Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
3
votes
2answers
952 views

What counts as material or non-material damage under the GDPR?

In Art. 82 GDPR: Right to compensation and liability it states: (1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the ...
3
votes
2answers
119 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
3
votes
3answers
1k views

GDPR: Citizens with Dual Nationality?

Do the GDPR Regulations apply to processing data of a citizen who has dual nationality?
3
votes
0answers
42 views

What happens to SARs recieved before the 25th May?

With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May. However, in ...
2
votes
4answers
295 views

Is it possible to refuse offering service to GDPR-protected customers?

Let's say I have a service that asks registration details from the user and for some reason I, as a provider of that service, can't comply to GDPR and therefore want to refuse registration of new ...
2
votes
4answers
180 views

GDPR - Is consent really necessary for contact form?

I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer. The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
2
votes
2answers
53 views

Is accepting to receive emails as part of user terms legal in GDPR?

If I run a webshop selling DVDs, could I put in my user terms (that you have to accept to register) that I will be sending you emails about other movies on a regular interval. Would this qualify as ...
2
votes
2answers
58 views

Under GDPR, are service operators allowed to record all clicks of logged in users?

Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either: The user consents to having ...
2
votes
1answer
34 views

Does GDPR affect personal projects with family data?

My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a ...
2
votes
2answers
98 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
2
votes
1answer
51 views

What is “a place where Member State law applies by virtue of public international law”?

Art. 3 (3) GDPR mentions that: This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of ...
2
votes
1answer
47 views

GDPR data portability when no data stored

My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have ...
2
votes
1answer
56 views

Is it a violation of GDPR law to email personnel gathered from hunter.io?

I'm a web developer working on a project for a client. The project is a directory of sustainable companies (enviromental-friendly companies). The project is only launching now. The companies listed ...
2
votes
1answer
60 views

GDPR Requiring consent to give up privacy

A website that I visited posted the following: “YOUR PRIVACY IS IMPORTANT TO US. New regulations in your country require you to agree to our terms of use agreement and privacy policy before you can ...
2
votes
1answer
223 views

Does a user have the right to request their forum posts deleted?

Forum posts and similar stuff: chat messages from chatlogs, etc. According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered ...
2
votes
2answers
486 views

Do I have the right to ask Github to hide my Contribution activity according to General Data Protection Regulation (GDPR)

Do I have the right to ask Github to hide my "Contribution activity" on my public profile page?
2
votes
2answers
242 views

GDPR - first party analytics cookies

Does the first-party issued cookie, under control of, and only accessible by the first party requires visitor consent? Given the conditions bellow: Cookie is used to uniquely identify anonymous ...
2
votes
2answers
336 views

GDPR privacy policy - Data controller vs Data processor

I'm wondering if someone can shed some light on this for me please and help distinguish the differences between what I need to mention In my privacy policy for a data controller and data processor. ...
2
votes
1answer
3k views

Under the GDPR, should transaction data be deleted on account deletion or on user request?

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted? Or if the user can buy ...
2
votes
1answer
65 views

Can liability for data disclosure be waived by T&Cs under GDPR?

I live in Ireland, an EU county subject to the GDPR. I see in a service T&Cs the line: "Despite our use of commercially reasonable efforts to protect your Personal Information from ...
2
votes
2answers
58 views

Is it allowed to collect additional personal data to comply with the information obligation (Article 14 GDPR)?

True story. A bank erroneously sends its clients' data to a company: name, surname, national identification number. The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and ...
2
votes
1answer
79 views

Can DPO do an internal audit of information security according to ISO 27001?

In one company, due to GDPR, a DPO was designated, who was later given additional role and a new task: to conduct an internal audit of information security according to ISO 27001. Is there a conflict ...
2
votes
1answer
109 views

Can't GDPR compliance be trivially bypassed?

For large tech firms such as Facebook, at least, wouldn't it be a trivial matter for these companies to avoid EU GDPR compliance altogether? Many big companies don't actually "sell" any tangible ...
2
votes
1answer
333 views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
2
votes
1answer
99 views

Does my Personal Web App need to comply to GDPR?

I am building an app where I have some concerns about GDPR and user data. First of all this is a personal app, no company behind. What the app does: Allows a user to authenticate via e.g. ...
2
votes
1answer
58 views

Can a user request the deletion of their IP address that is stored for moderation purposes?

An Internet forum logs their users' IP addresses for moderation purposes (fighting abusive sockpuppetry, temporary banning a dynamic IP address range in case of a spam attack, permanently banning ...
2
votes
1answer
294 views

Cookie compliance with GDPR when cookies don't collect the PII?

We are using Google Analytics and Facebook Login button (Which comes with preset Facebook Analytics). So here is the question with Google Analytics we are not assigning users with GA UserID and IP ...
2
votes
1answer
85 views

GDPR, email lists, a few email subscribers in the EU

Situation: Say you are an organization that regularly sends out e-newsletter updates to an email list that has been curated over the years by people signing up at events and/or through online sign-up ...
2
votes
1answer
74 views

Using Personal data before consent

I am having an Android App which is going to use some services such as Google Analytics, Firebase etc. I have a thought of having two different consent screens for different region user such as EU ...
2
votes
1answer
69 views

GDPR and online forms: how to prove that the data owner opted in?

How can the data processor who collect personal information using an online form prove that the person who entered her data gave active consent, for instance by clicking a checkmark? Imagine a a ...
2
votes
1answer
32 views

Data processing locations post-Brexit

I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients. I have several UK-based clients, all ...
2
votes
1answer
42 views

Can you request your personal data from a government agency under GDPR?

Can you address a request to a government agency (let's say for example the French "Ministry of education") to access the data they store about you under GDPR ? Does GDPR requirements apply to states ...
2
votes
1answer
49 views

Legal sending personal information to a third party if the user supplied incorrect contact information?

To clarify the title, here is an example: Alice wants to sign up to online store Nile.com Alice enters the email bob@mailprovider.com by accident Nile.com does not send a verification that Alice has ...
2
votes
1answer
50 views

GDPR Requirements for restricted use corporate webapp [closed]

The GDPR is very complicated, and while its requirements may be crystal clear to those who are intimately familiar with it, it is not at all clear to most as to what the exact requirements are in all ...
2
votes
1answer
69 views

Do Bitcoin nodes need consent to store EU citizen's personal data?

The Bitcoin blockchain stores data about bitcoin users. This includes: There bitcoin address, which is linkable to their identity via blockchain analysis Transactions they have made This would seem ...
2
votes
1answer
101 views

My email has been shared with other parties

I am in the process of searching for a new job and I have applied for a few. Today I received an email from HR representative of one of the companies saying that I was not called for an interview ...
2
votes
1answer
45 views

GDPR and Storing Non-EU Citizen Data as an EU-based company

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
2
votes
1answer
125 views

GDPR - What exactly should I do to prevent revenue loss?

I've seen many sites blocking cookies right away and expecting users to click the "Accept cookies" button to activate them. But then I came to stack exchange to ask this question and there's a note on ...
2
votes
2answers
51 views

GDPR and two-party communications

If a chat or email provider wishes to analyze the contents of what their customers are writing, does GDPR require it to obtain the consent of everyone involved in the chat/email? Or would the consent ...
2
votes
1answer
93 views

Advice sought regarding GDPR and managing sensitive data

We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server. There are files that are ...
2
votes
1answer
51 views

GDPR: Applied Security vs Employee Contracts

An Organisation has 10,000 employees. All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation. Only 200 employees require access to the PII data for the ...
2
votes
2answers
60 views

Under GDPR, Is a Hashed URL Enough to Protect Customer Data?

Does a hashed URL (sent via email) provide enough security to safeguard customer data? For example, if we publish our customer data online with a hashed URL that we send to the customer (in other ...
2
votes
2answers
72 views

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)?

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)? For example, on Stack Exchange, do the questions, answers, comments, messages and ...
2
votes
2answers
122 views

Is a website OK with GDPR if it is not permitting the users to delete their posts?

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. Is it against the right to erasure mentioned here ...
2
votes
1answer
56 views

GDPR and locked content, legal or not?

We are at the point where we want to launch a web application. The application requires the visitor to create a free account to explore the website. So already at the beginning, they need to create ...
2
votes
1answer
79 views

Can a company charge a fee for erasure under GDPR?

Suppose a company has a mailing list to reach out to potential customers. They send both physical and electronic mail. One EU-based potential customer does not want to receive mail anymore and ...
2
votes
1answer
86 views

Can I ask my employer for details held about me?

A company runs a transformation exercise. It asked for employees to fill out answers against questions, which are submitted to a portal and assessed by a number of employees and scored. These scores, ...
2
votes
1answer
68 views

GDPR and Homebrew analytics

Homebrew is collecting anonymous GA analytics by default. User have this information during installation of this package manager. To opt-out you need go to the web page and choise a way to opt-out (...
2
votes
1answer
102 views

Using GDPR against cold-call marketing emails

I recently received a "cold-call" email from a salesman to my professional email address, which is in the form firstname.lastname@company.com. The firstname is a very formal version unlikely to be ...
2
votes
1answer
112 views

Under GDPR, is an image of a person's face a “Special Category Data”?

I'm triyng to understand whether, under European GDPR, an image of a person's face is a "Special Category Data". From this image I could determine person's: ethnic origin (for example: from the ...