Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
116
questions
15
votes
3
answers
12k
views
Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers
I asked this question to Facebook:
I would like to know how can I permanently delete private messages
from both sides of the conversation. For example, conversations I had
in the past with ...
- 993
14
votes
4
answers
1k
views
What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?
My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
- 242
8
votes
1
answer
3k
views
GDPR Compliance: Do all Cookies require Opt-In?
Given a Web Site which uses cookies for the following:
User Preferences
Bookmarked Articles
Cookie Preferences
what explicit permissions would be required from the user?
Here I anticipate the ...
- 213
7
votes
4
answers
1k
views
Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?
The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data:
by a natural person in the course of a ...
- 3,172
26
votes
2
answers
25k
views
How to satisfy GDPR's consent requirement for IP logging?
Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
- 363
9
votes
1
answer
286
views
As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?
The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
- 3,833
9
votes
2
answers
2k
views
Is it really possible to use Google Analytics without consent, and if so, why exactly?
I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
- 1,818
5
votes
2
answers
2k
views
GitHub pages and GDPR - controller, processor and DPA
I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain.
The only potentially personal data that the site will ...
- 205
4
votes
1
answer
173
views
Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever
I have a small static personal website, where I publish some technical articles and my personal CV.
Do I need to include a privacy-policy if:
There are no (third- or first party) tracking services ...
- 43
9
votes
2
answers
816
views
Are GDPR-Walls legal?
Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information.
I see two possible legal problems:
GDPR forbids coupling of ...
- 190
6
votes
4
answers
3k
views
GDPR - Is consent really necessary for contact form?
I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer.
The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
- 163
5
votes
2
answers
746
views
"Right of access by the data subject" if the IP address is the only personal data
IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
- 1,136
5
votes
1
answer
229
views
In which jurisdictions outside the EU can the GDPR be enforced?
The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens.
Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
- 1,682
2
votes
2
answers
1k
views
GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?
I'm wondering if anyone can shed any light on this for me please. I've been doing alot of research about GDPR lately and how it is going to effect my websites using Google Analytics.
From what I can ...
- 175
1
vote
1
answer
1k
views
Who needs to implement Cookie Consent for embedded content?
Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <iframe>...
-1
votes
1
answer
652
views
Google AdWords banned my account. Can I request complete deletion under GDPR?
GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on ...
- 121
41
votes
2
answers
8k
views
GDPR + git history
Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required?
Git is a ...
- 511
15
votes
2
answers
5k
views
Would GDPR affect my own personal website?
I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public.
As I am the only person who is in charge (my personal site), would I have to oblige to ...
- 271
11
votes
4
answers
1k
views
Do cookie banners need to change for GDPR compliance?
Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
11
votes
2
answers
7k
views
Is hash of a username still personal data?
I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
- 113
7
votes
3
answers
274
views
Is it illegal to intentionally design a social network that can't comply with right-to-be-forgotten (and possibly other laws)?
If I intentionally design (and program) a social network that uses a technology (blockchain,...) which does not allow for alteration / erasing of user data, what happens in case of a right-to-be-...
- 171
7
votes
4
answers
4k
views
GDPR: are faces always considered identifiable information?
Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
- 125
5
votes
3
answers
1k
views
Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?
Background
Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
- 315
4
votes
1
answer
243
views
Was my GDPR request not complied with?
On the 12th of December I made a GDPR request to a major online retailer in the UK.
While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
4
votes
2
answers
2k
views
Storing IP's and GDPR Compliance
Suppose a web designer plans to store hashed IP's in a database for analytical purposes of tracking unique clicks, and for security purposes to prevent botting unique clicks. Suppose the site only ...
- 53
4
votes
1
answer
790
views
User consent required under GDPR
I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user.
For this reason I have drafted a ...
- 203
3
votes
1
answer
355
views
GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?
I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service.
...
- 83
3
votes
1
answer
276
views
GDPR and Storing Non-EU Citizen Data as an EU-based company
I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
- 133
3
votes
2
answers
743
views
Do web applications as hobby projects need to comply with the GDPR?
I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation.
2) This Regulation does ...
- 399
3
votes
2
answers
200
views
What consequences are there to ignoring GDPR rules as a non-EU entity?
If a non-EU entity ignores the GDPR rules, including not paying any fines they receive from not following them, what consequences are they subject to? Can a company simply decide to ignore GDPR rules ...
- 701
3
votes
3
answers
760
views
According to GDPR, do I need a contract for processing on behalf with my e-mail provider?
It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster.
Now, I am wondering whether the same is true for the e-...
- 374
1
vote
1
answer
99
views
How far up the chain of internet provision does my GDPR responsibility go?
Say I host a web page on my computer, and you visit that site from somewhere in Europe. The web server on my computer will know your IP address, and I can choose to "forget" it as soon as ...
- 867
1
vote
1
answer
73
views
Incomplete/unserviceable SAR submissions and deletion timeframes
Bob was party to an incident in a shop that keeps CCTV footage for 30 days. 28 days later he submits a request for this responsive footage, but neglects to include with it adequate selfidentification ...
1
vote
0
answers
424
views
Twitter has no "delete account" button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement
I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that.
But Twitter has no "delete account" button. There is only a "...
- 1,596
0
votes
1
answer
263
views
Opt Out Consent under GDPR
I am having an Android App which uses certain service such as Analytics, Ad Networks.
I am taking the consent from the user at when the app starts, i.e. before collecting any info.
But there are ...
- 203
0
votes
1
answer
135
views
What's the rationale for "joint controller" instead of keeping every entity doing stricly separate?
After reading Case C-40/17 and Case C-210/16 I still cannot figure out why GDPR would require "joint controller" decision.
Wouldn't it be much simpler to decide that e.g. in "Fashion ID&...
58
votes
4
answers
20k
views
Does GDPR include UK customers, or not anymore?
Now that Brexit happened, does GDPR include UK customers, or not anymore?
- 993
49
votes
2
answers
7k
views
Is requesting waiving the right to deletion of contributions against GDPR?
I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage:
(For GitLab ...
- 533
30
votes
2
answers
5k
views
Accessing public CCTV footage about you
Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
- 439
21
votes
2
answers
4k
views
Are global user account systems now illegal following the EU's May 2023 fine of Meta?
The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta
Like any website, we have an account system where people log in to access their ...
- 313
21
votes
2
answers
28k
views
Do the GDPR and Cookie-Law regulations apply to localStorage?
We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
- 313
15
votes
3
answers
3k
views
GDPR & Blocking EU Visitors?
I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
- 205
14
votes
3
answers
2k
views
Why can't I add a governing law to my terms of service to avoid GDPR?
I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
- 141
13
votes
2
answers
3k
views
Why does the GDPR matter to me, a US citizen with no property in Europe?
I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
- 12k
12
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 1,481
11
votes
4
answers
4k
views
Is there a way to determine if an email address is personal information?
The GDPR defines personal data as:
Personal data is information that relates to an identified or identifiable individual.
My understanding is that this means that firstname.lastname@example.com is ...
- 4,135
9
votes
3
answers
814
views
GDPR - Withdrawn user consent
I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent.
The user gives his consent to use his data and ...
- 193
9
votes
2
answers
3k
views
GDPR. Where to store users consent?
A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
- 113
7
votes
1
answer
2k
views
Deducing and using an email address under GDPR
I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this.
The work email ...
7
votes
1
answer
185
views
Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?
I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation.
Anyway, if I ...
- 171