Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
6
votes
3answers
424 views

Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?

The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data: by a natural person in the course of a ...
12
votes
4answers
611 views

What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
3
votes
3answers
141 views

According to GDPR, do I need a contract for processing on behalf with my e-mail provider?

It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster. Now, I am wondering whether the same is true for the e-...
9
votes
2answers
5k views

How to satisfy GDPR's consent requirement for IP logging?

Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
5
votes
1answer
225 views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
5
votes
1answer
652 views

GDPR Compliance: Do all Cookies require Opt-In?

Given a Web Site which uses cookies for the following: User Preferences Bookmarked Articles Cookie Preferences what explicit permissions would be required from the user? Here I anticipate the ...
4
votes
2answers
215 views

“Right of access by the data subject” if the IP address is the only personal data

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
2
votes
4answers
171 views

GDPR - Is consent really necessary for contact form?

I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer. The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
32
votes
2answers
5k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
10
votes
1answer
853 views

Do cookie banners need to change for GDPR compliance?

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
9
votes
2answers
2k views

Would GDPR affect my own personal website?

I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public. As I am the only person who is in charge (my personal site), would I have to oblige to ...
7
votes
2answers
2k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
6
votes
2answers
460 views

Are GDPR-Walls legal?

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information. I see two possible legal problems: GDPR forbids coupling of ...
1
vote
1answer
295 views

GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?

I'm wondering if anyone can shed any light on this for me please. I've been doing alot of research about GDPR lately and how it is going to effect my websites using Google Analytics. From what I can ...
7
votes
4answers
1k views

GDPR: are faces always considered identifiable information?

Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
7
votes
1answer
124 views

Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?

I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation. Anyway, if I ...
5
votes
3answers
636 views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
3
votes
2answers
409 views

Does keeping an MD5 hash of user data violate GDPR?

If a user requests to have their data deleted, would we still be permitted to keep hashes of user data for later use, even after the original data has been deleted?
2
votes
1answer
182 views

GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?

I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service. ...
0
votes
1answer
178 views

Opt Out Consent under GDPR

I am having an Android App which uses certain service such as Analytics, Ad Networks. I am taking the consent from the user at when the app starts, i.e. before collecting any info. But there are ...
5
votes
1answer
162 views

GDPR - am I a data controller as an app owner if I do not have access to the data?

Let's assume that I created a mobile app for iPhone that is tracking rides on a bike so that means the app is collecting GPS coordinates of the phone and later this mobile app shows some statistics ...
4
votes
1answer
886 views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
4
votes
1answer
514 views

Are hobby projects exempt from GDPR?

Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database. GDPR ...
10
votes
2answers
2k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
5
votes
2answers
176 views

Excluding all people from the EU from my blog - is this allowed?

There's a new law from the European Union I simply cannot comply with (GDPR). Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my ...
5
votes
5answers
147 views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
4
votes
1answer
148 views

GDPR Right to erasure vs mailing list archive?

Consider a mailing list like mailman or listserv. The archives of these mailing lists, due to quoting, will contain names and email addresses. Now, the GDP Article 17, unless I am mistaken obliges ...
3
votes
1answer
501 views

User consent required under GDPR

I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user. For this reason I have drafted a ...
3
votes
2answers
253 views

Do web applications as hobby projects need to comply with the GDPR?

I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation. 2) This Regulation does ...
3
votes
2answers
117 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
2
votes
1answer
3k views

Under the GDPR, should transaction data be deleted on account deletion or on user request?

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted? Or if the user can buy ...
9
votes
3answers
648 views

GDPR - Withdrawn user consent

I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent. The user gives his consent to use his data and ...
7
votes
1answer
141 views

Deducing and using an email address under GDPR

I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this. The work email ...
7
votes
1answer
74 views

Is it sufficient to provide a privacy policy only in english language?

Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language? Is a translation necessary for every country of the EU ...
5
votes
1answer
91 views

Do marketing emails require consent?

I am getting spammed with marketing emails from Tough Mudder. Their unsubscribe link takes me to a page where I have to either accept the fact they will send me emails or unsubscribe from everything, ...
5
votes
1answer
246 views

Contract necessary for the most basic processing under GPDR?

I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or ...
4
votes
1answer
1k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
4
votes
1answer
64 views

Can online business in one country deny access via terms of service to entities in another country?

Can an American company state in their terms of service that if an entity is from a designated country they are not allowed to use the service? In other words would that be a legal and enforceable ...
4
votes
2answers
334 views

Are server-logs reckoned as storing of personal data by website (GDPR)?

Well, almost all website have IP logs in "/home/logs/" folder. It is not stored by my website, but by hosting's Apache web-server (or like that). Should I state that in our privacy policy?
3
votes
2answers
106 views

anonymisation/redaction of public website content as response to 'right to erasure'

An organisation runs some public email lists. These are archived, and the archives are also publically available from its website. A user of the mailing list asserts their "right to be forgotten" and ...
3
votes
1answer
552 views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
3
votes
1answer
259 views

What does 'Right to Erasure' actually cover?

According to GDPR, any person has 'Right to Erasure (Recital)' and have his/hers sensitive information deleted. Does that mean that an organization can keep all non-sensitive data for a user? For an ...
3
votes
1answer
115 views

Was my GDPR request not complied with?

On the 12th of December I made a GDPR request to a major online retailer in the UK. While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
3
votes
3answers
107 views

Android Application: Is purchaseToken defined under GDPR as PII?

In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using this API ) and saving purchaseToken on our server to validate his license. ...
2
votes
2answers
282 views

GDPR privacy policy - Data controller vs Data processor

I'm wondering if someone can shed some light on this for me please and help distinguish the differences between what I need to mention In my privacy policy for a data controller and data processor. ...
2
votes
3answers
114 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
2
votes
1answer
67 views

GDPR and online forms: how to prove that the data owner opted in?

How can the data processor who collect personal information using an online form prove that the person who entered her data gave active consent, for instance by clicking a checkmark? Imagine a a ...
2
votes
1answer
93 views

Using GDPR against cold-call marketing emails

I recently received a "cold-call" email from a salesman to my professional email address, which is in the form firstname.lastname@company.com. The firstname is a very formal version unlikely to be ...
2
votes
1answer
100 views

Under GDPR, is an image of a person's face a “Special Category Data”?

I'm triyng to understand whether, under European GDPR, an image of a person's face is a "Special Category Data". From this image I could determine person's: ethnic origin (for example: from the ...
2
votes
2answers
160 views

Can I force a website/service to delete my private data

I would like to wipe my online data clean and make sure the people deleted my account. Considering that most services only offer to "close" or "suspend" the account and not delete the data like skype ...