Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
3
votes
4answers
64 views

Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?

I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
4answers
110 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
3
votes
1answer
76 views

As a customer, am i liable for messaging another customer found on a Facebook business page?

I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company. I have received a ...
3
votes
2answers
139 views

Can the terms of service contain a clause that instructs a user to forfeit their rights under the GDPR?

Suppose an American company wishes to do business with European parties. Could their terms of service say that as a user of their services the user forfeits any rights afforded to them by the GDPR ...
3
votes
2answers
44 views

Is this privacy statement from a solicitors in line with GDPR?

I'm in the process of buying a house and have paid for a survey to be done on the property. I have received a contract from the solicitor who will be conducting the survey for me and will provide me ...
3
votes
2answers
269 views

Do web applications as hobby projects need to comply with the GDPR?

I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation. 2) This Regulation does ...
3
votes
3answers
114 views

Android Application: Is purchaseToken defined under GDPR as PII?

In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using this API ) and saving purchaseToken on our server to validate his license. ...
3
votes
1answer
749 views

To comply with GDPR, do I need passwords hashed?

I currently have a website that will be going live soon. The passwords are hashed. Is that all I need to do to comply with General Data Protection Regulation's encryption article? Please cite and ...
3
votes
3answers
147 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
3
votes
3answers
84 views

GDPR: Is giving out customer name and implied existence of customership legal?

I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable. The purpose is to ...
3
votes
2answers
106 views

anonymisation/redaction of public website content as response to 'right to erasure'

An organisation runs some public email lists. These are archived, and the archives are also publically available from its website. A user of the mailing list asserts their "right to be forgotten" and ...
3
votes
1answer
115 views

Was my GDPR request not complied with?

On the 12th of December I made a GDPR request to a major online retailer in the UK. While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
3
votes
1answer
60 views

Does GDPR apply to location data collected by apps?

I've just been reading this article in the New York Times which expounds on the business practices of mobile apps which collect your location data and use it/sell it. The article gives examples of ...
3
votes
1answer
136 views

GDPR vs ICANN WHOIS

Let’s start with some basic information: While a bit vague, for years you’ve been required to submit registrant, admin, and technical contact details. https://whois.icann.org/en/domain-name-...
3
votes
3answers
151 views

According to GDPR, do I need a contract for processing on behalf with my e-mail provider?

It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster. Now, I am wondering whether the same is true for the e-...
3
votes
2answers
2k views

How to handle CVs / resumes with GDPR rules?

As a consultant my resume is personal information which is handed out to prospective clients frequently. How personal should it be? Should some data be anonymized? Should the resume be returned from ...
3
votes
2answers
101 views

Do default Apache logs violate the GDPR?

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
3
votes
1answer
73 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
3
votes
2answers
60 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
3
votes
1answer
73 views

Requesting to see holiday rota and GDPR

my partner has asked if she can see the holiday rota and was told she couldn't because of GDPR. Is that correct? I know anything that identifies you needs to be secure but the rota of when people are ...
3
votes
1answer
69 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
3
votes
1answer
71 views

Are artificially generated personal data covered by the GDPR?

According to Article 2(1) GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be ...
3
votes
1answer
122 views

Is email verification for account creation in violation of GDPR?

Is email verification for account creation in violation of GDPR? I am creating a new website, and my account creation is incredibly simple, consisting of username, password (stored as hash), and ...
3
votes
2answers
451 views

Does keeping an MD5 hash of user data violate GDPR?

If a user requests to have their data deleted, would we still be permitted to keep hashes of user data for later use, even after the original data has been deleted?
3
votes
1answer
443 views

GDPR: Are Anticheat Logs personal data?

We are running an online game server and use an automated system to detect cheaters. When a cheater gets banned a log will be saved containing the names of the algorithms that detected the cheater. We ...
3
votes
1answer
58 views

GDPR - Is having a PDF with fields to fill out classed as data?

I have a website which has a link to a PDF form which users can print out and fill in. I'm wondering if somewhere I need to a statement in my privacy policy which justifies this?
3
votes
1answer
569 views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
3
votes
1answer
50 views

GDPR: Transfer (chapter V)

I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web ...
3
votes
2answers
40 views

GDPR - am I the processor if I don't host the website?

I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase ...
3
votes
1answer
51 views

Do I need user consent to respond to their email sent through my website's contact form?

I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message. I'm not storing any of the data in a database or in cookies. When the user ...
3
votes
1answer
66 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
3
votes
1answer
74 views

Is it legal to have a opt-out of marketing emails checkbox under GDPR?

As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-...
3
votes
1answer
48 views

GDPR - How quick to honour unsubscribe?

Does GDPR or any other UK law specify the timeframe for removing someone from a mailing list? In our case the mailing list must be created up to 10 days before an automated email send over the ...
3
votes
1answer
123 views

GDPR and hotlinked images: are they allowed?

By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent: Your ...
3
votes
1answer
65 views

Private Website and copyright/GDPR

Similar questions have been asked before but I still could not find answers that made me understand it. I created a website and would like to know which laws affect me. The website does not have any ...
3
votes
1answer
157 views

Just how different is the legal situation in Germany under GDPR compared to previously with respect to running a website?

A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national ...
3
votes
1answer
74 views

GDPR and forums: “Lawfulness of processing” email addresses used only for providing the service

I run a small hobby message board that is entirely non-commercial. People need to provide an email address to register and use that for logging in. I do not use their email address for anything else (...
3
votes
1answer
156 views

Should email addresses be anonymized/pseudonymized under GDPR?

GDPR states recommendation to pseudonymise or even anonymise Personal Data. A lot — most of — web sites and services require email address on signup. Should, from the Data Controller's point of view, ...
3
votes
1answer
513 views

User consent required under GDPR

I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user. For this reason I have drafted a ...
3
votes
2answers
145 views

GDPR liability for Web Designer

I am a web designer that works with a range of clients on a project basis. I complete a project and then offer my services at any hourly rate for any other work required in the future. Do I have a ...
3
votes
1answer
264 views

What does 'Right to Erasure' actually cover?

According to GDPR, any person has 'Right to Erasure (Recital)' and have his/hers sensitive information deleted. Does that mean that an organization can keep all non-sensitive data for a user? For an ...
3
votes
1answer
87 views

According to GDPR Article 30, do I maintain a continuous record or just a one-off?

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification. See: https://www.privacy-regulation.eu/en/30.htm It states that a data controller ...shall maintain a record of ...
3
votes
1answer
94 views

Under GDPR, why is google not considering the index entries as personal data?

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling. Following this, I make the assumption that this qualifies as personal data under GDPR ...
3
votes
1answer
61 views

GDPR compliance for software that lets users store PII of other people

Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential ...
3
votes
1answer
66 views

How to fulfill the General Data Protection Regulation (GDPR) in science

Suppose, a scientist is planning to publish a paper that is about an algorithm which analyzes Wikipedia articles. I'm wondering, if the European General Data Protection Regulation would be relevant in ...
3
votes
2answers
882 views

What counts as material or non-material damage under the GDPR?

In Art. 82 GDPR: Right to compensation and liability it states: (1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the ...
3
votes
2answers
118 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
3
votes
3answers
1k views

GDPR: Citizens with Dual Nationality?

Do the GDPR Regulations apply to processing data of a citizen who has dual nationality?
3
votes
0answers
42 views

What happens to SARs recieved before the 25th May?

With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May. However, in ...
2
votes
4answers
282 views

Is it possible to refuse offering service to GDPR-protected customers?

Let's say I have a service that asks registration details from the user and for some reason I, as a provider of that service, can't comply to GDPR and therefore want to refuse registration of new ...