Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

1
vote
1answer
84 views

Does data that is anonymized need to be collected in the event of a GDPR Subject Access Request?

Google Analytics anonymizes and aggregates all user data so it is not possible to look up an individual user. Does that mean that in the event that we use Google Analytics and receive a Subject ...
1
vote
2answers
2k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
1
vote
2answers
48 views

Does CNNs cookie consent banner comply with the GDPR?

I just got done reading this cookie consent material and it says that we need to keep a record of cookie consent. It also says that the notification needs to allows users to opt in and out of ...
1
vote
1answer
39 views

What are the types of personal data?

In the GDPR, the concept of data categories is used and examples of such categories are given. The concept of data types is also used, but I do not know what they are. Example of data categories, ...
1
vote
1answer
119 views

Does a user have the right to request their forum posts deleted?

Forum posts and similar stuff: chat messages from chatlogs, etc. According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered ...
1
vote
1answer
111 views

GDPR, is scrolling the page can mean cookie acceptance?

For example take a look at https://www.cookiebot.com/ as soon as you scroll down a bit, the consenting options fades away, and it puts a cookie in your browser, that you accepted their cookies. Is ...
1
vote
1answer
53 views

Swedish Government and GDPR

Given that the nordics are one of the most transparent societies, is there any scope that these governments may be in breach of GDPR, for example with respect to default disclosure positions on things ...
1
vote
1answer
76 views

What does Recital 13 in GDPR make exempt?

I read through Recital 13 in GDPR and it states To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations ...
1
vote
2answers
122 views

Handling a GDPR subject access request when using google analytics?

When using Google Analytics and receiving a GDPR subject access request does the party receiving the request also have to send all data collected by Google Analytics?
1
vote
1answer
171 views

Do data privacy requirements apply to watch lists and sanctions lists?

There are different sanctions lists and watch lists all over the world maintained by governments & ministries, like well-known ones: OFAC lists, EU Consolidated Sanctions, CIA & FBI watch ...
1
vote
1answer
37 views

Required data entry seemingly against GDPR

From https://security.stackexchange.com/questions/186327/why-do-some-gdpr-emails-require-me-to-opt-out-and-some-to-opt-in : As a consequence the "G29", the group of national data protection ...
1
vote
2answers
101 views

Can anonymized data be collected under GDPR without consent?

I am having an Android App in which I want to track the usage of the app. But the usage will not have anyone identity for eg. I would collect one user used my app for around 10 minutes but who is that ...
1
vote
1answer
24 views

Copy of ID card: blacken / hide fields that are not relevant (Switzerland)

In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht. In article there is written that ...
1
vote
1answer
33 views

GDPR and collecting politician's social media posts

I am interested in collecting tweets and social media posts from politicians in the USA. Specifically from their political social media accounts. After reading this finextra article, I believe this ...
1
vote
2answers
47 views

If we anonymize Google Analytics IPs do we still need to ask for Cookie consent? [duplicate]

Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent? If so ...
1
vote
1answer
20 views

Handling medical data received from outside the EU

If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU? In particular, does ...
1
vote
1answer
17 views

GDPR and date of fields creation / update

Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields : client_id name first_name and that I want to be GPDR Complient does I ...
1
vote
1answer
49 views

Does allowing users to see user tracking on my analytics software violate GDPR?

I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard: However, you can click on a user ID (right) like abaer and see ...
1
vote
1answer
40 views

Do you have to provide the name and email address of your data protection officer?

Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them: You can contact Valve's data protection officer at the address below. While we ...
1
vote
1answer
21 views

GDPR collecting vs storing

I have a website that stores no personal data, however it does use ($_SERVER['REMOTE_ADDR']), a code that scans the IP address of visitors, but the IP address isn't stored anywhere. It's only scanned ...
1
vote
1answer
43 views

The case of creating personal data by combining non-personal data

In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
1
vote
1answer
18 views

Is information only about financial transactions personally identifiable in terms of GDPR?

I am creating application where you can manage your incomes/expenses e.g. on eBay. Main functionality is: create new item and specify price you've payed to get it set price that you've All other ...
1
vote
1answer
85 views

In the EU, with GDPR in force, can a company refuse service if a customer doesn't want marketing emails?

I am having an argument with a local discount airline in the EU: They have been sending 3 up-sell emails for a single flight. Under GDPR, it is my right to revoke any consent to receive marketing ...
1
vote
1answer
37 views

Does a website owner (data controller) have to disclose its data processors in its privacy policy?

A website owner is data controller. Most website owners are using web hosting companies, i.e. data processors. Each website owner must have a GDPR compliant privacy policy. Must each website owner ...
1
vote
1answer
47 views

GDPR: Do I have to mention MailChimp in the privacy policy of a website if the registration form is only linked?

If I use MailChimp to send out newsletters and on my website I link to the registration form hosted on the MailChimp server, but don't embed it, do I need a MailChimp section in the privacy policy of ...
1
vote
1answer
61 views

Can background screening companies be forced to remove stored personal data under GDPR?

I understand that a background screening company requires a certain set of personal data to deliver a service. One typically consents for this data to be processed when completing associated paperwork....
1
vote
1answer
96 views

Facebook blocked my account until I consent to their new privacy policy under GDPR. If I consent now, will I be able to withdraw my consent later?

I am going to delete my Facebook account in a month, I can't do it now because I still use it for work. I live in the EU and Facebook has blocked access to my account unless I accept their privacy ...
1
vote
2answers
57 views

Description of 3rd party cookies in the privacy policy for GDPR compliance?

In order to comply with GDPR's right to be informed section, some sites try to describe what specific cookies that 3rd parties supply do. Is it OK to just list what cookies these parties set, and ...
1
vote
1answer
277 views

What's the difference between “GDPR” “Privacy Shield” and “Safe Harbor”?

I'm getting confused on the differences between "GDPR", "Privacy Shield", and "Safe Harbor". Can someone please elaborate? I think Privacy Shield replaces "Safe Harbor" but I still don't understand ...
1
vote
1answer
107 views

In GDPR, who exactly are the processors and what do they have to do?

I thought the processor was just someone who processes all personal data on behalf of the controller, basically a simple substitute for some matters. But from what I read online it seems that a ...
1
vote
1answer
59 views

European nexus into U.S. through Google product?

I'm in the U.S. with my websites. I'm not under European Union jurisdiction unless my use of one or another Google product puts me under EU jurisdiction. I need to find out if any Google product gives ...
1
vote
1answer
101 views

Does GDPR apply to announcement/technical emails?

I work on a SaaS website offering both free, and paid subscriptions to B2C customers. On it, I collect statistics, and emails(subscribed and double-opt-in users only) As far as newsletters and ...
1
vote
2answers
122 views

GDPR: what can I record about website visitors?

My use case is very simple. I have a website, on which I have articles that I wrote. It behooves me to learn about the people who visit my site so that I know what articles are popular and why, mainly....
1
vote
1answer
288 views

GDPR and local data storage in mobile app

Let's say that I have a mobile app that tracks the user and saves his GPS coordinates locally only on a mobile device so that he can check where he was. The mobile application does not send this data ...
1
vote
2answers
73 views

Can my user agreement require end users to indemnify me for misuse of their data by third-party services embedded in my app?

I have an Android App which is already in the Play Store. Now due to GDPR I am planning to improve my Privacy Policy and a Terms of service. I am planning to add certain terms in my Terms of service ...
1
vote
3answers
10k views

Will the GDPR apply to small hobby clubs?

When it comes into force, how will the General Data Protection Regulation affect small hobbyist organisations? Will it apply to, for example, student societies that are holding lists of email ...
1
vote
1answer
37 views

Does the GDPR mandate that web sites provide access to cookie settings?

Cross referenced this question with SO just to get more technical perspective In this article it says with respect to: Google Analytics and GDPR consent to cookies and tracking: Based on a true ...
1
vote
1answer
54 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
1
vote
1answer
47 views

Users counting and GDPR

Do I need a GDPR "coockie" banner if I implement not a unique identifier but only a naive counter? My web app check a key presence in local storage. Key is the same for all. If it's not found - call /...
1
vote
2answers
98 views

Is it legal to ignore “Do Not Track” for data subjects who fall under the GDPR?

The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different ...
1
vote
1answer
51 views

Do I need an active consent according to GDPR? [duplicate]

If I have a form on a website where people fill in their personal details and credit card information to subscribe to a monthly delivery of apples, do I need an active consent (e.g. checkbox) from the ...
1
vote
1answer
22 views

Responsible GDPR data protection authority (DPA) responsible for non-EU companies?

Article 15 EU GDPR is often cited as basis of what needs to be included in privacy policy. The data subject shall have the right to obtain from the controller confirmation as to whether or not ...
1
vote
1answer
27 views

Can a data subject be asked to share a limited part of their data if it would be in their interest to do so?

I am an adviser for a UK agency that provides free advice to the public. I have two employment cases that differ in detail, but are fundamentally the same issues and involve the same company. It could ...
1
vote
1answer
72 views

GDPR: How to respond to clinicians who ask for subject access requests for results to be made in writing

During a hospital stay, when requesting a copy of blood test results from doctors or nurses, unfortunately patients are often met with the response "Your request must be made in writing and must be ...
1
vote
1answer
53 views

Can GDPR violations lead to piercing of the corporate veil?

Does GDPR have any clauses that hint at piercing of the corporate veil? Can GDPR violations lead to piercing of the corporate veil?
1
vote
1answer
37 views

Fee for Subject Access Request to GCHQ, Data Protection Act 2018

When making a Subject Access Request to GCHQ I was told that I would have to pay a fee for this Request. The GDPR does not allow for such a fee, while the UK Data Protection Act does(Part 4 – Chapter ...
1
vote
1answer
86 views

Does the process of anonymizing web server logs count as 'Processing' under GDPR?

As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. I am looking to implement a log anonymization ...
1
vote
2answers
79 views

Deliberately inaccurate data

The GDPR seem to assume that the client would want us to maintain accurate data. Article 5(1)(d) makes it clear we have to correct inaccurate data. But I deliver pizzas for a big chain, and I ...
1
vote
1answer
48 views

GDPR Article 13.4 - how do you know that the data subject already has the information?

Article 13.1 states: Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject ...
1
vote
1answer
83 views

Does the GDPR law apply to my hobby-site?

I'm the owner of a website that maintains statistics about crew-members of an other site. The statistics about the crew-members are as follows: Username (on that other website) User ID (on that other ...