Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
6
votes
2answers
267 views

If photos are PII under GDPR, how are most photos on the web legal?

It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal ...
6
votes
1answer
393 views

Is Facebook's new cookie banner GDPR compliant?

Today I visited Facebook from a Google search to find the following cookie banner at the top of the page: To personalize content, tailor and measure ads, and provide a safer experience, we use ...
6
votes
2answers
3k views

GDPR Compliance - does it extend to database backups and archived records?

How do the rules for GDPR affect database backups or archived data?As a company, you might have backups/archived data going back years. Based on the rules, when an individual invokes "forget me", it ...
6
votes
1answer
516 views

Is throw-away-the-key-encryption allowed under GDPR?

Article 15 of the GDPR says: The data subject shall have the right to obtain [...] personal data [if it is being "processed"] Article 4 says that "processing" includes storage. Therefore, all ...
6
votes
1answer
627 views

GDPR - Do I have to log user's IP after consent for a cookie?

Do I really have to log a user's IP address and a timestamp after they consent to a cookie? Log example: 20.05.2018 18:56:32 - 127.0.0.1 - Cookie accepted I don't even need (I'm not using it in any ...
6
votes
1answer
120 views

GDPR and personal data that gets crawled and ends up on other websites

Data controllers must delete the users' personal data if they are asked to do so, according to the GDPR, except in some cases that don't really apply here. But what if that personal data has ended up ...
6
votes
1answer
442 views

GDPR and deleting users from wiki changelogs

According to the GDPR §17, users have a right to request the deletion of personal data. I am wondering how this applies to wikis. In my case, when users edit a page, that edit is associated with ...
6
votes
3answers
617 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
6
votes
1answer
258 views

GDPR - am I a data controller as an app owner if I do not have access to the data?

Let's assume that I created a mobile app for iPhone that is tracking rides on a bike so that means the app is collecting GPS coordinates of the phone and later this mobile app shows some statistics ...
6
votes
1answer
542 views

Does GDPR Recital 15 exempt unstructured electronic data?

GDPR Recital 15 states that Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation. I ...
5
votes
1answer
2k views

I have created an App to help isolated people in Corona Virus lockdown. Do GDPR rules apply

I have created an App at helpathome.me which isolated people can use to fill out a form and request help from others. I innocently thought this would be fine but a friend told me that I must comply ...
5
votes
5answers
1k views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
5
votes
1answer
132 views

Is it GDPR-compliant to require *public* publishing of personal info as condition for access to a service?

Background: For roughly 2 decades I've run my own private email infrastructure for myself, open source projects, and a few other individuals over business internet service intended for such usage. I'...
5
votes
1answer
58 views

The circumvention of terms and conditions

There are sites, for example 'moodys.com', which require an explicit agreement to the terms and conditions on every vist (e.g. https://www.moodys.com/research/Moodys-affirms-Chang-Hwa-Commercial-Banks-...
5
votes
2answers
5k views

Do the GDPR and Cookie-Law regulations apply to localStorage?

We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
5
votes
3answers
901 views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
5
votes
2answers
265 views

GDPR with refusing medical information

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing ...
5
votes
1answer
2k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
5
votes
1answer
1k views

Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?

I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
5
votes
2answers
420 views

Is “By clicking Continue you accept T&C” an unambiguous consent in context of GDPR

I just read about explicit/unambiguous consent in context of GDPR. And I just saw in some mobile app a payment form where you enter some data and to pay you click a "Continue" button. Just next to ...
5
votes
1answer
1k views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
5
votes
1answer
414 views

Establishing GDPR consent when the person doesn't access a system themself

My company hosts an online database for organisations to manage training data for their people. In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. ...
5
votes
1answer
123 views

Does GDPR affect individual contributor license agreements for opensource projects?

I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example Apache 2.0. The gathered information when ...
5
votes
2answers
688 views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
5
votes
1answer
163 views

Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?

How does GDPR apply to companies getting someone else's personal data from a legitimate source? For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a ...
5
votes
1answer
262 views

Contract necessary for the most basic processing under GPDR?

I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or ...
5
votes
1answer
105 views

How to fulfill the General Data Protection Regulation (GDPR) when citing

I have a question about the European General Data Protection Regulation. According to Article 13, one has to inform anyone whose personal data is collected: Where personal data relating to a ...
5
votes
2answers
204 views

Excluding all people from the EU from my blog - is this allowed?

There's a new law from the European Union I simply cannot comply with (GDPR). Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my ...
5
votes
1answer
114 views

Do marketing emails require consent?

I am getting spammed with marketing emails from Tough Mudder. Their unsubscribe link takes me to a page where I have to either accept the fact they will send me emails or unsubscribe from everything, ...
4
votes
2answers
261 views

Are Blizzard breaking GDPR by charging people for changing their usernames?

I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago. I now want to change it again because searching it on Google ...
4
votes
2answers
576 views

Will GDPR (EU law) make bad practices in security illegal?

The way I understand it, the purpose of GDPR (General Data Protection Regulation, EU law) is to make sure that personal data is treated transparently and securely. So half of it is about giving the ...
4
votes
2answers
147 views

“no logs” website in eu - is it illegal?

As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
4
votes
2answers
2k views

Does any host provider currently comply with GDPR?

According to Rec.81; Art.28(1)-(3) of the GDPR regulation, "The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding ...
4
votes
2answers
507 views

Does GDPR apply to internal employees data?

Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has ...
4
votes
2answers
190 views

Do I have to provide proof of citizenship - GDPR

Recently, I've been going through some old accounts of mine (on online websites) and I started deleting them. Thanks to GDPR, this is now much easier. Most companies' customer services have no ...
4
votes
1answer
685 views

Are hobby projects exempt from GDPR?

Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database. GDPR ...
4
votes
1answer
215 views

Deletion of personal data

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background. ...
4
votes
2answers
87 views

If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?

I’m considering buying the assets of an insolvent company that has gone into administration / receivership. Included in the assets is a customer database. How does GDPR apply? is the purchasing ...
4
votes
1answer
121 views

Under GDPR can I avoid divulging a customer's data to the government?

Scenario: A business has a legal requirement to obtain a license from a government agency relating to its business activities. The business activities have already being undertaken and there is no ...
4
votes
1answer
86 views

Can online business in one country deny access via terms of service to entities in another country?

Can an American company state in their terms of service that if an entity is from a designated country they are not allowed to use the service? In other words would that be a legal and enforceable ...
4
votes
1answer
123 views

Can a data controller change their privacy policy without explicit consent?

While I read one of the updated privacy policies (PP) this week, the following section of a privacy policy seemed… off: We may change this Privacy Policy from time to time, and all changes will be ...
4
votes
1answer
110 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
4
votes
1answer
146 views

Requesting to see holiday rota and GDPR

my partner has asked if she can see the holiday rota and was told she couldn't because of GDPR. Is that correct? I know anything that identifies you needs to be secure but the rota of when people are ...
4
votes
1answer
190 views

Should all gdpr related documents be translated to all official EU languages?

I wrote application localized in Ukrainian language , which is not one of the official European Union languages. Since I reside in the EU territory I need to comply with gdpr. This application is ...
4
votes
2answers
583 views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
4
votes
1answer
209 views

GDPR email consent - Pre ticked “No” box

We are currently creating an email to gain consent from our customers to email allow us to market to them. We are currently using Mailchimp to put the email together and it is currently not allowing ...
4
votes
1answer
90 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
4
votes
2answers
91 views

Opting out of cookies by emailing a company

Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than ...
4
votes
4answers
391 views

Is a Blood sample considered Personal Data under GDPR?

Just that simple question: Is a Blood sample considered Personal Data under GDPR?
4
votes
1answer
175 views

Specificity of GDPR's right of erasure

Article 17 of the GDPR states that: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her [...] where one of the following ...

1
2
3 4 5
11