Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

60
votes
2answers
4k views

How does SE's arbitration clause hold up under the GDPR?

Today the new Terms of Service of Stack Exchange have been released, sparking a lot of unrest about its arbitration clause; see the comments and answers on the linked meta above, and also this ...
45
votes
2answers
6k views

Is requesting waiving the right to deletion of contributions against GDPR?

I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage: (For GitLab ...
32
votes
2answers
4k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
29
votes
4answers
8k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
20
votes
2answers
7k views

Can I request a copy of my password hash with GDPR?

People often use personal information to create them, like first name / date of birth, and people often reuse passwords across several sites, so I guess passwords are considered personal data since ...
14
votes
4answers
6k views

GDPR - reCAPTCHA with user's consent?

This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data. I was reading briefly about ePrivacy regulations ...
13
votes
3answers
2k views

Why can't I add a governing law to my terms of service to avoid GDPR?

I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
12
votes
4answers
597 views

What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
10
votes
1answer
848 views

Do cookie banners need to change for GDPR compliance?

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
10
votes
2answers
2k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
9
votes
1answer
1k views

Does GDPR cover the collection of data by websites that crawl the web and resell user data

I have found that a lot of my personal info is now available on a bunch of websites that collect data and resell it. I'm talking about those 'find anything about anyone' websites. A lot of the data ...
9
votes
2answers
4k views

How to satisfy GDPR's consent requirement for IP logging?

Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
9
votes
3answers
644 views

GDPR - Withdrawn user consent

I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent. The user gives his consent to use his data and ...
9
votes
2answers
2k views

Would GDPR affect my own personal website?

I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public. As I am the only person who is in charge (my personal site), would I have to oblige to ...
8
votes
3answers
573 views

Under GDPR, can I request to be forgotten and re-register for a trial?

Imagine an on-line service which offers 1 month of free trial for new users. Can I perpetually: register for the trial, use it for a month request my account deleted and my data forgotten repeat ?
8
votes
2answers
152 views

Does GDPR Prohibit Reading Unsolicited Emails?

I originally asked this question on Information Security and it was suggested it was a better fit over here. I'm a member of the management committee of an allotment society in the UK. The committee ...
8
votes
1answer
217 views

If I’ve no WhatsApp account am I still a node on their social graph? And if so can I request to be deleted?

I have never used WhatsApp so I have never shared my phone’s contacts with them or consented to their terms. Many of my friends and family do use WhatsApp and they will all have me in thier contacts ...
7
votes
4answers
1k views

GDPR: are faces always considered identifiable information?

Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
7
votes
2answers
2k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
7
votes
1answer
139 views

Deducing and using an email address under GDPR

I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this. The work email ...
7
votes
2answers
406 views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
7
votes
1answer
1k views

Are internet forum posts considered personal data under GDPR?

GDPR defines "personal data" as any information relating to an identified or identifiable natural person. ‘personal data’ means any information relating to an identified or identifiable natural ...
7
votes
1answer
154 views

Under GDPR right of access, do I have the right to receive a copy of scoring sheets / evaluation forms after a structured job interview?

Under the GDPR right of access, what rights do I have to employer assessment of myself in the role of a job applicant after a structured job interview? Presumably, in a structured job interview ...
7
votes
1answer
122 views

Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?

I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation. Anyway, if I ...
7
votes
1answer
74 views

Is it sufficient to provide a privacy policy only in english language?

Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language? Is a translation necessary for every country of the EU ...
7
votes
1answer
566 views

Legal aspects of Firebase Crashlytics SDK

Let's say we have a mobile app, where every user is associated with app-generated unique user id (ex. 57d2ef8b391277001aad7784). Having the uuid itself that's not possible to identify a user. ...
6
votes
1answer
917 views

Is it okay to store user locations?

I know it might sound quite bad. But here I explain the whole situation. I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
6
votes
2answers
755 views

Does vehicle information count as personal data?

Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation? How about the VIN? (Vehicle Identification Number)
6
votes
2answers
455 views

Are GDPR-Walls legal?

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information. I see two possible legal problems: GDPR forbids coupling of ...
6
votes
1answer
237 views

What did Flybe actually do wrong?

Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc. They sent an email to this ...
6
votes
2answers
197 views

If photos are PII under GDPR, how are most photos on the web legal?

It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal ...
6
votes
1answer
330 views

GDPR - Do I have to log user's IP after consent for a cookie?

Do I really have to log a user's IP address and a timestamp after they consent to a cookie? Log example: 20.05.2018 18:56:32 - 127.0.0.1 - Cookie accepted I don't even need (I'm not using it in any ...
6
votes
3answers
379 views

Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?

The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data: by a natural person in the course of a ...
6
votes
1answer
282 views

Is throw-away-the-key-encryption allowed under GDPR?

Article 15 of the GDPR says: The data subject shall have the right to obtain [...] personal data [if it is being "processed"] Article 4 says that "processing" includes storage. Therefore, all ...
6
votes
1answer
2k views

Are chat logs against the new european GDPR?

Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation? I know you can't save data which can be linked to a natural person ...
6
votes
3answers
520 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
6
votes
1answer
312 views

GDPR and deleting users from wiki changelogs

According to the GDPR §17, users have a right to request the deletion of personal data. I am wondering how this applies to wikis. In my case, when users edit a page, that edit is associated with ...
6
votes
1answer
363 views

Does GDPR Recital 15 exempt unstructured electronic data?

GDPR Recital 15 states that Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation. I ...
5
votes
1answer
629 views

GDPR Compliance: Do all Cookies require Opt-In?

Given a Web Site which uses cookies for the following: User Preferences Bookmarked Articles Cookie Preferences what explicit permissions would be required from the user? Here I anticipate the ...
5
votes
5answers
127 views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
5
votes
1answer
99 views

Company makes confidential CV publicly available and searchable. Legal recourse?

A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
5
votes
1answer
46 views

The circumvention of terms and conditions

There are sites, for example 'moodys.com', which require an explicit agreement to the terms and conditions on every vist (e.g. https://www.moodys.com/research/Moodys-affirms-Chang-Hwa-Commercial-Banks-...
5
votes
3answers
169 views

Is it illegal to intentionally design a social network that can't comply with right-to-be-forgotten (and possibly other laws)?

If I intentionally design (and program) a social network that uses a technology (blockchain,...) which does not allow for alteration / erasing of user data, what happens in case of a right-to-be-...
5
votes
1answer
207 views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
5
votes
3answers
624 views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
5
votes
2answers
247 views

GDPR with refusing medical information

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing ...
5
votes
1answer
277 views

Is Facebook's new cookie banner GDPR compliant?

Today I visited Facebook from a Google search to find the following cookie banner at the top of the page: To personalize content, tailor and measure ads, and provide a safer experience, we use ...
5
votes
1answer
92 views

Does GDPR affect individual contributor license agreements for opensource projects?

I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example Apache 2.0. The gathered information when ...
5
votes
1answer
381 views

Establishing GDPR consent when the person doesn't access a system themself

My company hosts an online database for organisations to manage training data for their people. In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. ...
5
votes
2answers
549 views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...