Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

69 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
1 answer
135 views

GDPR issues with Google sharing suspected child abuse images with law enforcement

I recently read of a man who had a Google account. His son's doctor asked for photos of a medical issue his son was having around his groin area, so his wife used his phone to take some. Google ...
user's user avatar
  • 1,876
3 votes
0 answers
57 views

Does consenting the usage of tracking Cookies also cover tracking Pixels under GDPR?

Last December Stack Overflow announced a change to the network advertisement policies. “Retargeting pixels are not allowed on any campaign. allowed for a limited number of vetted and pre-approved ...
SPArcheon's user avatar
  • 249
3 votes
0 answers
79 views

When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?

When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately? There exists an argument ...
GolDDranks's user avatar
3 votes
0 answers
77 views

Are apps required to notify users when they update their privacy policy or EULA?

I have noticed that many companies are doing this but definitely not all. Furthermore, what about cases where companies or developers cannot notify users because some users are not logged-in or ...
Matt's user avatar
  • 151
3 votes
0 answers
184 views

GDPR compliance for software that lets users store PII of other people

Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential ...
Oli's user avatar
  • 131
2 votes
2 answers
125 views

Is it legal/appropriate to email a GDPR SAR to the executive team if that is the only email address the company provides?

This is prompted by this question but I am fairly sure I do not have the correct answer so I am making this one. My personal answer to "How do I get my data from company X under GDPR" is to ...
User65535's user avatar
  • 6,536
2 votes
0 answers
45 views

Search engine data breaches, osint

Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
J.G.'s user avatar
  • 43
2 votes
0 answers
78 views

Is there anything to stop a subject access requester from being barred by a business?

A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
TylerDurden's user avatar
2 votes
1 answer
189 views

What exactly triggers the GDPR Article 14?

Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject: Art. 14 ...
User65535's user avatar
  • 6,536
2 votes
0 answers
62 views

GDPR data deletion: can I ask the company to delete the data it had exported in the United States?

I am located in Italy. I have subscribed to a service and provided some PII that "could be exported in the United States". If I send a GDPR request to delete my data, can I ask them to also ...
robertspierre's user avatar
2 votes
0 answers
54 views

GDPR data deletion: do I have a right to have the company specify which data it retained and why?

I requested the DPO of a company to delete all my data under GDPR. After a step of "account ownership" verification, it replied that: XXXX has deleted all of your personal data except where ...
robertspierre's user avatar
2 votes
0 answers
61 views

Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?

From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
J. Doe's user avatar
  • 457
2 votes
0 answers
333 views

Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?

It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
Nostradamus's user avatar
2 votes
0 answers
269 views

How to notify the use of cookies (Cookie Law Notice)

I have been investigating notifications about the use of cookies and a question has come up: Why 99.9% of websites do not report correctly about the use of cookies and nothing happens? With "...
Brahim Khallota's user avatar
2 votes
0 answers
166 views

Ebay - GDPR - Legality of re-assigning Data Controllers?

This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016. According to Article 27 (...
John Smith Optional's user avatar
2 votes
0 answers
370 views

Explanations for GDPR if no personal data is collected?

I have a website that is a travel search engine and I am very concerned about GDPR. I am not interested in any private information from the users for marketing or such things. I just use Google ...
J0ANMM's user avatar
  • 121
2 votes
0 answers
44 views

What happens to SARs recieved before the 25th May?

With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May. However, in ...
Bilkokuya's user avatar
  • 234
2 votes
0 answers
117 views

GDPR and logging which user accessed which personal information

If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what ...
Masza's user avatar
  • 121
2 votes
0 answers
207 views

Who is the data controller of users' data of a SaaS platform?

Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU. The B company uses the software to keep track of its customers, ...
Arne Evertsson's user avatar
2 votes
0 answers
69 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
Mr Cholmondley Warner's user avatar
1 vote
0 answers
33 views

Multi Domain Cookies Consent —Special Category Data

Can cross domain cookie consent be applied to government websites which collect special category data? Or is there any legal\policy guidance covering the use of multi domain cookies consent for the EU?...
NiallL's user avatar
  • 11
1 vote
0 answers
91 views

Does the GDPR/data protection act contain any anti-reprisal provisions?

The Information Commissioner's Office ICO advisers state that one “shouldn't” be treated any directly or less favourably as a result of exercising one’s rights under the legislation. What legal ...
TylerDurden's user avatar
1 vote
0 answers
68 views

What information can insurance companies share with brokers?

I'm currently in the process of buying my first home, and have a mortgage broker helping me through the process. Our broker found us life insurance (to cover the cost of the mortgage) through a large ...
Chelsie Wright's user avatar
1 vote
0 answers
64 views

Receive written confirmation about non-breached data

Context: I am working for an institution which has recently suffered a data breach. There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
Vassilis Markos's user avatar
1 vote
0 answers
52 views

What are the limits to what the information commissioner can take action upon?

It is in the news that a doctor inappropriately accessed and distributed a patients medical records. They did this through their employer, Cambridge University Hospitals (CUH) at Addenbrookes. The ...
User65535's user avatar
  • 6,536
1 vote
0 answers
44 views

Data representatives in EU, UK, Switzerland - are there more countries requiring this?

The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
UweD's user avatar
  • 1,382
1 vote
0 answers
177 views

Mendeley is encrypting my data on my hard disk with a key only available to them: can I ask for unencrypted data under GDPR?

I use Mendeley Desktop to manage my bibliography. Now I want to switch to Zotero. Zotero used to be able to import the Mandeley's database. However, Mendeley 1.19 encrypted my data on my HDD with a ...
robertspierre's user avatar
1 vote
0 answers
486 views

Twitter has no "delete account" button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement

I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that. But Twitter has no "delete account" button. There is only a "...
robertspierre's user avatar
1 vote
0 answers
52 views

University diploma / various certificates under GDPR

Background: I'm considering building a web (focused to Europe) which, for one of it's part, would require users to upload their university diplomas and/or other similar certificates of achieved ...
Marek Schwarz's user avatar
1 vote
0 answers
95 views

Facebook vs GDPR - Is Facebook never deleting the Searches you do?

I frequently delete the Search History from my account's Activity Log. However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past. Suggestions ...
Nuno's user avatar
  • 1,033
1 vote
0 answers
416 views

Corporate responsibility when allowing biometric authentication

At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for ...
Grooke's user avatar
  • 111
1 vote
0 answers
50 views

Is Apple's default Privacy settings GDPR compliant?

I recently realized that some apps were able to "link" my identity to Facebook. I checked my off facebook activity and could see some apps that I've never given my email. Investigating ...
gingerlime's user avatar
1 vote
0 answers
33 views

Company acquired a website with existing users. Is GDPR announcement obligatory?

When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
Kate's user avatar
  • 11
1 vote
0 answers
72 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
user27419's user avatar
1 vote
0 answers
147 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
howtopythonpls's user avatar
1 vote
0 answers
84 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
Rick Jelier's user avatar
1 vote
0 answers
60 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
SSSS's user avatar
  • 11
1 vote
0 answers
62 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
zzmaster's user avatar
  • 111
1 vote
0 answers
252 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
startupsmith's user avatar
1 vote
0 answers
541 views

Offering GDPR privacy policy for voice mail?

Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
unor's user avatar
  • 1,156
1 vote
0 answers
190 views

Under GDPR Data Processing Officer's email address bounces - what to do?

In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts. So I had sent ...
Grzegorz Oledzki's user avatar
1 vote
0 answers
362 views

Can a developer have access to live data within GDPR?

Segregation of Duties in IT I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
Per Digre's user avatar
  • 354
1 vote
0 answers
740 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
CaterinaG's user avatar
1 vote
1 answer
118 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
user103220's user avatar
1 vote
1 answer
68 views

to be in photo and video, and right to ask for removal these data relying on GDPR

At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs. Now, I want my pictures to be erased, or any data, ...
user avatar
0 votes
0 answers
36 views

Is a third party which solicits and accepts personal data from a customer on another’s behalf a processor or a controller?

Alice contracts with ACME insurance which sends her to their identity verification solution provider’s app/website (BCME KYC SOLUTIONS Inc). BCME’s portal asks Alice for photos of herself and other ...
TylerDurden's user avatar
0 votes
0 answers
63 views

Is amateur/hobbyist journalism/photography a purely household purpose?

Alice takes photos of people in public and puts them into a portfolio binder for grading by her photography class instructor but does not publish them. Barbara takes photos on her nights out and ...
TylerDurden's user avatar
0 votes
0 answers
67 views

how long might the regulatory action against Meta’s GDPR flouting take to play out?

Meta Inc is known to flout subject access request under the GDPR and numerous complaints have been lodged. What is the timeframe for these processes to play out? How does Facebook justify non-...
TylerDurden's user avatar
0 votes
0 answers
647 views

GDPR implications of email sent to a misconfigured host

I sent an email to a website's contact and my mailserver received this error: <...@...>: host ....mail.protection.outlook.com[104.47.70.110] said: 451 4.4.4 Mail received as unauthenticated, ...
Nemo's user avatar
  • 103
0 votes
0 answers
47 views

MDR - Is an app that supports physiotherapy patients in doing their exercises regularly a medical device according to the MDR?

With the introduction of the medical device regulation (MDR), there is a lot of ambiguity about which risk-class specific software is. And developing a medical device is linked to a lot of work and ...
TjardL's user avatar
  • 43