We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0
votes
2answers
45 views

Is anonymous analytics data subject to GDPR?

I am reading the definition of "personal data" here https://gdpr-info.eu/issues/personal-data/. My understanding is that GDPR comes into play when information is about personal data. Let's say there ...
0
votes
1answer
27 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
1
vote
1answer
43 views

User-solicited personal information beyond consent

What does the GDPR say about personal information provided by a user of a service about themselves, in the case that the service sign-up process and ToS have always asked of the users not to provide ...
1
vote
0answers
40 views

GDPR in a scientific, transborder scenario

Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole ...
10
votes
3answers
3k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
0
votes
2answers
45 views

GDPR compliance in ads SDK for iOS/Android

I have opened this question in SO, but was suggested to ask here, as the solution might come from a lawyer, rather than developer. I work on a native ads SDK for iOS/Android (banner, interstitial, ...
0
votes
1answer
80 views

Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
2
votes
4answers
203 views

How often does a website have to ask for cookie consent?

I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or ...
0
votes
1answer
52 views

GDPR - We're a global company and are expanding to Europe, do we need to save data there?

We're a global company and are expanding to Europe. We have users log in to our service and then they can use it. If a user is from the EU, do we have to store all of their personal information ...
3
votes
2answers
94 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
1
vote
1answer
70 views

Can the GDPR be used to ask free race photographs?

A lot of time pictures of participants are taken during a sports event. These are often sold afterwards for e.g. 10 euro each. Some people just share the watermarked image on social media. But my ...
4
votes
2answers
226 views

Are Blizzard breaking GDPR by charging people for changing their usernames?

I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago. I now want to change it again because searching it on Google ...
2
votes
2answers
96 views

What an employer can legally ask to monitor about user activity

I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's ...
3
votes
1answer
180 views

Is it legal for Blizzard to demand a copy of my government id before deleting my account?

I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so. I've seen a somewhat related question about Twitter at How can I get Twitter to delete my ...
3
votes
1answer
96 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
1
vote
1answer
75 views

How can I get Twitter to delete my account?

I want to delete my old (7 years unused, never logged in) Twitter account. I lost the email to it, but it has my name so I would like to delete it. I wrote Twitter support twice and told them "This is ...
0
votes
0answers
42 views

Does USA have a law similar to GDPR that gives you the right to a copy of the information a religious organization has on you?

For some background: the EU "Data Protection Directive" is a European Union directive which regulates the processing of personal data within the European Union, as explained in this Wikipedia article. ...
0
votes
1answer
46 views

GDPR on Proxy Users

I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc... My questions here are about the scope of GDPR. Does GDPR apply to people who: ...
0
votes
0answers
43 views

Question Regarding GDPR

I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
15
votes
1answer
2k views

Can Slack really claim not to be a data controller?

I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response: Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
0
votes
0answers
13 views

Are previous communiication preferences retained with form submissions?

I'm trying to understand the correct procedure when dealing with storing a users email subscription types, and the behaviour in relation to legitimate interest and consent to communicate. And the ...
1
vote
4answers
151 views

Is it okay for letting agency to deny me viewing for not telling them my employer name and how long I had been in a profession?

Is it okay for a letting agency to ask me these questions ? What is the name of company I work for ? The property I am renting at the present is through agency or a landlord? How long I have been ...
0
votes
0answers
13 views

Complying with GDPR when storing emails and IPs for a refferal campaign

I want to start an email referral campaign to collect emails for the upcoming launch of a videogame and was warned that I need to comply with the GDPR rules of privacy. I'll be storing the email ...
6
votes
1answer
386 views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
2
votes
2answers
218 views

Company retained my card details after payment completed and suffered a breach. What are my options?

A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications. After the breach, when the company was ...
0
votes
2answers
90 views

Emails from clients and GDPR

I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the ...
1
vote
1answer
68 views

does the GDPR apply to publicly available data?

There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little ...
3
votes
1answer
26 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
2
votes
2answers
67 views

When is pseudonymization insufficient in terms of GDPR compliance when storing and processing data for research purposes?

I am working on a project where data needs to be stored and kept for further processing. It's primarily for research purposes. I know that in order to be GDPR compliant, this data has to be anonymized....
2
votes
1answer
100 views

Under GDPR EU law, can I sue big tech companies (Facebook, Google, Apple) for acquiring and storing my personal data without my consent?

Many of my friends have social media accounts (Instagram, Facebook, etc.) where they regularly post photos of them and where occasionally I appear in them. Many of my friends have their personal ...
1
vote
1answer
179 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
3
votes
2answers
67 views

Site does not provide the option to disallow cookies in a notification

Is this a typical behavior for websites to provide only one option, and doing so, forces the user clicking "accept"? Isn't it so that they must provide both, accept and reject?
1
vote
1answer
137 views

What can i do if my GDPR requests are being ignored?

I have requested my personal data removal from one shady company that has gotten to my email somehow. They said they've complied, but i am still getting newsletters from them. What can i do as a ...
1
vote
2answers
75 views

Does creating an account or making a purchase apply consent for all marketing communications?

Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent. For example, I created an account using my email and hired a bike from ...
2
votes
1answer
44 views

Data processing locations post-Brexit

I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients. I have several UK-based clients, all ...
1
vote
1answer
44 views

Is sending log data + customer name + location compatible with data privacy and GDPR?

I've written an updater program. Our customer downloads it to update our software with database. It would be helpful if we would know who has already updated our software. For this purpose I've added ...
2
votes
2answers
67 views

Under GDPR, Is a Hashed URL Enough to Protect Customer Data?

Does a hashed URL (sent via email) provide enough security to safeguard customer data? For example, if we publish our customer data online with a hashed URL that we send to the customer (in other ...
3
votes
1answer
49 views

Data deletion requirements

I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it. I never ...
1
vote
0answers
33 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
1
vote
1answer
196 views

Is it legal for me to use publicly accessible user data about a person on my website?

I run a wiki service and I was wondering if someone doxes an anonymous person in the from of a dump (pastebin, screenshots, recordings etc), can we keep that data or perhaps cite it? For instance if ...
4
votes
1answer
103 views

Under GDPR can I avoid divulging a customer's data to the government?

Scenario: A business has a legal requirement to obtain a license from a government agency relating to its business activities. The business activities have already being undertaken and there is no ...
17
votes
4answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
1
vote
1answer
119 views

Can I sue a company for testing Captcha when unsubscribing from email?

With all the data protection stuff these days I was wondering if it is possible to sue a company for making a user pass a CAPTCHA test when unsubscribing from email. I don't know the law surrounding ...
2
votes
1answer
37 views

Does GDPR affect personal projects with family data?

My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a ...
-2
votes
1answer
68 views

Is a GDPR flashmob legal?

If users decide to run a viral laege scale flashmob to get their data in terms of GDPR from a company, is this procedure legal? Like, competing who manages to make a request to inform about their ...
3
votes
1answer
85 views

A user has supplied personal information in an anonymous form. What is this information's status under GDPR?

I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form. If a user includes personal information (e.g. their ...
2
votes
0answers
54 views

Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?

From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
1
vote
1answer
62 views

Do I violate GDRP if install WhatsApp as a private user?

As far as I can understand, if I install WhatsApp, the app sends my contact list to the server. Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
1
vote
1answer
57 views

Cookie expiration time per GDPR guidelines

I am working on a task that requires to set cookie expiry date to Jan 2038. This cookie is used for showing personalized content to end user e.g. If user is on Home page and he clicks on Business ...
0
votes
4answers
154 views

Data Protection Laws

Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/...