Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

1
vote
2answers
98 views

Is GDPR really needed if my android app doesn't collect any personal data?

I have developed some Android applications, and they don't store any personal data, but they do some calculation about some input, for example the annual salary provided by user and return to him a ...
0
votes
2answers
85 views

GDPR - Do we need to give individual mixed personal data of 2 individuals? (Right of access)

Individual is asking for phone recording which contains personal information of that individual and our marketing person, it also contains our sales speech. Do we need to provide copy of phone ...
8
votes
1answer
550 views

Legal aspects of Firebase Crashlytics SDK

Let's say we have a mobile app, where every user is associated with app-generated unique user id (ex. 57d2ef8b391277001aad7784). Having the uuid itself that's not possible to identify a user. ...
1
vote
1answer
59 views

to be in photo and video, and right to ask for removal these data relying on GDPR

At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs. Now, I want my pictures to be erased, or any data, ...
1
vote
1answer
69 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
1
vote
1answer
71 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
1
vote
1answer
93 views

GDPR - Recording simple page views

We are currently using google analytics to track our site. The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the ...
1
vote
1answer
145 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
1
vote
1answer
261 views

Parent company GDPR compliance

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
0
votes
1answer
35 views

Emails from clients and GDPR

I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the ...
0
votes
1answer
175 views

Is it legal for me to use publicly accessible user data about a person on my website?

I run a wiki service and I was wondering if someone doxes an anonymous person in the from of a dump (pastebin, screenshots, recordings etc), can we keep that data or perhaps cite it? For instance if ...
0
votes
1answer
91 views

GDPR and a cell phone paid through work?

Company Contacts page From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B. For instance my private email is regulated by GDPR, but my work ...
4
votes
0answers
39 views

Is Google's privacy policy compliant with GDPR for the data processing agreement between a controller and a processor?

If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google ...
4
votes
0answers
59 views

Do I have to send one of those emails after updating my privacy policy for GDPR?

We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?...
3
votes
0answers
42 views

What happens to SARs recieved before the 25th May?

With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May. However, in ...
2
votes
0answers
50 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
2
votes
0answers
27 views

How to notify the use of cookies (Cookie Law Notice)

I have been investigating notifications about the use of cookies and a question has come up: Why 99.9% of websites do not report correctly about the use of cookies and nothing happens? With "...
2
votes
0answers
59 views

Ebay - GDPR - Legality of re-assigning Data Controllers?

This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016. According to Article 27 (...
2
votes
0answers
31 views

GDPR which practice is compliant?

I have seen many ways of requiring user acceptance of their data usage on the internet. Which are conforming? Keep in mind I am talking just about the consent acquiring mechanism. In order from the ...
2
votes
0answers
113 views

Just how different is the legal situation in Germany under GDPR compared to previously with respect to running a website?

A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national ...
2
votes
0answers
205 views

Explanations for GDPR if no personal data is collected?

I have a website that is a travel search engine and I am very concerned about GDPR. I am not interested in any private information from the users for marketing or such things. I just use Google ...
2
votes
0answers
71 views

Who is the data controller of users' data of a SaaS platform?

Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU. The B company uses the software to keep track of its customers, ...
2
votes
0answers
52 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
1
vote
0answers
42 views

Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?

It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
1
vote
0answers
53 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
1
vote
0answers
33 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
1
vote
0answers
36 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
1
vote
0answers
133 views

GDPR: How does Airbnb get away with their signup form?

We're looking at making our signup form GDPR friendly along with sending users more timely, personalised marketing and account update emails. Asking if a user wants to receive all these different ...
1
vote
0answers
46 views

Derogation for small companies in GDPR

Question What does Recital 13 in GDPR make exempt? refers to Article 30 on the technical definition on record keeping. But I am interested in another aspect of this sentence: To take account of ...
1
vote
0answers
57 views

Russian bank calling Russian citizen who is tourist in EU - GDPR issues

Let's say I'm Russian citizen (no dual citizenship) and on a tourist visa in the EU. I got a call on my roaming Russian mobile phone number from a Russian bank who tries to offer me a new product. I'm ...
1
vote
0answers
191 views

Offering GDPR privacy policy for voice mail?

Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
1
vote
0answers
160 views

Under GDPR Data Processing Officer's email address bounces - what to do?

In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts. So I had sent ...
1
vote
0answers
52 views

How does GDPR affect me if I am processing 3rd Party Data for My IOS App?

We are updating our app based on GDPR and as per GDPR, the user has Right to Access data anytime. In My IOS App we are using FitBit's Data after taking User Consent. Now my question is: When the ...
1
vote
0answers
73 views

GDPR and logging which user accessed which personal information

If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what ...
1
vote
0answers
140 views

Can a developer have access to live data within GDPR?

Segregation of Duties in IT I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
1
vote
0answers
438 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
1
vote
0answers
67 views

Are data processors allowed to locally store live customer information for testing GDPR

We develop software for another company and use their live data to test our applications locally before they go live. This means we keep live customer information on office computers. Will this be ...
0
votes
0answers
4 views

What data processing requires opt-in consent for an existing customer under GDPR?

I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where ...
0
votes
0answers
13 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
0
votes
0answers
29 views

How does GDPR apply for normal email communication?

I am a member in an association and in charge of membership management and general IT. We exchange information about the work of the association by email using private mailing lists the association ...
0
votes
0answers
12 views

Do you have to provide information about processing personal data for contact persons?

Two companies write a legal agreement between themselves and contain contact details of their representatives in its content. Assuming that these contact details are personal data, are these companies ...
0
votes
0answers
24 views

Cause of action for data processor where the data controller neglects to notify supervisory authority

By reading the GDPR I have gathered that a data processor is obligated to notify the data controller of a breach within 72 hours and the data controller is likewise obligated to notify the supervisory ...
0
votes
0answers
29 views

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer ? Is above fundamental right's affected by Clauses in temporary employment contract like '...
0
votes
0answers
21 views

Changes to the privacy policy that require the user's consent: GDPR compliance

Suppose you have an online service, with a privacy policy that the users have accepted. Then at some point you want to introduce some changes to that privacy policy, in a way that requires the user's ...
0
votes
0answers
23 views

How do platform sites ensure their users do not abuse forwarded user data?

I am asking this question based upon the specific case of open source software sites, but the concept should probably apply equally to other websites that serve as a "platform" for their users to ...
0
votes
0answers
26 views

Do I need to do anything to add people to Facebook Group?

I would like to be able to share information with people. I consider 2 options: 1 share it with email; it requires to collect emails and store it in my company (which needs to be GDPR compliant ...