Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
8
votes
2answers
462 views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
1
vote
2answers
80 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
-2
votes
0answers
14 views

What are the legal requirement related to storing customer data? [on hold]

Can someone list the main points a developer has to consider when storing customer data in a web service with respects to GDPR?
0
votes
0answers
34 views

Purpose classification of cookies based on GDPR and ePrivacy [on hold]

Although GDPR mentions cookies only in a single recital, several consulting companies (e.g., Cookiepedia or Cookiebot) interpreted it similarly. For the cookie consent, they classify cookies into ...
3
votes
2answers
32 views

GDPR - am I the processor if I don't host the website?

I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase ...
0
votes
1answer
66 views

Is deterministic anonymization of test data ok?

Deterministic anonymization of test data? When anonymizing multiple data sources and preserving data consistency we usually end up with a mapping table for "real to anonymized" values. Typically ...
-1
votes
1answer
34 views

Data anonymization of user idents?

Data anonymization of user idents? I wish I didn't have to since I see little value to it. User idents By user idents I mean such as windows login name, LDAP short names such as "PDIG". These ...
17
votes
1answer
3k views

GDPR rights when subject dies; does family inherit subject rights?

Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.). What if the subject is deceased? Does the widow/widower or do the children ...
3
votes
1answer
72 views

Under GDPR, why is google not considering the index entries as personal data?

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling. Following this, I make the assumption that this qualifies as personal data under GDPR ...
3
votes
1answer
43 views

Do I need user consent to respond to their email sent through my website's contact form?

I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message. I'm not storing any of the data in a database or in cookies. When the user ...
1
vote
3answers
110 views

How often does a website have to ask for cookie consent?

I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or ...
2
votes
2answers
55 views

Under GDPR, are service operators allowed to record all clicks of logged in users?

Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either: The user consents to having ...
0
votes
1answer
63 views

Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
-1
votes
2answers
69 views

GDPR no opt out option

Is it legal if we do not offer an explicit opt-out option in our app for non-persnonal data collection? We planned to explain to the user what data we collect and at the bottom of the screen there ...
2
votes
2answers
84 views

Do default Apache logs violate the GDPR?

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
6
votes
4answers
189 views

Do internal annotations on user accounts fall under the GDPR?

In a platform such as Stack Exchange or any other moderated forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may ...
7
votes
1answer
1k views

Are internet forum posts considered personal data under GDPR?

GDPR defines "personal data" as any information relating to an identified or identifiable natural person. ‘personal data’ means any information relating to an identified or identifiable natural ...
2
votes
3answers
114 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
0
votes
2answers
50 views

GDPR - Company employee [closed]

I believe to know that an employee at a company that I'm customer at, I believe has accessed my customer profile and gotten personal information, such as my full name, ID number and address. I know ...
0
votes
1answer
36 views

GDPR: legal to combine (clickstreams) tracking and survey?

I am working on a website that collects clickstream data using Google Analytics. There is also a opti-layer. In the near future a survey to ask in which industry a visitor works shall be integrated, ...
2
votes
1answer
44 views

Legal sending personal information to a third party if the user supplied incorrect contact information?

To clarify the title, here is an example: Alice wants to sign up to online store Nile.com Alice enters the email bob@mailprovider.com by accident Nile.com does not send a verification that Alice has ...
3
votes
1answer
70 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
0
votes
2answers
35 views

GDPR question about processing personal data for research purposes that yield aggregated results

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...
1
vote
1answer
67 views

Store browser width / screen size and browser type without user consent?

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design ...
3
votes
2answers
53 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
0
votes
2answers
74 views

Do I need permission to publish a FOI response in a blog post or open letter?

I recently submitted a FOI request to my local council, and had a response. Part of the response stated the following: You are free to use this information for your own use, including for non-...
4
votes
2answers
128 views

“no logs” website in eu - is it illegal?

As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
1
vote
1answer
76 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
3
votes
1answer
148 views

Just how different is the legal situation in Germany under GDPR compared to previously with respect to running a website?

A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national ...
29
votes
4answers
8k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
14
votes
4answers
6k views

GDPR - reCAPTCHA with user's consent?

This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data. I was reading briefly about ePrivacy regulations ...
0
votes
1answer
56 views

Locate me data obtained from european register

There is an entry on locatefamily.com that I know because it has certain details that were used on a European domain register in 2014. I an EU citizen living in the states. Does the GDPR apply to them ...
1
vote
1answer
27 views

Copy of ID card: blacken / hide fields that are not relevant (Switzerland)

In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht. In article there is written that ...
0
votes
2answers
81 views

Are Steam account IDs (and telemetry data associated with Steam IDs) deemed personal data?

A few friends and were having an argument on the following situation: People can sign up for Steam accounts for free, letting them purchase games and play games over their network. Users are able to ...
2
votes
1answer
58 views

Can liability for data disclosure be waived by T&Cs under GDPR?

I live in Ireland, an EU county subject to the GDPR. I see in a service T&Cs the line: "Despite our use of commercially reasonable efforts to protect your Personal Information from ...
4
votes
4answers
89 views

Is a Blood sample considered Personal Data under GDPR?

Just that simple question: Is a Blood sample considered Personal Data under GDPR?
0
votes
0answers
29 views

Single sign on via cookies and GDPR compliance?

Going to call my two sites "identity provider" and "WordPress site". Flow is: User logs in on identity provider User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token ...
0
votes
1answer
48 views

Emails from clients and GDPR

I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the ...
0
votes
2answers
47 views

GDPR: can we ask the building owner to share and/or destroy data about one's RFID activity?

this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways It seems most buildings store the activity of one's RFID key activity. ...
6
votes
2answers
460 views

Are GDPR-Walls legal?

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information. I see two possible legal problems: GDPR forbids coupling of ...
0
votes
4answers
111 views

Is it okay for letting agency to deny me viewing for not telling them my employer name and how long I had been in a profession?

Is it okay for a letting agency to ask me these questions ? What is the name of company I work for ? The property I am renting at the present is through agency or a landlord? How long I have been ...
0
votes
1answer
59 views

GDPR: Can I do anything that touches a system with live customer data if I have no instructions at all

I have just become aware of this particular Article 29, which has one good side: it is short. The processor and any person acting under the authority of the controller or of the processor, who has ...
1
vote
1answer
35 views

GDPR and collecting politician's social media posts

I am interested in collecting tweets and social media posts from politicians in the USA. Specifically from their political social media accounts. After reading this finextra article, I believe this ...
2
votes
2answers
60 views

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)?

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)? For example, on Stack Exchange, do the questions, answers, comments, messages and ...
1
vote
2answers
50 views

If we anonymize Google Analytics IPs do we still need to ask for Cookie consent? [duplicate]

Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent? If so ...
3
votes
3answers
82 views

GDPR: Is giving out customer name and implied existence of customership legal?

I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable. The purpose is to ...
3
votes
4answers
58 views

Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?

I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
4answers
108 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
1
vote
1answer
156 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
3
votes
1answer
71 views

Is it legal to have a opt-out of marketing emails checkbox under GDPR?

As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-...