Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

1
vote
0answers
36 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
1
vote
1answer
14 views

If we anonymize Google Analytics IPs do we still need to ask for Cookie consent?

Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent? If so ...
1
vote
1answer
14 views

What data processing requires opt-in consent for an existing customer under GDPR?

I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where ...
1
vote
1answer
31 views

Does the GDPR mandate that web sites provide access to cookie settings?

Cross referenced this question with SO just to get more technical perspective In this article it says with respect to: Google Analytics and GDPR consent to cookies and tracking: Based on a true ...
1
vote
2answers
42 views

Does CNNs cookie consent banner comply with the GDPR?

I just got done reading this cookie consent material and it says that we need to keep a record of cookie consent. It also says that the notification needs to allows users to opt in and out of ...
1
vote
1answer
81 views

Does data that is anonymized need to be collected in the event of a GDPR Subject Access Request?

Google Analytics anonymizes and aggregates all user data so it is not possible to look up an individual user. Does that mean that in the event that we use Google Analytics and receive a Subject ...
1
vote
1answer
59 views

to be in photo and video, and right to ask for removal these data relying on GDPR

At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs. Now, I want my pictures to be erased, or any data, ...
0
votes
2answers
51 views

GDPR: Transmitting results from secondary to primary care records

In the UK, results of a blood (or other) test taken at a hospital (in secondary care) are stored in the hospital's records but are not automatically forwarded into primary care records (GP records) ...
1
vote
1answer
19 views

Handling medical data received from outside the EU

If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU? In particular, does ...
1
vote
2answers
49 views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
0
votes
1answer
175 views

Is it legal for me to use publicly accessible user data about a person on my website?

I run a wiki service and I was wondering if someone doxes an anonymous person in the from of a dump (pastebin, screenshots, recordings etc), can we keep that data or perhaps cite it? For instance if ...
1
vote
1answer
16 views

GDPR and date of fields creation / update

Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields : client_id name first_name and that I want to be GPDR Complient does I ...
1
vote
2answers
98 views

Is GDPR really needed if my android app doesn't collect any personal data?

I have developed some Android applications, and they don't store any personal data, but they do some calculation about some input, for example the annual salary provided by user and return to him a ...
1
vote
2answers
125 views

GDPR: if a user doesn't agree cookies on my banner, what must I do?

if a guest of my site click on "Not agree" on cookie banner, what must I do? Have I to disable all the cookies? Have I to disable all the cookies except technical cookies (eg. login session cookies)? ...
0
votes
1answer
42 views

Modify a client file

After the setup of the GDPR law about personnal data security, I have a case I'm not sure about. Test case: I receive an addresses file from a client containing x lines of addresses with personnal ...
3
votes
1answer
57 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
2
votes
2answers
155 views

Can I force a website/service to delete my private data

I would like to wipe my online data clean and make sure the people deleted my account. Considering that most services only offer to "close" or "suspend" the account and not delete the data like skype ...
8
votes
1answer
550 views

Legal aspects of Firebase Crashlytics SDK

Let's say we have a mobile app, where every user is associated with app-generated unique user id (ex. 57d2ef8b391277001aad7784). Having the uuid itself that's not possible to identify a user. ...
2
votes
1answer
42 views

What is “a place where Member State law applies by virtue of public international law”?

Art. 3 (3) GDPR mentions that: This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of ...
1
vote
1answer
145 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
1
vote
0answers
42 views

Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?

It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
13
votes
3answers
2k views

Why can't I add a governing law to my terms of service to avoid GDPR?

I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
9
votes
1answer
1k views

Does GDPR cover the collection of data by websites that crawl the web and resell user data

I have found that a lot of my personal info is now available on a bunch of websites that collect data and resell it. I'm talking about those 'find anything about anyone' websites. A lot of the data ...
1
vote
1answer
261 views

Parent company GDPR compliance

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
0
votes
1answer
61 views

Does GDPR require consent for a processor to confirm or deny the existence of data?

Assume we have two separate lists of emails handled by two different processors. List A is gathered by company A in a way that the subject has given their consent for its processing for marketing ...
1
vote
1answer
93 views

GDPR - Recording simple page views

We are currently using google analytics to track our site. The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the ...
0
votes
1answer
91 views

GDPR and a cell phone paid through work?

Company Contacts page From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B. For instance my private email is regulated by GDPR, but my work ...
0
votes
2answers
85 views

GDPR - Do we need to give individual mixed personal data of 2 individuals? (Right of access)

Individual is asking for phone recording which contains personal information of that individual and our marketing person, it also contains our sales speech. Do we need to provide copy of phone ...
1
vote
1answer
46 views

Does allowing users to see user tracking on my analytics software violate GDPR?

I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard: However, you can click on a user ID (right) like abaer and see ...
3
votes
1answer
53 views

Requesting to see holiday rota and GDPR

my partner has asked if she can see the holiday rota and was told she couldn't because of GDPR. Is that correct? I know anything that identifies you needs to be secure but the rota of when people are ...
1
vote
0answers
57 views

Russian bank calling Russian citizen who is tourist in EU - GDPR issues

Let's say I'm Russian citizen (no dual citizenship) and on a tourist visa in the EU. I got a call on my roaming Russian mobile phone number from a Russian bank who tries to offer me a new product. I'm ...
2
votes
0answers
50 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
3
votes
1answer
3k views

Salesman text me from his personal phone

I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me ...
5
votes
3answers
590 views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
6
votes
1answer
912 views

Is it okay to store user locations?

I know it might sound quite bad. But here I explain the whole situation. I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
1
vote
1answer
36 views

Do you have to provide the name and email address of your data protection officer?

Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them: You can contact Valve's data protection officer at the address below. While we ...
0
votes
1answer
114 views

GDPR: Can a website not process personal data?

I want to have a website where I publish my own articles. When a user requests a webpage, I receive an HTTP request from their browser, which contains the IP. Now, for a split second while the ...
2
votes
1answer
36 views

GDPR data portability when no data stored

My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have ...
1
vote
1answer
20 views

GDPR collecting vs storing

I have a website that stores no personal data, however it does use ($_SERVER['REMOTE_ADDR']), a code that scans the IP address of visitors, but the IP address isn't stored anywhere. It's only scanned ...
1
vote
1answer
52 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
6
votes
2answers
673 views

Does vehicle information count as personal data?

Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation? How about the VIN? (Vehicle Identification Number)
5
votes
5answers
115 views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
2
votes
1answer
34 views

Is it a violation of GDPR law to email personnel gathered from hunter.io?

I'm a web developer working on a project for a client. The project is a directory of sustainable companies (enviromental-friendly companies). The project is only launching now. The companies listed ...
2
votes
1answer
34 views

GDPR Requirements for restricted use corporate webapp [closed]

The GDPR is very complicated, and while its requirements may be crystal clear to those who are intimately familiar with it, it is not at all clear to most as to what the exact requirements are in all ...
1
vote
1answer
32 views

What are the types of personal data?

In the GDPR, the concept of data categories is used and examples of such categories are given. The concept of data types is also used, but I do not know what they are. Example of data categories, ...
3
votes
1answer
75 views

As a customer, am i liable for messaging another customer found on a Facebook business page?

I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company. I have received a ...
1
vote
0answers
53 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
-2
votes
1answer
166 views

Google AdWords banned my account. Can I request complete deletion under GDPR?

GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on ...
0
votes
1answer
21 views

When to authorize someone and when to sign a contract for processing personal data

There are two ways for the data controller to let someone else process the data he controls: authorise him or her to do so, sign a legal contract making him or her a 'processor' (Article 28 GDPR). ...
0
votes
1answer
31 views

Data Portability in GDPR

I've reading: https://gdpr-info.eu/art-20-gdpr/ It says: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, ...