Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1
vote
2answers
182 views

GDPR: if a user doesn't agree cookies on my banner, what must I do?

if a guest of my site click on "Not agree" on cookie banner, what must I do? Have I to disable all the cookies? Have I to disable all the cookies except technical cookies (eg. login session cookies)? ...
1
vote
1answer
49 views

Crawling a web forum and presenting the posts in a search

Is what this site is doing with steam community legal? https://www.steamtrades.com/ I assume that is a grey area, no? So what are the factors that would make it legal or not? I assume one should not ...
1
vote
1answer
141 views

Is it reasonable to ask me to change my email address after it was leaked?

My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later ...
1
vote
1answer
226 views

What is exactly a joint controller in GDPR? Examples

I am not sure I really understand the concept of "joint controllers" in GDPR, and I'd like to have some concrete examples, especially examples of joint controllers relating to the internet (websites, ...
1
vote
1answer
37 views

Who is the Controller and who is the Processor if Company X hosts/embeds content of Company Y

Let's say we have two companies "WeServe" and "OurContent" and the following relationships, who is the Controller and who is the Processor or are they Joint Controllers (Art. 26 GDPR) or is there ...
1
vote
1answer
83 views

How to fulfill the General Data Protection Regulation (GDPR) when receiving emails

Suppose, a scientist is planning to publish a paper, and his email address will be printed on it. I'm wondering, if the European General Data Protection Regulation would be relevant in that case. ...
1
vote
1answer
196 views

Is it legal for me to use publicly accessible user data about a person on my website?

I run a wiki service and I was wondering if someone doxes an anonymous person in the from of a dump (pastebin, screenshots, recordings etc), can we keep that data or perhaps cite it? For instance if ...
1
vote
1answer
320 views

google analytics cookie consent with anonymized ip on

I am not even sure how is this possible, so here I am. I have google analytics with anonymized IP on, my users can activate and deactivate google analytics cookies at any time. BUT, on top of that, ...
1
vote
2answers
445 views

What does “monitor the behavior of individuals in the EU” mean?

https://www.truevault.com/blog/do-i-need-to-be-gdpr-compliant.html GDPR was created by the European Union to protect its citizens, and so it only affects organizations with some kind of ...
1
vote
1answer
96 views

Allow people to communicate on an international religious non-commercial website without getting into trouble with GDPR

This question seems related to this one. The new European "GDPR" ("General Data Protection Regulation") laws are confusing to me. One can read everywhere that these will apply everywhere, not only ...
1
vote
2answers
558 views

Are Phone Number lists with no other personal data allowed under GDPR?

Given a phone number list stored in a format such as this: 02321 203201, 203120 023102, etc. Would this be classed as personally identifiable information under the new GDPR regulations or as there ...
1
vote
2answers
70 views

Is it possible, under the GDPR, to request publicly available information to be taken down from an aggregator?

In Sweden, there are many services available that collect publicly available personal information (such as telephone numbers, addresses, social security numbers, income, mortgages, registered cars) ...
1
vote
1answer
53 views

GDPR - If am am allowing user to post on twitter and Facebook from my IOS app?

If am allowing user to post on twitter and Facebook from my IOS app, Do I have to get user consent ? If yes what do I have to mention in user consent ?
1
vote
1answer
385 views

GDPR - Offshoring

We work for consulting company in India, call it Z. Z has a partnership with a European cards & transactions processing company Y. So the Indian consulting company Z does offshore production ...
1
vote
0answers
28 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
1
vote
1answer
62 views

does the GDPR apply to publicly available data?

There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little ...
1
vote
0answers
44 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
1
vote
0answers
56 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
1
vote
0answers
88 views

Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?

It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
1
vote
0answers
55 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
1
vote
0answers
43 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
1
vote
0answers
60 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
1
vote
1answer
53 views

GDPR article 20, portability of future data

Article 20.2 of the GDPR states: "In exercising his or her right to data portability [...], the data subject shall have the right to have the personal data transmitted directly from one controller to ...
1
vote
0answers
188 views

GDPR: How does Airbnb get away with their signup form?

We're looking at making our signup form GDPR friendly along with sending users more timely, personalised marketing and account update emails. Asking if a user wants to receive all these different ...
1
vote
1answer
71 views

Processing of genetic data: which are the required “technical and organisational measures”?

Several articles of the Regulation require to apply the “appropriate technical and organisational measures” or “appropriate safeguards” in order to ensure the security of data. While GDPR ...
1
vote
1answer
116 views

GDPR - Recording simple page views

We are currently using google analytics to track our site. The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the ...
1
vote
0answers
51 views

Derogation for small companies in GDPR

Question What does Recital 13 in GDPR make exempt? refers to Article 30 on the technical definition on record keeping. But I am interested in another aspect of this sentence: To take account of ...
1
vote
1answer
178 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
1
vote
1answer
321 views

GDPR and Query String Variables

I have a project where a customised email is sent out to clients and there is a link that takes them to a landing page, with a form, that currently gets populated by way of query string variables e.g. ...
1
vote
0answers
61 views

Russian bank calling Russian citizen who is tourist in EU - GDPR issues

Let's say I'm Russian citizen (no dual citizenship) and on a tourist visa in the EU. I got a call on my roaming Russian mobile phone number from a Russian bank who tries to offer me a new product. I'm ...
1
vote
0answers
285 views

Offering GDPR privacy policy for voice mail?

Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
1
vote
0answers
168 views

Under GDPR Data Processing Officer's email address bounces - what to do?

In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts. So I had sent ...
1
vote
1answer
200 views

Is it still legal to include an invitation based service in a program after GDPR?

I just started a cross-platform mobile application within users could invite other people to join as new users. The invitation would require the existing user to enter the new user's name (not ...
1
vote
1answer
341 views

Parent company GDPR compliance

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
1
vote
0answers
55 views

How does GDPR affect me if I am processing 3rd Party Data for My IOS App?

We are updating our app based on GDPR and as per GDPR, the user has Right to Access data anytime. In My IOS App we are using FitBit's Data after taking User Consent. Now my question is: When the ...
1
vote
0answers
168 views

Can a developer have access to live data within GDPR?

Segregation of Duties in IT I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
1
vote
0answers
485 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
1
vote
0answers
70 views

Are data processors allowed to locally store live customer information for testing GDPR

We develop software for another company and use their live data to test our applications locally before they go live. This means we keep live customer information on office computers. Will this be ...
1
vote
1answer
96 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
1
vote
2answers
111 views

Is GDPR really needed if my android app doesn't collect any personal data?

I have developed some Android applications, and they don't store any personal data, but they do some calculation about some input, for example the annual salary provided by user and return to him a ...
1
vote
4answers
164 views

How often does a website have to ask for cookie consent?

I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or ...
1
vote
1answer
62 views

to be in photo and video, and right to ask for removal these data relying on GDPR

At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs. Now, I want my pictures to be erased, or any data, ...
0
votes
2answers
78 views

Do companies have the right to demand proof of being present in the EU before executing a GDPR request?

Under the GDPR, any company doing business in the EU must remove EU users' personal data upon request from that user. Since the statute only applies to persons present in the EU, are companies ...
0
votes
2answers
38 views

GDPR Information and consent

I am building a game that stores score/level on the local device and uses non-personalized AdMob. Do I need to inform the user about storing the score locally? Do I need consent for using non-...
0
votes
1answer
55 views

How much can the GDPR be amended by EU member states in their national laws?

Citing article 8 of the GDPR (emphasis added): Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the ...
0
votes
3answers
93 views

Is this information considered personal?

Imagine a UK-based company made an application to order food from restaurants. The company decided to share the following information with the restaurants to summarize orders made restaurant location ...
0
votes
1answer
68 views

Is it legal to collect reviews/ratings about people and show it on website?

There are websites which show reviews, ratings, scores about companies (restaurants, hotels, etc.). For example, I create a website which would collect similar data about concrete persons. Could a ...
0
votes
2answers
105 views

GDPR - Confirm company terms and conditions by button click

This May the General Data Protection Regulation (GDPR) will be applied across the EU. I read somewhere that users have to always 'opt-in' after this law is effective. Since I'm concerned about ...
0
votes
1answer
36 views

GDPR on Proxy Users

I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc... My questions here are about the scope of GDPR. Does GDPR apply to people who: ...
0
votes
4answers
148 views

Data Protection Laws

Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/...