Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
2
votes
0answers
54 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
2
votes
0answers
40 views

How to notify the use of cookies (Cookie Law Notice)

I have been investigating notifications about the use of cookies and a question has come up: Why 99.9% of websites do not report correctly about the use of cookies and nothing happens? With "...
2
votes
2answers
120 views

Is a website OK with GDPR if it is not permitting the users to delete their posts?

Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. Is it against the right to erasure mentioned here ...
2
votes
0answers
70 views

Ebay - GDPR - Legality of re-assigning Data Controllers?

This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016. According to Article 27 (...
2
votes
1answer
60 views

GDPR - website with no cookies, no analytics, no private data collection

I'm building a website right now and I'm little bit concerned about GDPR and I hope you can help me out. So, the website will be a blog with posts, product reviews and some affiliate links, I plan to ...
2
votes
0answers
31 views

GDPR which practice is compliant?

I have seen many ways of requiring user acceptance of their data usage on the internet. Which are conforming? Keep in mind I am talking just about the consent acquiring mechanism. In order from the ...
2
votes
2answers
89 views

GDPR - Can I store domain names?

I create the code that everybody can download for free and use on their website (MIT licensed). In that code, I want to put the additional code sending requests to my server if the domain name is ...
2
votes
0answers
244 views

Explanations for GDPR if no personal data is collected?

I have a website that is a travel search engine and I am very concerned about GDPR. I am not interested in any private information from the users for marketing or such things. I just use Google ...
2
votes
3answers
120 views

I live outside of Europe. If I gain e-Residency in Estonia, will I be protected by GDPR regulations?

Are people who gain an Estonian e-Residency treated as a European citizen under upcoming GDPR regulations?
2
votes
0answers
88 views

GDPR and logging which user accessed which personal information

If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what ...
2
votes
0answers
75 views

Who is the data controller of users' data of a SaaS platform?

Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU. The B company uses the software to keep track of its customers, ...
2
votes
0answers
57 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
1
vote
2answers
83 views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
1
vote
1answer
66 views

Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications

I originally posted this on another Stack Exchange website but was advised this might be a better place for it. Original is here: https://security.stackexchange.com/questions/215300/is-it-ok-to-assume-...
1
vote
1answer
24 views

What data processing requires opt-in consent for an existing customer under GDPR?

I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where ...
1
vote
1answer
108 views

Does data that is anonymized need to be collected in the event of a GDPR Subject Access Request?

Google Analytics anonymizes and aggregates all user data so it is not possible to look up an individual user. Does that mean that in the event that we use Google Analytics and receive a Subject ...
1
vote
2answers
2k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
1
vote
3answers
39 views

Does GDPR apply to personal information entered in a password-field?

If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply? For example if someone enters their email, phone number or name in a password-field? If so, ...
1
vote
1answer
61 views

GDPR: Can I collect non-personally identifiable information?

I'm creating a game that collects data in two ways: Unity Analytics for usage stats, and bug reports that sends me a report of an issue along with several files to help me diagnose the issue. However, ...
1
vote
2answers
56 views

Does CNNs cookie consent banner comply with the GDPR?

I just got done reading this cookie consent material and it says that we need to keep a record of cookie consent. It also says that the notification needs to allows users to opt in and out of ...
1
vote
1answer
40 views

What are the types of personal data?

In the GDPR, the concept of data categories is used and examples of such categories are given. The concept of data types is also used, but I do not know what they are. Example of data categories, ...
1
vote
1answer
166 views

GDPR, is scrolling the page can mean cookie acceptance?

For example take a look at https://www.cookiebot.com/ as soon as you scroll down a bit, the consenting options fades away, and it puts a cookie in your browser, that you accepted their cookies. Is ...
1
vote
1answer
57 views

Swedish Government and GDPR

Given that the nordics are one of the most transparent societies, is there any scope that these governments may be in breach of GDPR, for example with respect to default disclosure positions on things ...
1
vote
1answer
83 views

What does Recital 13 in GDPR make exempt?

I read through Recital 13 in GDPR and it states To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations ...
1
vote
2answers
157 views

Handling a GDPR subject access request when using google analytics?

When using Google Analytics and receiving a GDPR subject access request does the party receiving the request also have to send all data collected by Google Analytics?
1
vote
1answer
205 views

Do data privacy requirements apply to watch lists and sanctions lists?

There are different sanctions lists and watch lists all over the world maintained by governments & ministries, like well-known ones: OFAC lists, EU Consolidated Sanctions, CIA & FBI watch ...
1
vote
1answer
37 views

Required data entry seemingly against GDPR

From https://security.stackexchange.com/questions/186327/why-do-some-gdpr-emails-require-me-to-opt-out-and-some-to-opt-in : As a consequence the "G29", the group of national data protection ...
1
vote
2answers
111 views

Can anonymized data be collected under GDPR without consent?

I am having an Android App in which I want to track the usage of the app. But the usage will not have anyone identity for eg. I would collect one user used my app for around 10 minutes but who is that ...
1
vote
2answers
98 views

Does GDPR's physical address rule apply to my real world hobby art group?

I run an art group (in the UK) that meets up every other month to give feedback on each others' work. To share the meeting dates and to share the work we're giving feedback on that month, I have an ...
1
vote
1answer
70 views

Is it illegal to state in your website that an employee of a company emailed you?

I have an open source project regarding software used in banking and I have received emails about it from employees working in top banks/consultancies. I am considering to mention this in the website,...
1
vote
1answer
27 views

Copy of ID card: blacken / hide fields that are not relevant (Switzerland)

In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht. In article there is written that ...
1
vote
1answer
36 views

GDPR and collecting politician's social media posts

I am interested in collecting tweets and social media posts from politicians in the USA. Specifically from their political social media accounts. After reading this finextra article, I believe this ...
1
vote
2answers
67 views

If we anonymize Google Analytics IPs do we still need to ask for Cookie consent? [duplicate]

Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent? If so ...
1
vote
1answer
22 views

Handling medical data received from outside the EU

If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU? In particular, does ...
1
vote
1answer
17 views

GDPR and date of fields creation / update

Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields : client_id name first_name and that I want to be GPDR Complient does I ...
1
vote
1answer
52 views

Does allowing users to see user tracking on my analytics software violate GDPR?

I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard: However, you can click on a user ID (right) like abaer and see ...
1
vote
1answer
43 views

Do you have to provide the name and email address of your data protection officer?

Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them: You can contact Valve's data protection officer at the address below. While we ...
1
vote
1answer
22 views

GDPR collecting vs storing

I have a website that stores no personal data, however it does use ($_SERVER['REMOTE_ADDR']), a code that scans the IP address of visitors, but the IP address isn't stored anywhere. It's only scanned ...
1
vote
1answer
45 views

The case of creating personal data by combining non-personal data

In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
1
vote
1answer
19 views

Is information only about financial transactions personally identifiable in terms of GDPR?

I am creating application where you can manage your incomes/expenses e.g. on eBay. Main functionality is: create new item and specify price you've payed to get it set price that you've All other ...
1
vote
1answer
100 views

In the EU, with GDPR in force, can a company refuse service if a customer doesn't want marketing emails?

I am having an argument with a local discount airline in the EU: They have been sending 3 up-sell emails for a single flight. Under GDPR, it is my right to revoke any consent to receive marketing ...
1
vote
1answer
49 views

Does a website owner (data controller) have to disclose its data processors in its privacy policy?

A website owner is data controller. Most website owners are using web hosting companies, i.e. data processors. Each website owner must have a GDPR compliant privacy policy. Must each website owner ...
1
vote
1answer
72 views

GDPR: Do I have to mention MailChimp in the privacy policy of a website if the registration form is only linked?

If I use MailChimp to send out newsletters and on my website I link to the registration form hosted on the MailChimp server, but don't embed it, do I need a MailChimp section in the privacy policy of ...
1
vote
1answer
61 views

Can background screening companies be forced to remove stored personal data under GDPR?

I understand that a background screening company requires a certain set of personal data to deliver a service. One typically consents for this data to be processed when completing associated paperwork....
1
vote
1answer
102 views

Facebook blocked my account until I consent to their new privacy policy under GDPR. If I consent now, will I be able to withdraw my consent later?

I am going to delete my Facebook account in a month, I can't do it now because I still use it for work. I live in the EU and Facebook has blocked access to my account unless I accept their privacy ...
1
vote
2answers
59 views

Description of 3rd party cookies in the privacy policy for GDPR compliance?

In order to comply with GDPR's right to be informed section, some sites try to describe what specific cookies that 3rd parties supply do. Is it OK to just list what cookies these parties set, and ...
1
vote
1answer
298 views

What's the difference between “GDPR” “Privacy Shield” and “Safe Harbor”?

I'm getting confused on the differences between "GDPR", "Privacy Shield", and "Safe Harbor". Can someone please elaborate? I think Privacy Shield replaces "Safe Harbor" but I still don't understand ...
1
vote
1answer
112 views

In GDPR, who exactly are the processors and what do they have to do?

I thought the processor was just someone who processes all personal data on behalf of the controller, basically a simple substitute for some matters. But from what I read online it seems that a ...
1
vote
1answer
60 views

European nexus into U.S. through Google product?

I'm in the U.S. with my websites. I'm not under European Union jurisdiction unless my use of one or another Google product puts me under EU jurisdiction. I need to find out if any Google product gives ...
1
vote
1answer
105 views

Does GDPR apply to announcement/technical emails?

I work on a SaaS website offering both free, and paid subscriptions to B2C customers. On it, I collect statistics, and emails(subscribed and double-opt-in users only) As far as newsletters and ...