Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
63 votes
2 answers
5k views

How does SE's arbitration clause hold up under the GDPR?

Today the new Terms of Service of Stack Exchange have been released, sparking a lot of unrest about its arbitration clause; see the comments and answers on the linked meta above, and also this ...
Adriaan's user avatar
  • 715
60 votes
4 answers
20k views

Does GDPR include UK customers, or not anymore?

Now that Brexit happened, does GDPR include UK customers, or not anymore?
Nuno's user avatar
  • 1,033
49 votes
2 answers
7k views

Is requesting waiving the right to deletion of contributions against GDPR?

I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage: (For GitLab ...
rubenvb's user avatar
  • 533
42 votes
2 answers
8k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
Oldrich Svec's user avatar
36 votes
2 answers
7k views

How to store refusal of cookie consent

If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
Jackson Holiday Wheeler's user avatar
30 votes
4 answers
9k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
fluidj's user avatar
  • 419
30 votes
2 answers
5k views

Accessing public CCTV footage about you

Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
dollar bill's user avatar
27 votes
2 answers
28k views

How to satisfy GDPR's consent requirement for IP logging?

Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
Pistos's user avatar
  • 373
26 votes
2 answers
8k views

Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?

So, I've been receiving a lot of spammails recently and I'm pretty fed up with them. I've also been wondering, how they got access to my mail-address, so I sent a request of information so I can see, ...
Florian F.'s user avatar
26 votes
5 answers
16k views

Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?

I have recently come across this part of an app from a well-known US company: Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of ...
Michal's user avatar
  • 369
24 votes
2 answers
7k views

Can I request a copy of my password hash with GDPR?

People often use personal information to create them, like first name / date of birth, and people often reuse passwords across several sites, so I guess passwords are considered personal data since ...
Benoit Esnard's user avatar
23 votes
2 answers
2k views

Other use of profile photos: legality fair-use and permissions

I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). ...
Sunil Gupta's user avatar
23 votes
3 answers
10k views

In Europe, can I refuse to use Gsuite / Office365 at work?

See above. In a country where GDPR applies (Italy in my case), do I have the right to refuse giving consent to Google and Microsoft to store my personal data, if this account is for work use? Or, in ...
Federico Poloni's user avatar
22 votes
2 answers
4k views

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
Kin's user avatar
  • 231
22 votes
1 answer
6k views

Am I obligated to decrypt lots of data for GDPR requests?

I am providing a B2B service where customer data of businesses are stored in an SQL table. As I never need to query for this personal data, the data at rest there is asymmetrically encrypted with the ...
dmuensterer's user avatar
22 votes
2 answers
33k views

Do the GDPR and Cookie-Law regulations apply to localStorage?

We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
Andrea's user avatar
  • 323
22 votes
4 answers
15k views

GDPR - reCAPTCHA with user's consent?

This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data. I was reading briefly about ePrivacy regulations ...
lp1051's user avatar
  • 321
20 votes
2 answers
4k views

Are global user account systems now illegal following the EU's May 2023 fine of Meta?

The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta Like any website, we have an account system where people log in to access their ...
Per's user avatar
  • 303
18 votes
1 answer
4k views

GDPR rights when subject dies; does family inherit subject rights?

Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.). What if the subject is deceased? Does the widow/widower or do the children ...
gerrit's user avatar
  • 1,386
17 votes
4 answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
J. Doe's user avatar
  • 457
17 votes
1 answer
3k views

Can Slack really claim not to be a data controller?

I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response: Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
the's user avatar
  • 271
16 votes
5 answers
7k views

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

On day one of my first year in high school me and basically every other students were given a few documents to sign. One of them included a clause that allowed the school to publish pictures of us ...
nz4387's user avatar
  • 161
16 votes
2 answers
4k views

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
User65535's user avatar
  • 6,536
16 votes
3 answers
14k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
Nuno's user avatar
  • 1,033
15 votes
2 answers
5k views

Does GDPR apply if my web app stores personal data on the user's phone only?

My web app stores personal data about the user, but on the user's phone only (HTML5 Local Storage). The data is never touched by any server or database. I can't see the data. My server can't see the ...
Chris's user avatar
  • 253
15 votes
2 answers
6k views

Would GDPR affect my own personal website?

I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public. As I am the only person who is in charge (my personal site), would I have to oblige to ...
iProgram's user avatar
  • 271
14 votes
5 answers
4k views

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

Service providers like Google and Facebook are pretty much part of people's lives. Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
user1034912's user avatar
  • 1,501
14 votes
3 answers
3k views

GDPR & Blocking EU Visitors?

I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
Charles's user avatar
  • 197
14 votes
3 answers
2k views

Why can't I add a governing law to my terms of service to avoid GDPR?

I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
Jim's user avatar
  • 141
14 votes
2 answers
3k views

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member. I will explain the best I can: ...
Michael Morgan's user avatar
14 votes
1 answer
2k views

How can consent-banner as a service be GDPR compliant?

A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
Samuel's user avatar
  • 243
14 votes
4 answers
1k views

What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
Ben Collins's user avatar
13 votes
1 answer
4k views

Does the German GDPR require storing the data in a German datacenter for a tele-health company?

I co-founded a tele-health startup, we are expanding to Germany, we have gone through the GDPR, and implemented most of it, however, we didn't quite understand the data residency part and found ...
ali.bh's user avatar
  • 233
13 votes
5 answers
3k views

Are auto-generated identifiers PII if they cannot be linked to an identity?

The reason for this post is to express a contradiction that seems to be widespread in some places on the internet. I'm not a lawyer, I'm a software developer doing my best to comply with the GDPR and ...
svprdga's user avatar
  • 293
12 votes
4 answers
5k views

How can I get more than 10 years of transaction history from my bank?

I will shamefully admit that it was only in the year 2021 that I finally built my own bookkeeping system. Yes, I should have done it 10-20 years ago, but I didn't. So now I'm in this situation: First ...
H Salvas's user avatar
  • 147
12 votes
6 answers
8k views

What should a website do if the end user refuses to accept the necessary cookies?

Suppose that a data controller chooses the consent legal basis for GDPR article 6 purposes. Then, the data controller says something along these lines in a cookie consent banner on their website: We ...
Paul Razvan Berg's user avatar
12 votes
2 answers
3k views

Why does the GDPR matter to me, a US citizen with no property in Europe?

I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
Someone's user avatar
  • 16.6k
12 votes
2 answers
2k views

Does the Companies Act 2006 trump an individual's right to be forgotten?

I once was a contractor and ran a limited company. At the time all my details and my secretary's were published on the Companies House website. edit: This information includes full names and addresses....
iwarv's user avatar
  • 231
12 votes
1 answer
1k views

Is an email enumeration vulnerability a breach of GDPR?

I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows: User inputs their email If the email belongs to an existing user, ...
MichaelJK's user avatar
  • 173
11 votes
2 answers
2k views

Are users' personal notes about other users subjected to the GDPR right of access?

Some applications, like Discord or Mastodon, allow a user A to put private notes (only accessible to A) next to the profile of another user B. This data is very probably Personal Identifiable ...
user19917937's user avatar
11 votes
5 answers
2k views

GDPR: Can a city request deletion of all personal data that uses a certain domain for logins?

A city in Finland asked me to delete all data for everyone whose login uses a certain domain. The domain contains "edu" in it and "oppilas" (which translates to "student")...
cesoid's user avatar
  • 211
11 votes
4 answers
1k views

Do cookie banners need to change for GDPR compliance?

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
Matthew FitzGerald-Chamberlain's user avatar
11 votes
2 answers
7k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
lnl's user avatar
  • 213
11 votes
2 answers
2k views

To comply to GDPR, are social networks required to have a button to "Export your Data"?

Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
Nuno's user avatar
  • 1,033
10 votes
4 answers
5k views

Is there a way to determine if an email address is personal information?

The GDPR defines personal data as: Personal data is information that relates to an identified or identifiable individual. My understanding is that this means that [email protected] is ...
User65535's user avatar
  • 6,536
10 votes
2 answers
4k views

Is a "login timestamp" considered as personal data according to GDPR?

If software is saving the timestamp of the last login of a user, would that timestamp itself be considered personal data by GDPR?
Mr. Eivind's user avatar
10 votes
6 answers
4k views

GDPR and right to provide meter readings

My energy company have estimated the opening meter readings for my move in date for a property. I have the correct readings in photos taken on that date, but the energy company won't allow me to ...
F Chopin's user avatar
  • 315
10 votes
4 answers
5k views

Do I need to present a GDPR banner to IP addresses outside of GDPR regions?

The context of my question comes from this comment: The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The ...
Daniel Kaplan's user avatar
10 votes
3 answers
3k views

Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?

Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store. Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head ...
JosephCorrectEnglishPronouns's user avatar
10 votes
2 answers
3k views

Can a company actually become GDPR compliant? Is there such a thing?

(This question could be expanded to other auditing procedures too) How do huge multinational companies that want to become GDPR compliant start off this? I mean, I guess one has to read the regulation,...
4d4143's user avatar
  • 103

1
2 3 4 5
20