Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
72
questions with no upvoted or accepted answers
4
votes
1
answer
136
views
GDPR issues with Google sharing suspected child abuse images with law enforcement
I recently read of a man who had a Google account. His son's doctor asked for photos of a medical issue his son was having around his groin area, so his wife used his phone to take some. Google ...
- 1,876
3
votes
0
answers
69
views
Does consenting the usage of tracking Cookies also cover tracking Pixels under GDPR?
Last December Stack Overflow announced a change to the network advertisement policies.
“Retargeting pixels are not allowed on any campaign. allowed for a limited number of vetted and pre-approved ...
- 249
3
votes
0
answers
80
views
When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?
When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately?
There exists an argument ...
- 131
3
votes
0
answers
48
views
Search engine data breaches, osint
Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
- 53
3
votes
0
answers
83
views
Are apps required to notify users when they update their privacy policy or EULA?
I have noticed that many companies are doing this but definitely not all.
Furthermore, what about cases where companies or developers cannot notify users because some users are not logged-in or ...
- 151
3
votes
0
answers
186
views
GDPR compliance for software that lets users store PII of other people
Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential ...
- 131
2
votes
2
answers
130
views
Is it legal/appropriate to email a GDPR SAR to the executive team if that is the only email address the company provides?
This is prompted by this question but I am fairly sure I do not have the correct answer so I am making this one.
My personal answer to "How do I get my data from company X under GDPR" is to ...
- 6,608
2
votes
0
answers
78
views
Is there anything to stop a subject access requester from being barred by a business?
A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
2
votes
1
answer
218
views
What exactly triggers the GDPR Article 14?
Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject:
Art. 14 ...
- 6,608
2
votes
0
answers
62
views
GDPR data deletion: can I ask the company to delete the data it had exported in the United States?
I am located in Italy.
I have subscribed to a service and provided some PII that "could be exported in the United States".
If I send a GDPR request to delete my data, can I ask them to also ...
- 1,606
2
votes
0
answers
54
views
GDPR data deletion: do I have a right to have the company specify which data it retained and why?
I requested the DPO of a company to delete all my data under GDPR.
After a step of "account ownership" verification, it replied that:
XXXX has deleted all of your personal data except where ...
- 1,606
2
votes
0
answers
61
views
Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?
From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
- 447
2
votes
0
answers
337
views
Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?
It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
- 205
2
votes
0
answers
270
views
How to notify the use of cookies (Cookie Law Notice)
I have been investigating notifications about the use of cookies and a question has come up:
Why 99.9% of websites do not report correctly about the use of cookies and nothing happens?
With "...
- 133
2
votes
0
answers
169
views
Ebay - GDPR - Legality of re-assigning Data Controllers?
This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016.
According to Article 27 (...
2
votes
0
answers
372
views
Explanations for GDPR if no personal data is collected?
I have a website that is a travel search engine and I am very concerned about GDPR.
I am not interested in any private information from the users for marketing or such things. I just use Google ...
- 121
2
votes
0
answers
44
views
What happens to SARs recieved before the 25th May?
With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May.
However, in ...
- 234
2
votes
0
answers
117
views
GDPR and logging which user accessed which personal information
If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what ...
- 121
2
votes
0
answers
217
views
Who is the data controller of users' data of a SaaS platform?
Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU.
The B company uses the software to keep track of its customers, ...
- 121
2
votes
0
answers
69
views
GDPR - Right of Access From Processor
If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller?
If ...
1
vote
0
answers
35
views
Does a Push Notification Service (Apple/Google) have to be mentioned in an DPA. Do i need a DPA with the Service Providers?
We are a Software Company that provides a Software (an IOS and Android Application) to our Customers. That Customer itself would be treated as an Data Controller and thus we are the Data Processor, ...
- 19
1
vote
0
answers
39
views
Multi Domain Cookies Consent —Special Category Data
Can cross domain cookie consent be applied to government websites which collect special category data?
Or is there any legal\policy guidance covering the use of multi domain cookies consent for the EU?...
- 11
1
vote
0
answers
94
views
Does the GDPR/data protection act contain any anti-reprisal provisions?
The Information Commissioner's Office ICO advisers state that one “shouldn't” be treated any directly or less favourably as a result of exercising one’s rights under the legislation. What legal ...
1
vote
0
answers
75
views
What information can insurance companies share with brokers?
I'm currently in the process of buying my first home, and have a mortgage broker helping me through the process. Our broker found us life insurance (to cover the cost of the mortgage) through a large ...
1
vote
0
answers
65
views
Receive written confirmation about non-breached data
Context:
I am working for an institution which has recently suffered a data breach.
There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
- 153
1
vote
0
answers
52
views
What are the limits to what the information commissioner can take action upon?
It is in the news that a doctor inappropriately accessed and distributed a patients medical records. They did this through their employer, Cambridge University Hospitals (CUH) at Addenbrookes. The ...
- 6,608
1
vote
0
answers
44
views
Data representatives in EU, UK, Switzerland - are there more countries requiring this?
The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
- 1,392
1
vote
0
answers
177
views
Mendeley is encrypting my data on my hard disk with a key only available to them: can I ask for unencrypted data under GDPR?
I use Mendeley Desktop to manage my bibliography. Now I want to switch to Zotero.
Zotero used to be able to import the Mandeley's database. However, Mendeley 1.19 encrypted my data on my HDD with a ...
- 1,606
1
vote
0
answers
490
views
Twitter has no "delete account" button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement
I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that.
But Twitter has no "delete account" button. There is only a "...
- 1,606
1
vote
0
answers
52
views
University diploma / various certificates under GDPR
Background: I'm considering building a web (focused to Europe) which, for one of it's part, would require users to upload their university diplomas and/or other similar certificates of achieved ...
- 111
1
vote
0
answers
95
views
Facebook vs GDPR - Is Facebook never deleting the Searches you do?
I frequently delete the Search History from my account's Activity Log.
However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past.
Suggestions ...
- 1,033
1
vote
0
answers
449
views
Corporate responsibility when allowing biometric authentication
At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for ...
- 111
1
vote
0
answers
50
views
Is Apple's default Privacy settings GDPR compliant?
I recently realized that some apps were able to "link" my identity to Facebook. I checked my off facebook activity and could see some apps that I've never given my email.
Investigating ...
- 111
1
vote
0
answers
34
views
Company acquired a website with existing users. Is GDPR announcement obligatory?
When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
- 11
1
vote
0
answers
72
views
Is it obligatory to store ToS and Privacy Policy consent for a web app?
I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should".
So my ...
- 11
1
vote
0
answers
150
views
Replace User ID with pseudonym, still need consent?
I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy.
My goal is to avoid collecting any ...
- 111
1
vote
0
answers
86
views
To achieve ECTS credits at my school a student is forced to drop his/her right of privacy
Some background about the situation:
I attend a vocational university (university of applied sciences)
I live in the Netherlands - Europe
We have a mandatory activity that provides us with ECTS ...
- 111
1
vote
0
answers
60
views
A company finds out that it has made a material decision based on incorrect personal data, what should it do?
A company terminates an employee based on what it believes to be a record of the actions of person gained from log files.
Months later the company finds out that this information is not correct.
...
- 11
1
vote
0
answers
62
views
Minimal GDPR requirements for a website
Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options:
Agree
Decline
"Read more" link to a common page "What are cookies?"
Additionally I ...
- 111
1
vote
0
answers
253
views
Is geocoding an IP address but not storing it considered processing under GDPR?
As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address.
If I geocode the IP address to get the visitor's country and ...
- 111
1
vote
0
answers
551
views
Offering GDPR privacy policy for voice mail?
Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
- 1,146
1
vote
0
answers
190
views
Under GDPR Data Processing Officer's email address bounces - what to do?
In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts.
So I had sent ...
- 203
1
vote
0
answers
371
views
Can a developer have access to live data within GDPR?
Segregation of Duties in IT
I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
- 354
1
vote
0
answers
751
views
Is disclosure of subprocessors absolutely necessary under the GDPR?
Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors?
Must I absolutely declare this information in the appropriate manner or can I ...
- 11
1
vote
1
answer
119
views
Can my employer gather personal data without written consent
I'm located in the EU.
My employer recently became a contractor for an american company. We deal with software.
A requirement of the american company was that on all machine of the people working ...
- 11
1
vote
1
answer
68
views
to be in photo and video, and right to ask for removal these data relying on GDPR
At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs.
Now, I want my pictures to be erased, or any data, ...
user14943
0
votes
1
answer
19
views
Data processing agreement with license seller or Saas host
If we (company) are buying a Saas licenses via a reseller, do we need a data processing agreement with the reseller or with the origial Saas provider.
Example:
We buy a hosted email services. Company ...
0
votes
0
answers
23
views
Would a GDPR SAR cover the evidence an online company would be expected to provide to enforce a contractual debt?
It is in the news that HelloFresh is accused of charging people for deliveries they did not request, and said they would "send a third-party debt collector round" in the case of non-payment. ...
- 6,608
0
votes
2
answers
71
views
Does a "Data Controller" need to decide on behalf of others over their Data to become a Data Controller?
We provide Software for a School, more specifically for the Students Councils there. Hence we dont sign our contract with the School, but with "the Head" of the Students Council, which is ...
- 19
0
votes
0
answers
36
views
Is a third party which solicits and accepts personal data from a customer on another’s behalf a processor or a controller?
Alice contracts with ACME insurance which sends her to their identity verification solution provider’s app/website (BCME KYC SOLUTIONS Inc). BCME’s portal asks Alice for photos of herself and other ...