Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
5
votes
3answers
681 views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
5
votes
1answer
298 views

Is Facebook's new cookie banner GDPR compliant?

Today I visited Facebook from a Google search to find the following cookie banner at the top of the page: To personalize content, tailor and measure ads, and provide a safer experience, we use ...
5
votes
1answer
84 views

GDPR and personal data that gets crawled and ends up on other websites

Data controllers must delete the users' personal data if they are asked to do so, according to the GDPR, except in some cases that don't really apply here. But what if that personal data has ended up ...
5
votes
1answer
96 views

Does GDPR affect individual contributor license agreements for opensource projects?

I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example Apache 2.0. The gathered information when ...
5
votes
1answer
390 views

Establishing GDPR consent when the person doesn't access a system themself

My company hosts an online database for organisations to manage training data for their people. In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. ...
5
votes
2answers
567 views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
5
votes
2answers
188 views

Are publicly available password dumps legal under GDPR

When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or ...
5
votes
1answer
249 views

Contract necessary for the most basic processing under GPDR?

I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or ...
5
votes
1answer
88 views

How to fulfill the General Data Protection Regulation (GDPR) when citing

I have a question about the European General Data Protection Regulation. According to Article 13, one has to inform anyone whose personal data is collected: Where personal data relating to a ...
5
votes
2answers
180 views

Excluding all people from the EU from my blog - is this allowed?

There's a new law from the European Union I simply cannot comply with (GDPR). Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my ...
5
votes
1answer
93 views

Do marketing emails require consent?

I am getting spammed with marketing emails from Tough Mudder. Their unsubscribe link takes me to a page where I have to either accept the fact they will send me emails or unsubscribe from everything, ...
4
votes
2answers
2k views

Does any host provider currently comply with GDPR?

According to Rec.81; Art.28(1)-(3) of the GDPR regulation, "The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding ...
4
votes
2answers
541 views

Will GDPR (EU law) make bad practices in security illegal?

The way I understand it, the purpose of GDPR (General Data Protection Regulation, EU law) is to make sure that personal data is treated transparently and securely. So half of it is about giving the ...
4
votes
2answers
131 views

“no logs” website in eu - is it illegal?

As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
4
votes
2answers
349 views

Does GDPR apply to internal employees data?

Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has ...
4
votes
2answers
139 views

Do I have to provide proof of citizenship - GDPR

Recently, I've been going through some old accounts of mine (on online websites) and I started deleting them. Thanks to GDPR, this is now much easier. Most companies' customer services have no ...
4
votes
1answer
65 views

Can online business in one country deny access via terms of service to entities in another country?

Can an American company state in their terms of service that if an entity is from a designated country they are not allowed to use the service? In other words would that be a legal and enforceable ...
4
votes
1answer
110 views

Can a data controller change their privacy policy without explicit consent?

While I read one of the updated privacy policies (PP) this week, the following section of a privacy policy seemed… off: We may change this Privacy Policy from time to time, and all changes will be ...
4
votes
1answer
538 views

Are hobby projects exempt from GDPR?

Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database. GDPR ...
4
votes
1answer
1k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
4
votes
1answer
49 views

Should all gdpr related documents be translated to all official EU languages?

I wrote application localized in Ukrainian language , which is not one of the official European Union languages. Since I reside in the EU territory I need to comply with gdpr. This application is ...
4
votes
2answers
2k views

Do the GDPR and Cookie-Law regulations apply to localStorage?

We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
4
votes
1answer
915 views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
4
votes
2answers
475 views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
4
votes
1answer
191 views

GDPR email consent - Pre ticked “No” box

We are currently creating an email to gain consent from our customers to email allow us to market to them. We are currently using Mailchimp to put the email together and it is currently not allowing ...
4
votes
1answer
567 views

Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?

I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
4
votes
1answer
146 views

Specificity of GDPR's right of erasure

Article 17 of the GDPR states that: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her [...] where one of the following ...
4
votes
2answers
217 views

Is “By clicking Continue you accept T&C” an unambiguous consent in context of GDPR

I just read about explicit/unambiguous consent in context of GDPR. And I just saw in some mobile app a payment form where you enter some data and to pay you click a "Continue" button. Just next to ...
4
votes
1answer
162 views

Would a business that has no office in EU still have to worry about GDPR, and if so, why?

This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR. Although opportunistic lawsuits against US-based businesses on their ...
4
votes
2answers
1k views

GDPR Compliance - does it extend to database backups and archived records?

How do the rules for GDPR affect database backups or archived data?As a company, you might have backups/archived data going back years. Based on the rules, when an individual invokes "forget me", it ...
4
votes
1answer
472 views

GDPR impact on genealogy website / uncontrolled user data

The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is ...
4
votes
1answer
220 views

Do employees have personal liability when working for a company that violates the GDPR?

I work for a company that doesn't take privacy laws very seriously. As far as I can tell, they're woefully unprepared for GDPR and don't seem to care very much. My tasks mainly consist of software ...
4
votes
4answers
97 views

Is a Blood sample considered Personal Data under GDPR?

Just that simple question: Is a Blood sample considered Personal Data under GDPR?
4
votes
1answer
76 views

Responding to GDPR Article 15 requests if all data is already accessible via website

So, Article 15 of the GDPR gives the user the right to access all the personal data concerning him or her. Assume we have a website with user accounts. We store some information that is regarded as ...
4
votes
1answer
158 views

With GDPR, can you request 'real life data' be deleted/forgotten?

For example, can you request libraries remove your name from books you have checked out?
4
votes
1answer
152 views

GDPR Right to erasure vs mailing list archive?

Consider a mailing list like mailman or listserv. The archives of these mailing lists, due to quoting, will contain names and email addresses. Now, the GDP Article 17, unless I am mistaken obliges ...
4
votes
1answer
113 views

Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?

How does GDPR apply to companies getting someone else's personal data from a legitimate source? For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a ...
4
votes
1answer
128 views

GDPR for small interest associations

What exactly does a small common interest club with 100 members need to do to comply with GDPR requirements?
4
votes
1answer
90 views

Can I count unique users without a cookie warning?

Is there a way to count (approximate) unique users on a website without having to display that silly cookie warning? The usual way to track unique users is to set a cookie. An alternative (less ...
4
votes
1answer
289 views

GDPR vs. Credit Card Chargebacks

I work for a company where we take credit card payments for the services we provide. As per the Card Scheme rules, the cardholder can request a charge-back up to (in the case of Visa) 13 months after ...
4
votes
2answers
80 views

Opting out of cookies by emailing a company

Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than ...
4
votes
1answer
53 views

Would revealing/storing whether or not an EU customer uses a service violate the GDPR?

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
4
votes
1answer
70 views

Does possesing BUT NOT processing a personal data make the organization their controller?

According to Article 4(7) of GDPR: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
4
votes
2answers
233 views

“Right of access by the data subject” if the IP address is the only personal data

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
4
votes
1answer
326 views

Can I file a GDPR “request to be forgotten” on behalf of someone else?

Assuming a person might be interested in requesting to be forgotten by a large number of sites that store personal or behavioral data, sending individual requests to hundreds (or thousands) of sites ...
4
votes
1answer
127 views

As a web and mobile (iOS and Android) developer, how do I discover if GDPR applies to a user?

This is a really basic question about GDPR. If I have products that are intended only for US customers, but can be accessed by European Union residents, does GDPR apply? More specific example: A ...
4
votes
0answers
43 views

Is Google's privacy policy compliant with GDPR for the data processing agreement between a controller and a processor?

If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google ...
4
votes
0answers
60 views

Do I have to send one of those emails after updating my privacy policy for GDPR?

We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?...
3
votes
1answer
3k views

Salesman text me from his personal phone

I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me ...
3
votes
2answers
419 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...