Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
7
votes
1answer
85 views

As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?

The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
7
votes
1answer
210 views

Under GDPR right of access, do I have the right to receive a copy of scoring sheets / evaluation forms after a structured job interview?

Under the GDPR right of access, what rights do I have to employer assessment of myself in the role of a job applicant after a structured job interview? Presumably, in a structured job interview ...
7
votes
1answer
163 views

Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?

I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation. Anyway, if I ...
7
votes
1answer
115 views

Is it sufficient to provide a privacy policy only in english language?

Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language? Is a translation necessary for every country of the EU ...
7
votes
1answer
754 views

Legal aspects of Firebase Crashlytics SDK

Let's say we have a mobile app, where every user is associated with app-generated unique user id (ex. 57d2ef8b391277001aad7784). Having the uuid itself that's not possible to identify a user. ...
6
votes
2answers
3k views

Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user's jurisdiction?

Can one add a clause stating Do not use this application if the terms demanded cannot be provided by law For example, let's say one term of use states that information collected may be retained ...
6
votes
1answer
1k views

Is it okay to store user locations?

I know it might sound quite bad. But here I explain the whole situation. I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
6
votes
2answers
4k views

Does vehicle information count as personal data?

Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation? How about the VIN? (Vehicle Identification Number)
6
votes
4answers
218 views

Do internal annotations on user accounts fall under the GDPR?

In a platform such as Stack Exchange or any other moderated forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may ...
6
votes
1answer
114 views

Company makes confidential CV publicly available and searchable. Legal recourse?

A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
6
votes
2answers
621 views

Are server-logs reckoned as storing of personal data by website (GDPR)?

Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS). Should I state that in our privacy policy?
6
votes
1answer
275 views

What did Flybe actually do wrong?

Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc. They sent an email to this ...
6
votes
1answer
121 views

Can a company charge you to update your address under GDPR?

I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
6
votes
1answer
162 views

Is it GDPR-compliant to require *public* publishing of personal info as condition for access to a service?

Background: For roughly 2 decades I've run my own private email infrastructure for myself, open source projects, and a few other individuals over business internet service intended for such usage. I'...
6
votes
2answers
322 views

If photos are PII under GDPR, how are most photos on the web legal?

It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal ...
6
votes
1answer
697 views

Is throw-away-the-key-encryption allowed under GDPR?

Article 15 of the GDPR says: The data subject shall have the right to obtain [...] personal data [if it is being "processed"] Article 4 says that "processing" includes storage. Therefore, all ...
6
votes
1answer
476 views

Is Facebook's new cookie banner GDPR compliant?

Today I visited Facebook from a Google search to find the following cookie banner at the top of the page: To personalize content, tailor and measure ads, and provide a safer experience, we use ...
6
votes
1answer
765 views

GDPR - Do I have to log user's IP after consent for a cookie?

Do I really have to log a user's IP address and a timestamp after they consent to a cookie? Log example: 20.05.2018 18:56:32 - 127.0.0.1 - Cookie accepted I don't even need (I'm not using it in any ...
6
votes
3answers
646 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
6
votes
2answers
785 views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
6
votes
1answer
581 views

Does GDPR Recital 15 exempt unstructured electronic data?

GDPR Recital 15 states that Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation. I ...
5
votes
1answer
2k views

I have created an App to help isolated people in Corona Virus lockdown. Do GDPR rules apply

I have created an App at helpathome.me which isolated people can use to fill out a form and request help from others. I innocently thought this would be fine but a friend told me that I must comply ...
5
votes
5answers
3k views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
5
votes
1answer
64 views

The circumvention of terms and conditions

There are sites, for example 'moodys.com', which require an explicit agreement to the terms and conditions on every vist (e.g. https://www.moodys.com/research/Moodys-affirms-Chang-Hwa-Commercial-Banks-...
5
votes
3answers
993 views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
5
votes
2answers
270 views

GDPR with refusing medical information

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing ...
5
votes
1answer
115 views

Are there temporal limits to data requirements for a GDPR SAR?

Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data? The particular case I am thinking about is SAR made to the 3 credit ...
5
votes
1answer
245 views

Deletion of personal data

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background. ...
5
votes
1answer
2k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
5
votes
1answer
1k views

Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?

I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
5
votes
2answers
533 views

Is “By clicking Continue you accept T&C” an unambiguous consent in context of GDPR

I just read about explicit/unambiguous consent in context of GDPR. And I just saw in some mobile app a payment form where you enter some data and to pay you click a "Continue" button. Just next to ...
5
votes
1answer
1k views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
5
votes
1answer
421 views

Establishing GDPR consent when the person doesn't access a system themself

My company hosts an online database for organisations to manage training data for their people. In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. ...
5
votes
1answer
184 views

Specificity of GDPR's right of erasure

Article 17 of the GDPR states that: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her [...] where one of the following ...
5
votes
1answer
133 views

Does GDPR affect individual contributor license agreements for opensource projects?

I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example Apache 2.0. The gathered information when ...
5
votes
1answer
181 views

Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?

How does GDPR apply to companies getting someone else's personal data from a legitimate source? For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a ...
5
votes
1answer
275 views

Contract necessary for the most basic processing under GPDR?

I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or ...
5
votes
3answers
251 views

Do I have a “legitimate interest” under GDPR to not delete data my software needs to fulfil its function?

The GDPR gives users the right to have their stored data deleted. How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by ...
5
votes
1answer
165 views

Under GDPR, why is google not considering the index entries as personal data?

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling. Following this, I make the assumption that this qualifies as personal data under GDPR ...
5
votes
1answer
120 views

How to fulfill the General Data Protection Regulation (GDPR) when citing

I have a question about the European General Data Protection Regulation. According to Article 13, one has to inform anyone whose personal data is collected: Where personal data relating to a ...
5
votes
2answers
222 views

Excluding all people from the EU from my blog - is this allowed?

There's a new law from the European Union I simply cannot comply with (GDPR). Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my ...
5
votes
1answer
117 views

Do marketing emails require consent?

I am getting spammed with marketing emails from Tough Mudder. Their unsubscribe link takes me to a page where I have to either accept the fact they will send me emails or unsubscribe from everything, ...
5
votes
2answers
418 views

“Right of access by the data subject” if the IP address is the only personal data

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
4
votes
2answers
293 views

Are Blizzard breaking GDPR by charging people for changing their usernames?

I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago. I now want to change it again because searching it on Google ...
4
votes
2answers
582 views

Will GDPR (EU law) make bad practices in security illegal?

The way I understand it, the purpose of GDPR (General Data Protection Regulation, EU law) is to make sure that personal data is treated transparently and securely. So half of it is about giving the ...
4
votes
2answers
473 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
4
votes
2answers
153 views

“no logs” website in eu - is it illegal?

As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
4
votes
2answers
2k views

Does any host provider currently comply with GDPR?

According to Rec.81; Art.28(1)-(3) of the GDPR regulation, "The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding ...
4
votes
2answers
676 views

Does GDPR apply to internal employees data?

Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has ...
4
votes
2answers
562 views

GDPR: Is only a birthday personal identifiable information?

I wonder if only a birthday is seen as personal identifiable information according to the GDPR, so no usernames, passwords, emails, phone numbers are present in the system. Literally only a birthdate. ...

1
2
3 4 5
12