Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

2
votes
1answer
81 views

Does my Personal Web App need to comply to GDPR?

I am building an app where I have some concerns about GDPR and user data. First of all this is a personal app, no company behind. What the app does: Allows a user to authenticate via e.g. ...
2
votes
1answer
57 views

Can a user request the deletion of their IP address that is stored for moderation purposes?

An Internet forum logs their users' IP addresses for moderation purposes (fighting abusive sockpuppetry, temporary banning a dynamic IP address range in case of a spam attack, permanently banning ...
2
votes
1answer
242 views

Cookie compliance with GDPR when cookies don't collect the PII?

We are using Google Analytics and Facebook Login button (Which comes with preset Facebook Analytics). So here is the question with Google Analytics we are not assigning users with GA UserID and IP ...
2
votes
1answer
82 views

GDPR, email lists, a few email subscribers in the EU

Situation: Say you are an organization that regularly sends out e-newsletter updates to an email list that has been curated over the years by people signing up at events and/or through online sign-up ...
2
votes
1answer
72 views

Using Personal data before consent

I am having an Android App which is going to use some services such as Google Analytics, Firebase etc. I have a thought of having two different consent screens for different region user such as EU ...
2
votes
1answer
67 views

GDPR and online forms: how to prove that the data owner opted in?

How can the data processor who collect personal information using an online form prove that the person who entered her data gave active consent, for instance by clicking a checkmark? Imagine a a ...
2
votes
1answer
3k views

Under the GDPR, should transaction data be deleted on account deletion or on user request?

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted? Or if the user can buy ...
2
votes
1answer
47 views

GDPR Requirements for restricted use corporate webapp [closed]

The GDPR is very complicated, and while its requirements may be crystal clear to those who are intimately familiar with it, it is not at all clear to most as to what the exact requirements are in all ...
2
votes
1answer
68 views

Do Bitcoin nodes need consent to store EU citizen's personal data?

The Bitcoin blockchain stores data about bitcoin users. This includes: There bitcoin address, which is linkable to their identity via blockchain analysis Transactions they have made This would seem ...
2
votes
1answer
179 views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
2
votes
1answer
96 views

My email has been shared with other parties

I am in the process of searching for a new job and I have applied for a few. Today I received an email from HR representative of one of the companies saying that I was not called for an interview ...
2
votes
1answer
35 views

GDPR and Storing Non-EU Citizen Data as an EU-based company

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
2
votes
1answer
123 views

GDPR - What exactly should I do to prevent revenue loss?

I've seen many sites blocking cookies right away and expecting users to click the "Accept cookies" button to activate them. But then I came to stack exchange to ask this question and there's a note on ...
2
votes
2answers
49 views

GDPR and two-party communications

If a chat or email provider wishes to analyze the contents of what their customers are writing, does GDPR require it to obtain the consent of everyone involved in the chat/email? Or would the consent ...
2
votes
1answer
90 views

Advice sought regarding GDPR and managing sensitive data

We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server. There are files that are ...
2
votes
1answer
50 views

GDPR: Applied Security vs Employee Contracts

An Organisation has 10,000 employees. All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation. Only 200 employees require access to the PII data for the ...
2
votes
2answers
54 views

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)?

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)? For example, on Stack Exchange, do the questions, answers, comments, messages and ...
2
votes
1answer
54 views

GDPR and locked content, legal or not?

We are at the point where we want to launch a web application. The application requires the visitor to create a free account to explore the website. So already at the beginning, they need to create ...
2
votes
1answer
75 views

Can a company charge a fee for erasure under GDPR?

Suppose a company has a mailing list to reach out to potential customers. They send both physical and electronic mail. One EU-based potential customer does not want to receive mail anymore and ...
2
votes
1answer
75 views

Can I ask my employer for details held about me?

A company runs a transformation exercise. It asked for employees to fill out answers against questions, which are submitted to a portal and assessed by a number of employees and scored. These scores, ...
2
votes
1answer
103 views

GDPR and hotlinked images: are they allowed?

By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent: Your ...
2
votes
1answer
62 views

GDPR and Homebrew analytics

Homebrew is collecting anonymous GA analytics by default. User have this information during installation of this package manager. To opt-out you need go to the web page and choise a way to opt-out (...
2
votes
1answer
93 views

Using GDPR against cold-call marketing emails

I recently received a "cold-call" email from a salesman to my professional email address, which is in the form firstname.lastname@company.com. The firstname is a very formal version unlikely to be ...
2
votes
1answer
94 views

Under GDPR, is an image of a person's face a “Special Category Data”?

I'm triyng to understand whether, under European GDPR, an image of a person's face is a "Special Category Data". From this image I could determine person's: ethnic origin (for example: from the ...
2
votes
1answer
41 views

Does the GDPR cover / apply to (in any way) photography at a workplace event?

A company organises a staff event during business hours. Say a hackathon or similar. The company arranges a photographer and videographer to record pictures, footage, presentations etc. Speaking ...
2
votes
1answer
53 views

Under what conditions can an Asian company access Database hosted by a British company containing data of European citizens?

I work for a small non-EU company1 on projects of a British company2 which rents out houses. All the live databases3 are located in the UK on their premises and we access those databases and servers ...
2
votes
2answers
744 views

What counts as material or non-material damage under the GDPR?

In Art. 82 GDPR: Right to compensation and liability it states: (1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the ...
2
votes
2answers
267 views

Is the GDPR applicable to data stored in human memory?

If data is stored in human memory, is the GDPR applicable? Say, an employee of a company remembers an email address of a client, their date of birth, or even what their face looks like, does the ...
2
votes
1answer
178 views

GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?

I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service. ...
2
votes
2answers
163 views

GDPR - A mobile App that allows user to store media do we have to option user consent?

Have a few doubts for GDPR law. If we are a mobile app, that allows user to store data inside our application like photos, videos and notes etc then do we have to get user content or anything related ...
2
votes
1answer
80 views

Does a community-made project using data from a games API need to adhere to GDPR?

I am part of the team on a popular website that provides users with overviews of their statistics for a particular game. Our data is gathered from a publicly available API and in order to provide our ...
2
votes
1answer
59 views

How does the gdpr apply to software houses/companies and call centres?

I would like to know how the gdpr applies to software companies/houses. What aspects or workings of software companies need gdpr compliance? And what is the sort of personal information they gather ...
2
votes
1answer
173 views

GDPR seeking consent - Subjects not responding to the consent email

We have currently sent out emails to gain consent from subjects to receive our marketing content. For subjects who don't respond, can we send another email chasing the consent? (i feel doing this can ...
2
votes
2answers
128 views

Does the EU GDPR apply to these types of natural persons?

Does the GDPR apply to a website operator who is a natural person (not a company or non-profit) and uses the website directly for commercial activity uses the website to advertise his/her other ...
2
votes
2answers
159 views

Can I force a website/service to delete my private data

I would like to wipe my online data clean and make sure the people deleted my account. Considering that most services only offer to "close" or "suspend" the account and not delete the data like skype ...
2
votes
0answers
51 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
2
votes
0answers
30 views

How to notify the use of cookies (Cookie Law Notice)

I have been investigating notifications about the use of cookies and a question has come up: Why 99.9% of websites do not report correctly about the use of cookies and nothing happens? With "...
2
votes
2answers
115 views

Is a website OK with GDPR if it is not permitting the users to delete their posts?

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. Is it against the right to erasure mentioned here ...
2
votes
0answers
63 views

Ebay - GDPR - Legality of re-assigning Data Controllers?

This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016. According to Article 27 (...
2
votes
1answer
53 views

GDPR - website with no cookies, no analytics, no private data collection

I'm building a website right now and I'm little bit concerned about GDPR and I hope you can help me out. So, the website will be a blog with posts, product reviews and some affiliate links, I plan to ...
2
votes
0answers
31 views

GDPR which practice is compliant?

I have seen many ways of requiring user acceptance of their data usage on the internet. Which are conforming? Keep in mind I am talking just about the consent acquiring mechanism. In order from the ...
2
votes
2answers
89 views

GDPR - Can I store domain names?

I create the code that everybody can download for free and use on their website (MIT licensed). In that code, I want to put the additional code sending requests to my server if the domain name is ...
2
votes
0answers
217 views

Explanations for GDPR if no personal data is collected?

I have a website that is a travel search engine and I am very concerned about GDPR. I am not interested in any private information from the users for marketing or such things. I just use Google ...
2
votes
3answers
114 views

I live outside of Europe. If I gain e-Residency in Estonia, will I be protected by GDPR regulations?

Are people who gain an Estonian e-Residency treated as a European citizen under upcoming GDPR regulations?
2
votes
0answers
75 views

Who is the data controller of users' data of a SaaS platform?

Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU. The B company uses the software to keep track of its customers, ...
2
votes
0answers
55 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
1
vote
2answers
56 views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
1
vote
1answer
24 views

What data processing requires opt-in consent for an existing customer under GDPR?

I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where ...
1
vote
1answer
84 views

Does data that is anonymized need to be collected in the event of a GDPR Subject Access Request?

Google Analytics anonymizes and aggregates all user data so it is not possible to look up an individual user. Does that mean that in the event that we use Google Analytics and receive a Subject ...
1
vote
2answers
2k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...