Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

0
votes
1answer
44 views

Identity of the controller (GDPR): can any website now ever be anonymous?

No matter whether a website collects personal data or not, it seems that a privacy policy is required anyway, and such a policy should contain (citing article 13 of the GDPR, first paragraph): (a) ...
0
votes
1answer
87 views

GDPR - is user social ID personal data

1) Is Google or Facebook user ID number considered personal data? The ID itself is just a number, but you can use it to construct a profile url and reveal his identity through Google or Facebook ...
0
votes
1answer
112 views

Hetzner is trying to charge me for Bandwidth overuse and will not respond when I use the contact form

A few months ago, I was using Hetzner Cloud for my VPS, and they blocked a server because someone seems to have DDoSed it. I requested it to be unblocked, and they ignored me. I also noticed they are ...
0
votes
3answers
102 views

GDPR for dummies: can I track anonymous data? can I track how many people accept / refuse my new cookie policy?

is it legal following the GDPR law, to track anonymous data without consent? I was reading many articles, but GDPR is so broad, there is so much information that receiving a simple answer as that, ...
0
votes
2answers
92 views

GDPR vs. Copyright for a recommendation letter

Spurred by a discussion on academia.se: suppose prof. X writes a letter of recommendation for her student mr. Y, and sends it to university Z through an on-line system. Then, the student mr. Y writes ...
0
votes
1answer
94 views

Autoresponders and GDPR - do they comply with the law?

Would it be GDPR compliant to have an autoresponder request opt-in permission? For example, a customer makes an enquiry by sending an email to the company in question. The company in question then ...
0
votes
1answer
174 views

Opt Out Consent under GDPR

I am having an Android App which uses certain service such as Analytics, Ad Networks. I am taking the consent from the user at when the app starts, i.e. before collecting any info. But there are ...
0
votes
1answer
23 views

GDPR: legal to combine (clickstreams) tracking and survey?

I am working on a website that collects clickstream data using Google Analytics. There is also a opti-layer. In the near future a survey to ask in which industry a visitor works shall be integrated, ...
0
votes
2answers
35 views

GDPR question about processing personal data for research purposes that yield aggregated results

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...
0
votes
2answers
73 views

Do I need permission to publish a FOI response in a blog post or open letter?

I recently submitted a FOI request to my local council, and had a response. Part of the response stated the following: You are free to use this information for your own use, including for non-...
0
votes
1answer
54 views

Locate me data obtained from european register

There is an entry on locatefamily.com that I know because it has certain details that were used on a European domain register in 2014. I an EU citizen living in the states. Does the GDPR apply to them ...
0
votes
2answers
46 views

GDPR: can we ask the building owner to share and/or destroy data about one's RFID activity?

this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways It seems most buildings store the activity of one's RFID key activity. ...
0
votes
1answer
55 views

GDPR: Can I do anything that touches a system with live customer data if I have no instructions at all

I have just become aware of this particular Article 29, which has one good side: it is short. The processor and any person acting under the authority of the controller or of the processor, who has ...
0
votes
1answer
125 views

GDPR: Can a website not process personal data?

I want to have a website where I publish my own articles. When a user requests a webpage, I receive an HTTP request from their browser, which contains the IP. Now, for a split second while the ...
0
votes
1answer
32 views

Data Portability in GDPR

I've reading: https://gdpr-info.eu/art-20-gdpr/ It says: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, ...
0
votes
1answer
53 views

Data Scraping public athlete name and performance data. Does this need to be treated as personal data?

Consider the following data for amateur/professional athletes: Athlete name, Athletic event + best performance data e.g.: Joe Bloggs 5k 19:00 10k 40:00 Half Marathon 85:00 other events etc... and ...
0
votes
1answer
45 views

Replication of user data a violation of GDPR

I'm in the planing staging of building game service provider, kind of like Xbox Live, PSN, Steam, etc. As far as I understand in the terms of the GDPR, information that can directly identify users ...
0
votes
1answer
89 views

Yahoo Messenger and the GDPR

Yahoo Messenger was was discontinued on December 1, 2018. On this date downloading of chat history was stopped. However they did not tell their users what happened to their data associated with Yahoo ...
0
votes
1answer
33 views

Does GDPR impose requirement for an EU based e-mail address?

Does GDPR impose requirement for an EU based e-mail address? I mean, not directly but indirectly for all practical purposes. Assume an EU based company having a public website. GDPR requires a ...
0
votes
1answer
164 views

What is “disclosure by transmission”?

Article 4(2) GDPR states: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as ...
0
votes
1answer
42 views

Modify a client file

After the setup of the GDPR law about personnal data security, I have a case I'm not sure about. Test case: I receive an addresses file from a client containing x lines of addresses with personnal ...
0
votes
1answer
53 views

How can GDPR affect user generated content?

I'm wondering where the lines of GDPR are in regard to user generated content and how it meets the Communications Decency Act. Section 230 has been what ISPs and websites (Yelp as an example) use as ...
0
votes
1answer
275 views

GDPR: cookie for login management

I use cookie in my site for login management. I user logs in the cookie dies with the sessione, if user flags "Keep me logged in" when logging in a long time cookie persists. In the long time cookie I ...
0
votes
1answer
44 views

How does GDPR affect a personal web application that uses third parties to authenticate?

I created a publicly accessible web application that allows me to remotely control the heating system in my home. The only data the app itself collects is logs of user activity (e.g.: logging when I ...
0
votes
1answer
44 views

GDPR - User invitation functionality within learning and development platform

There are similar answers to queries around this but I just wanted to introduce this scenario to get some advice. Company A provides pharmaceutical products to Company B Company B is a pharmacy ...
0
votes
1answer
22 views

What if I stored Personally identifiable information (PII) on cloud but with IP restricted environment or using VPN. Will it be GDPR compliance?

I have a requirement to fetch and search (partial search, full text search, fuzzy search etc) personally identifiable information (PII) data in Admin Panel and I can restrict my environment with IP ...
0
votes
1answer
179 views

GDPR: event registration form and email communications

I need to set up a registration form for an event in which the main communication channel between the registered users and the organizers is the e-mail. E-mails could be sent before, during and after ...
0
votes
1answer
58 views

For GDPR compliance, what documents or contracts need to contain a list of processors or sub-processors?

Should a complete list of processors or sub-processors be written anywhere for GDPR compliance? If so, who is required to do so? Controllers, processors, sub-processors? And where should the list be ...
0
votes
1answer
80 views

Do i have to disclose all processors to my controller? EU-GDPR

I'm working as a processor, we host and develop an online information portal (analysis) for customers of different controllers (all working in the same kind of buisness). The different controllers ...
0
votes
1answer
43 views

GDPR: Subscribing for advertisments using an email that a user does not own.

Is a company GDPR compliant if user A is able to subscribe for advertisments using an email of user B, if the company does not verify the ownership of the email and still send advertisments?
0
votes
1answer
70 views

Does the GDPR enforce an age restriction?

Many services limit the age of users in europe to 16+ bases on the GDPR. Does the GDPR really forces them to do this?
0
votes
1answer
475 views

Do aggregated personal data fall under GDPR personal data rules?

If I have statistics on users location data (i.e. city, country, etc.) aggregated from hundreds or thousands of users, are there any restrictions on storing and using these data under GDPR? I plan to ...
0
votes
1answer
88 views

GPDR Soft opt-in requirements for pre-GDPR customers

The UK ICO documentation on GDPR definition of legitimate interest says that emails/text messages to existing customers – obtained using ‘soft opt-in’ are allowed. From ICO Direct Marketing Guidance: ...
0
votes
1answer
62 views

Data Subject Rights under GDPR

I am having an Android App which uses Advertising networks and other Analytics services. Now under the GDPR the data controller which is me in my case is required to provide some rights to the user ...
0
votes
1answer
64 views

GDPR: Detecting duplicate accounts in online services with customer data

If I have a game or some other online service I host in which: It is forbidden for a subscriber to hold more than one account, OR Even if it is not forbidden, to detect one person on multiple ...
0
votes
1answer
62 views

GDPR Retention - Secondary Database

GDPR requires retaining personal data after a certain time period defined based on the following clauses: the current and future value of the information; the costs, risks and liabilities associated ...
0
votes
1answer
111 views

How does one exercise their GDPR related rights?

In May, GDPR will become effective and have a global impact on how personal data is handled. Article 20 of the GDPR requires complying systems provide Data Portability. If a European citizen was to ...
0
votes
1answer
199 views

Is an incentivized consent considered freely given in GDPR?

Let's say someone offers you 50 bucks if you opt-in to a consent; would that consent be still considered freely given in the eyes of GDPR (General Data Protection Regulation)? My understanding is ...
0
votes
1answer
55 views

Store browser width / screen size and browser type without user consent?

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design ...
0
votes
1answer
33 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
0
votes
1answer
46 views

Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
0
votes
0answers
27 views

Single sign on via cookies and GDPR compliance?

Going to call my two sites "identity provider" and "WordPress site". Flow is: User logs in on identity provider User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token ...
0
votes
2answers
60 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
0
votes
0answers
31 views

How does GDPR apply for normal email communication?

I am a member in an association and in charge of membership management and general IT. We exchange information about the work of the association by email using private mailing lists the association ...
0
votes
0answers
14 views

GDPR the other way arround [duplicate]

Let's say that there is a site with a list of people that did one thing. Once with GDPR rules, those people can ask to be removed from that site. I was wondering if that site changes the way it makes ...
0
votes
0answers
12 views

Do you have to provide information about processing personal data for contact persons?

Two companies write a legal agreement between themselves and contain contact details of their representatives in its content. Assuming that these contact details are personal data, are these companies ...
0
votes
0answers
17 views

Does sending email with personal data require agreement with email provider under GDPR? [duplicate]

It's common practice to allow users of your service to get email notifications about interesting events. For example user Joe subscribes to notifications to email address joe@emailprovider.com about ...
0
votes
0answers
24 views

Cause of action for data processor where the data controller neglects to notify supervisory authority

By reading the GDPR I have gathered that a data processor is obligated to notify the data controller of a breach within 72 hours and the data controller is likewise obligated to notify the supervisory ...
0
votes
0answers
29 views

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer ? Is above fundamental right's affected by Clauses in temporary employment contract like '...
0
votes
1answer
47 views

Emails from clients and GDPR

I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the ...