Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

0
votes
2answers
28 views

GDPR question about processing personal data for research purposes that yield aggregated results

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...
0
votes
1answer
52 views

Store browser width / screen size and browser type without user consent?

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design ...
3
votes
2answers
43 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
0
votes
2answers
71 views

Do I need permission to publish a FOI response in a blog post or open letter?

I recently submitted a FOI request to my local council, and had a response. Part of the response stated the following: You are free to use this information for your own use, including for non-...
4
votes
2answers
96 views

“no logs” website in eu - is it illegal?

As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
1
vote
1answer
76 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
3
votes
1answer
142 views

Just how different is the legal situation in Germany under GDPR compared to previously with respect to running a website?

A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national ...
0
votes
1answer
33 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
29
votes
4answers
8k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
14
votes
4answers
6k views

GDPR - reCAPTCHA with user's consent?

This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data. I was reading briefly about ePrivacy regulations ...
0
votes
1answer
54 views

Locate me data obtained from european register

There is an entry on locatefamily.com that I know because it has certain details that were used on a European domain register in 2014. I an EU citizen living in the states. Does the GDPR apply to them ...
1
vote
1answer
23 views

Copy of ID card: blacken / hide fields that are not relevant (Switzerland)

In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht. In article there is written that ...
0
votes
2answers
74 views

Are Steam account IDs (and telemetry data associated with Steam IDs) deemed personal data?

A few friends and were having an argument on the following situation: People can sign up for Steam accounts for free, letting them purchase games and play games over their network. Users are able to ...
2
votes
1answer
49 views

Can liability for data disclosure be waived by T&Cs under GDPR?

I live in Ireland, an EU county subject to the GDPR. I see in a service T&Cs the line: "Despite our use of commercially reasonable efforts to protect your Personal Information from ...
1
vote
3answers
103 views

How often does a website have to ask for cookie consent?

I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or ...
0
votes
1answer
46 views

Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
3
votes
4answers
80 views

Is a Blood sample considered Personal Data under GDPR?

Just that simple question: Is a Blood sample considered Personal Data under GDPR?
0
votes
0answers
27 views

Single sign on via cookies and GDPR compliance?

Going to call my two sites "identity provider" and "WordPress site". Flow is: User logs in on identity provider User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token ...
0
votes
1answer
47 views

Emails from clients and GDPR

I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the ...
0
votes
2answers
46 views

GDPR: can we ask the building owner to share and/or destroy data about one's RFID activity?

this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways It seems most buildings store the activity of one's RFID key activity. ...
0
votes
2answers
60 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
6
votes
2answers
451 views

Are GDPR-Walls legal?

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information. I see two possible legal problems: GDPR forbids coupling of ...
0
votes
4answers
104 views

Is it okay for letting agency to deny me viewing for not telling them my employer name and how long I had been in a profession?

Is it okay for a letting agency to ask me these questions ? What is the name of company I work for ? The property I am renting at the present is through agency or a landlord? How long I have been ...
0
votes
1answer
55 views

GDPR: Can I do anything that touches a system with live customer data if I have no instructions at all

I have just become aware of this particular Article 29, which has one good side: it is short. The processor and any person acting under the authority of the controller or of the processor, who has ...
1
vote
1answer
32 views

GDPR and collecting politician's social media posts

I am interested in collecting tweets and social media posts from politicians in the USA. Specifically from their political social media accounts. After reading this finextra article, I believe this ...
2
votes
2answers
54 views

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)?

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)? For example, on Stack Exchange, do the questions, answers, comments, messages and ...
1
vote
2answers
47 views

If we anonymize Google Analytics IPs do we still need to ask for Cookie consent? [duplicate]

Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent? If so ...
3
votes
3answers
79 views

GDPR: Is giving out customer name and implied existence of customership legal?

I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable. The purpose is to ...
3
votes
4answers
51 views

Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?

I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
4answers
104 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
1
vote
1answer
156 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
3
votes
1answer
69 views

Is it legal to have a opt-out of marketing emails checkbox under GDPR?

As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-...
1
vote
0answers
53 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
1
vote
1answer
24 views

What data processing requires opt-in consent for an existing customer under GDPR?

I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where ...
1
vote
1answer
37 views

Does the GDPR mandate that web sites provide access to cookie settings?

Cross referenced this question with SO just to get more technical perspective In this article it says with respect to: Google Analytics and GDPR consent to cookies and tracking: Based on a true ...
1
vote
2answers
48 views

Does CNNs cookie consent banner comply with the GDPR?

I just got done reading this cookie consent material and it says that we need to keep a record of cookie consent. It also says that the notification needs to allows users to opt in and out of ...
1
vote
1answer
84 views

Does data that is anonymized need to be collected in the event of a GDPR Subject Access Request?

Google Analytics anonymizes and aggregates all user data so it is not possible to look up an individual user. Does that mean that in the event that we use Google Analytics and receive a Subject ...
1
vote
1answer
61 views

to be in photo and video, and right to ask for removal these data relying on GDPR

At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs. Now, I want my pictures to be erased, or any data, ...
0
votes
2answers
52 views

GDPR: Transmitting results from secondary to primary care records

In the UK, results of a blood (or other) test taken at a hospital (in secondary care) are stored in the hospital's records but are not automatically forwarded into primary care records (GP records) ...
1
vote
1answer
20 views

Handling medical data received from outside the EU

If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU? In particular, does ...
1
vote
2answers
56 views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
0
votes
1answer
175 views

Is it legal for me to use publicly accessible user data about a person on my website?

I run a wiki service and I was wondering if someone doxes an anonymous person in the from of a dump (pastebin, screenshots, recordings etc), can we keep that data or perhaps cite it? For instance if ...
1
vote
1answer
16 views

GDPR and date of fields creation / update

Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields : client_id name first_name and that I want to be GPDR Complient does I ...
1
vote
2answers
99 views

Is GDPR really needed if my android app doesn't collect any personal data?

I have developed some Android applications, and they don't store any personal data, but they do some calculation about some input, for example the annual salary provided by user and return to him a ...
1
vote
2answers
132 views

GDPR: if a user doesn't agree cookies on my banner, what must I do?

if a guest of my site click on "Not agree" on cookie banner, what must I do? Have I to disable all the cookies? Have I to disable all the cookies except technical cookies (eg. login session cookies)? ...
0
votes
1answer
42 views

Modify a client file

After the setup of the GDPR law about personnal data security, I have a case I'm not sure about. Test case: I receive an addresses file from a client containing x lines of addresses with personnal ...
3
votes
1answer
59 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
2
votes
2answers
158 views

Can I force a website/service to delete my private data

I would like to wipe my online data clean and make sure the people deleted my account. Considering that most services only offer to "close" or "suspend" the account and not delete the data like skype ...
7
votes
1answer
564 views

Legal aspects of Firebase Crashlytics SDK

Let's say we have a mobile app, where every user is associated with app-generated unique user id (ex. 57d2ef8b391277001aad7784). Having the uuid itself that's not possible to identify a user. ...
2
votes
1answer
44 views

What is “a place where Member State law applies by virtue of public international law”?

Art. 3 (3) GDPR mentions that: This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of ...