Skip to main content

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
16 votes
3 answers
15k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
Nuno's user avatar
  • 1,033
14 votes
4 answers
1k views

What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
Ben Collins's user avatar
8 votes
1 answer
3k views

GDPR Compliance: Do all Cookies require Opt-In?

Given a Web Site which uses cookies for the following: User Preferences Bookmarked Articles Cookie Preferences what explicit permissions would be required from the user? Here I anticipate the ...
Manngo's user avatar
  • 213
7 votes
4 answers
1k views

Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?

The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data: by a natural person in the course of a ...
Free Radical's user avatar
  • 3,212
27 votes
2 answers
29k views

How to satisfy GDPR's consent requirement for IP logging?

Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
Pistos's user avatar
  • 373
12 votes
3 answers
3k views

Why does the GDPR matter to me, a US citizen with no property in Europe?

I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
Someone's user avatar
  • 17k
10 votes
1 answer
447 views

As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?

The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
JonathanReez's user avatar
  • 4,563
8 votes
2 answers
3k views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
reed's user avatar
  • 1,838
6 votes
2 answers
2k views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
David's user avatar
  • 215
3 votes
1 answer
326 views

Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever

I have a small static personal website, where I publish some technical articles and my personal CV. Do I need to include a privacy-policy if: There are no (third- or first party) tracking services ...
danbreu's user avatar
  • 33
9 votes
2 answers
865 views

Are GDPR-Walls legal?

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information. I see two possible legal problems: GDPR forbids coupling of ...
allo's user avatar
  • 220
7 votes
3 answers
3k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
Gjermund B. Dahl's user avatar
6 votes
4 answers
4k views

GDPR - Is consent really necessary for contact form?

I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer. The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
Alen Šimunic's user avatar
5 votes
1 answer
273 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
Christopher King's user avatar
5 votes
2 answers
859 views

"Right of access by the data subject" if the IP address is the only personal data

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
unor's user avatar
  • 1,144
2 votes
1 answer
2k views

Who needs to implement Cookie Consent for embedded content?

Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <iframe>...
Mikko Rantalainen's user avatar
2 votes
2 answers
1k views

GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?

I'm wondering if anyone can shed any light on this for me please. I've been doing alot of research about GDPR lately and how it is going to effect my websites using Google Analytics. From what I can ...
Shaun's user avatar
  • 175
-1 votes
1 answer
742 views

Google AdWords banned my account. Can I request complete deletion under GDPR?

GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on ...
giorgio79's user avatar
  • 121
42 votes
2 answers
9k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
Oldrich Svec's user avatar
15 votes
2 answers
6k views

Would GDPR affect my own personal website?

I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public. As I am the only person who is in charge (my personal site), would I have to oblige to ...
iProgram's user avatar
  • 271
11 votes
4 answers
1k views

Do cookie banners need to change for GDPR compliance?

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
Matthew FitzGerald-Chamberlain's user avatar
11 votes
2 answers
7k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
lnl's user avatar
  • 213
7 votes
3 answers
297 views

Is it illegal to intentionally design a social network that can't comply with right-to-be-forgotten (and possibly other laws)?

If I intentionally design (and program) a social network that uses a technology (blockchain,...) which does not allow for alteration / erasing of user data, what happens in case of a right-to-be-...
user2486570's user avatar
7 votes
4 answers
5k views

GDPR: are faces always considered identifiable information?

Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
4Oh4's user avatar
  • 125
5 votes
3 answers
1k views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
Paul's user avatar
  • 325
4 votes
1 answer
823 views

User consent required under GDPR

I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user. For this reason I have drafted a ...
Rajesh K's user avatar
  • 203
4 votes
2 answers
917 views

Do web applications as hobby projects need to comply with the GDPR?

I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation. 2) This Regulation does ...
Steve Woods's user avatar
4 votes
1 answer
344 views

GDPR and Storing Non-EU Citizen Data as an EU-based company

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
tda's user avatar
  • 143
4 votes
1 answer
259 views

Was my GDPR request not complied with?

On the 12th of December I made a GDPR request to a major online retailer in the UK. While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
Michael Feldmeier's user avatar
3 votes
1 answer
391 views

GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?

I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service. ...
Sideshow Bob's user avatar
3 votes
3 answers
836 views

According to GDPR, do I need a contract for processing on behalf with my e-mail provider?

It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster. Now, I am wondering whether the same is true for the e-...
O. R. Mapper's user avatar
3 votes
2 answers
291 views

What consequences are there to ignoring GDPR rules as a non-EU entity?

If a non-EU entity ignores the GDPR rules, including not paying any fines they receive from not following them, what consequences are they subject to? Can a company simply decide to ignore GDPR rules ...
Nzall's user avatar
  • 1,385
3 votes
2 answers
3k views

Storing IP's and GDPR Compliance

Suppose a web designer plans to store hashed IP's in a database for analytical purposes of tracking unique clicks, and for security purposes to prevent botting unique clicks. Suppose the site only ...
bishbe's user avatar
  • 43
3 votes
3 answers
391 views

Does the GDPR apply to the data subject's computers?

In this answer to a GDPR question about processing conducted by an app on the user's computer I wrote: The GDPR only applies to data processed by you on your computer. Any processing that happens on ...
Paul Johnson's user avatar
  • 13.5k
1 vote
1 answer
111 views

How far up the chain of internet provision does my GDPR responsibility go?

Say I host a web page on my computer, and you visit that site from somewhere in Europe. The web server on my computer will know your IP address, and I can choose to "forget" it as soon as ...
Dave's user avatar
  • 827
1 vote
0 answers
496 views

Twitter has no "delete account" button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement

I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that. But Twitter has no "delete account" button. There is only a "...
robertspierre's user avatar
0 votes
1 answer
281 views

Opt Out Consent under GDPR

I am having an Android App which uses certain service such as Analytics, Ad Networks. I am taking the consent from the user at when the app starts, i.e. before collecting any info. But there are ...
Rajesh K's user avatar
  • 203
0 votes
1 answer
188 views

What's the rationale for "joint controller" instead of keeping every entity doing stricly separate?

After reading Case C-40/17 and Case C-210/16 I still cannot figure out why GDPR would require "joint controller" decision. Wouldn't it be much simpler to decide that e.g. in "Fashion ID&...
Mikko Rantalainen's user avatar
60 votes
4 answers
20k views

Does GDPR include UK customers, or not anymore?

Now that Brexit happened, does GDPR include UK customers, or not anymore?
Nuno's user avatar
  • 1,033
49 votes
2 answers
7k views

Is requesting waiving the right to deletion of contributions against GDPR?

I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage: (For GitLab ...
rubenvb's user avatar
  • 533
30 votes
2 answers
5k views

Accessing public CCTV footage about you

Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
dollar bill's user avatar
22 votes
2 answers
35k views

Do the GDPR and Cookie-Law regulations apply to localStorage?

We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
Andrea's user avatar
  • 323
20 votes
2 answers
4k views

Are global user account systems now illegal following the EU's May 2023 fine of Meta?

The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta Like any website, we have an account system where people log in to access their ...
Per's user avatar
  • 303
14 votes
3 answers
3k views

GDPR & Blocking EU Visitors?

I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
Charles's user avatar
  • 197
14 votes
5 answers
4k views

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

Service providers like Google and Facebook are pretty much part of people's lives. Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
user1034912's user avatar
  • 1,501
14 votes
3 answers
2k views

Why can't I add a governing law to my terms of service to avoid GDPR?

I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
Jim's user avatar
  • 141
11 votes
2 answers
4k views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
Oful's user avatar
  • 133
10 votes
4 answers
5k views

Is there a way to determine if an email address is personal information?

The GDPR defines personal data as: Personal data is information that relates to an identified or identifiable individual. My understanding is that this means that [email protected] is ...
User65535's user avatar
  • 6,868
9 votes
3 answers
848 views

GDPR - Withdrawn user consent

I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent. The user gives his consent to use his data and ...
jvecsei's user avatar
  • 193
8 votes
1 answer
2k views

Deducing and using an email address under GDPR

I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this. The work email ...
George Harris's user avatar