Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
4
votes
3answers
4k views

How to handle CVs / resumes with GDPR rules?

As a consultant my resume is personal information which is handed out to prospective clients frequently. How personal should it be? Should some data be anonymized? Should the resume be returned from ...
4
votes
1answer
538 views

GDPR impact on genealogy website / uncontrolled user data

The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is ...
4
votes
1answer
276 views

Do employees have personal liability when working for a company that violates the GDPR?

I work for a company that doesn't take privacy laws very seriously. As far as I can tell, they're woefully unprepared for GDPR and don't seem to care very much. My tasks mainly consist of software ...
4
votes
1answer
98 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
4
votes
1answer
92 views

Responding to GDPR Article 15 requests if all data is already accessible via website

So, Article 15 of the GDPR gives the user the right to access all the personal data concerning him or her. Assume we have a website with user accounts. We store some information that is regarded as ...
4
votes
1answer
161 views

With GDPR, can you request 'real life data' be deleted/forgotten?

For example, can you request libraries remove your name from books you have checked out?
4
votes
1answer
198 views

GDPR Right to erasure vs mailing list archive?

Consider a mailing list like mailman or listserv. The archives of these mailing lists, due to quoting, will contain names and email addresses. Now, the GDP Article 17, unless I am mistaken obliges ...
4
votes
1answer
128 views

GDPR for small interest associations

What exactly does a small common interest club with 100 members need to do to comply with GDPR requirements?
4
votes
1answer
251 views

Can I count unique users without a cookie warning?

Is there a way to count (approximate) unique users on a website without having to display that silly cookie warning? The usual way to track unique users is to set a cookie. An alternative (less ...
4
votes
3answers
216 views

Do I have a “legitimate interest” under GDPR to not delete data my software needs to fulfil its function?

The GDPR gives users the right to have their stored data deleted. How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by ...
4
votes
1answer
132 views

Under GDPR, why is google not considering the index entries as personal data?

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling. Following this, I make the assumption that this qualifies as personal data under GDPR ...
4
votes
1answer
68 views

Would revealing/storing whether or not an EU customer uses a service violate the GDPR?

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
4
votes
1answer
84 views

Does possesing BUT NOT processing a personal data make the organization their controller?

According to Article 4(7) of GDPR: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
4
votes
1answer
422 views

Can I file a GDPR “request to be forgotten” on behalf of someone else?

Assuming a person might be interested in requesting to be forgotten by a large number of sites that store personal or behavioral data, sending individual requests to hundreds (or thousands) of sites ...
4
votes
1answer
139 views

As a web and mobile (iOS and Android) developer, how do I discover if GDPR applies to a user?

This is a really basic question about GDPR. If I have products that are intended only for US customers, but can be accessed by European Union residents, does GDPR apply? More specific example: A ...
4
votes
0answers
53 views

Is Google's privacy policy compliant with GDPR for the data processing agreement between a controller and a processor?

If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google ...
4
votes
2answers
337 views

“Right of access by the data subject” if the IP address is the only personal data

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
4
votes
1answer
78 views

Do I have to send one of those emails after updating my privacy policy for GDPR?

We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?...
3
votes
1answer
3k views

Salesman text me from his personal phone

I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me ...
3
votes
4answers
256 views

GDPR - Is consent really necessary for contact form?

I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer. The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
3
votes
2answers
456 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
3
votes
4answers
80 views

Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?

I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
2answers
160 views

Can the terms of service contain a clause that instructs a user to forfeit their rights under the GDPR?

Suppose an American company wishes to do business with European parties. Could their terms of service say that as a user of their services the user forfeits any rights afforded to them by the GDPR ...
3
votes
4answers
134 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
3
votes
1answer
84 views

As a customer, am i liable for messaging another customer found on a Facebook business page?

I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company. I have received a ...
3
votes
1answer
1k views

Does a user have the right to request their forum posts deleted?

Forum posts and similar stuff: chat messages from chatlogs, etc. According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered ...
3
votes
2answers
58 views

Are there any HIPAA like technical requirements in EU for developing health related web software?

It looks like in the USA developers adhere to HIPAA standards when developing and hosting health-related software. But I can't find anything similar to the EU. GDPR is all about being transparent and ...
3
votes
3answers
203 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
3
votes
2answers
48 views

Is this privacy statement from a solicitors in line with GDPR?

I'm in the process of buying a house and have paid for a survey to be done on the property. I have received a contract from the solicitor who will be conducting the survey for me and will provide me ...
3
votes
2answers
329 views

GDPR - first party analytics cookies

Does the first-party issued cookie, under control of, and only accessible by the first party requires visitor consent? Given the conditions bellow: Cookie is used to uniquely identify anonymous ...
3
votes
2answers
380 views

Do web applications as hobby projects need to comply with the GDPR?

I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation. 2) This Regulation does ...
3
votes
3answers
143 views

Android Application: Is purchaseToken defined under GDPR as PII?

In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using this API ) and saving purchaseToken on our server to validate his license. ...
3
votes
1answer
930 views

To comply with GDPR, do I need passwords hashed?

I currently have a website that will be going live soon. The passwords are hashed. Is that all I need to do to comply with General Data Protection Regulation's encryption article? Please cite and ...
3
votes
2answers
83 views

Site does not provide the option to disallow cookies in a notification

Is this a typical behavior for websites to provide only one option, and doing so, forces the user clicking "accept"? Isn't it so that they must provide both, accept and reject?
3
votes
3answers
95 views

GDPR: Is giving out customer name and implied existence of customership legal?

I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable. The purpose is to ...
3
votes
2answers
115 views

anonymisation/redaction of public website content as response to 'right to erasure'

An organisation runs some public email lists. These are archived, and the archives are also publically available from its website. A user of the mailing list asserts their "right to be forgotten" and ...
3
votes
1answer
181 views

Was my GDPR request not complied with?

On the 12th of December I made a GDPR request to a major online retailer in the UK. While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
3
votes
1answer
78 views

Does GDPR apply to location data collected by apps?

I've just been reading this article in the New York Times which expounds on the business practices of mobile apps which collect your location data and use it/sell it. The article gives examples of ...
3
votes
1answer
191 views

GDPR vs ICANN WHOIS

Let’s start with some basic information: While a bit vague, for years you’ve been required to submit registrant, admin, and technical contact details. https://whois.icann.org/en/domain-name-...
3
votes
3answers
228 views

According to GDPR, do I need a contract for processing on behalf with my e-mail provider?

It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster. Now, I am wondering whether the same is true for the e-...
3
votes
1answer
123 views

GDPR - does a unique device identifier count as personal data?

I'm planning to sell my software online. The payment process is handled by a reseller (FastSpring), so the personal data collected (like the buyer's name and e-Mail address) is never stored on my ...
3
votes
1answer
322 views

Is it legal for Blizzard to demand a copy of my government id before deleting my account?

I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so. I've seen a somewhat related question about Twitter at How can I get Twitter to delete my ...
3
votes
1answer
66 views

Data deletion requirements

I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it. I never ...
3
votes
1answer
92 views

A user has supplied personal information in an anonymous form. What is this information's status under GDPR?

I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form. If a user includes personal information (e.g. their ...
3
votes
2answers
336 views

Do default Apache logs violate the GDPR?

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
3
votes
2answers
117 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
3
votes
1answer
123 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
3
votes
1answer
108 views

Are artificially generated personal data covered by the GDPR?

According to Article 2(1) GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be ...
3
votes
1answer
796 views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
3
votes
1answer
377 views

Is email verification for account creation in violation of GDPR?

Is email verification for account creation in violation of GDPR? I am creating a new website, and my account creation is incredibly simple, consisting of username, password (stored as hash), and ...

1 2
3
4 5
11