 - is EU anyhow working towards and agreement with US to allow not to give away private data? - As I see on Wikipedia, so far only UK has got this agreement ...
- 688
3
votes
2
answers
1k
views
GDPR, PII, and UUIDs
GDPR states that
An individual is ‘identified’ or ‘identifiable’ if you can distinguish them from other individuals.
and also that
The GDPR provides a non-exhaustive list of identifiers, including:
...
- 103
1
vote
3
answers
91
views
What does "necessary" mean with regards GDPR and cookie consent
The GDPR makes use of the word "necessary". For example article 6. Lawfulness of processing 1. (f) says "processing is necessary for the purposes of the legitimate interests pursued by ...
- 183k
0
votes
1
answer
46
views
If I have concurrent user consents then can I combine these consents?
I have an app that supports concurrent user consents.
Assume that I have:
Consent A that gives access to https://example.com/resources/a
Consent B that gives access to https://example.com/resources/b....
- 23.5k
2
votes
1
answer
754
views
Is MailChimp compliant with GDPR?
In light of recent news of Facebook not being compliant with GDPR because it processes data in USA and not in europe, would a website using MailChimp for newsletter be GDPR compliant since it is based ...
- 10.8k
14
votes
1
answer
2k
views
How can consent-banner as a service be GDPR compliant?
A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
- 23.5k
6
votes
3
answers
3k
views
GDPR: Do I have to IP log "every" login for a customer?
IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. ...
- 63
2
votes
2
answers
87
views
Is a bank account history of transactions considered personal data in the sense of GDPR?
For archival purposes, I'm trying to get the full history of transactions on my bank account since I opened it in 2019. I know my bank still has it since it's visible in the mobile app (I can scroll ...
- 23.5k
1
vote
1
answer
36
views
GDPR When using an external CV formatting company
As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
- 23.5k
0
votes
1
answer
79
views
Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?
ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
- 23.5k
4
votes
1
answer
143
views
What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?
What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?
The social network Mastodon https://en.wikipedia.org/wiki/Mastodon_(social_network) ...
- 197k
0
votes
1
answer
44
views
GDPR @ ePrivacy & Data Controller & Local processing PII & Mobile App
I'm developing an open source client mobile app that allows user to use third-party social media. So the app logs in directly to the interface with the credentials entered by the user and makes direct ...
- 23.5k
10
votes
2
answers
1k
views
GDPR - Are technical identifiers personal data?
I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
- 23.5k