Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0
votes
1answer
40 views

Cookie opt-in required on paid-for web-based software-as-a-service application?

Context: We provide a paid-for web-based software-as-a-service application. This application requires users to register an account, and agree to our terms & conditions and privacy policy to be ...
2
votes
2answers
114 views

does the GDPR apply to publicly available data?

There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little ...
0
votes
0answers
17 views

Does my personal website GDPR compliant? [duplicate]

I made a basic chat website. Shows active users with nicknames or if not given nickname, random given name. There is no register or login I take users nickname and save it to cookies. Nickname can be ...
0
votes
0answers
31 views

How does the GDPR differ from national data protection law?

Before the GDPR came into effect, I had to deal with both the German Bundesdatenschutzgesetz and the Italian Codice in materia di dati personali, and recall them having very similar provisions (though ...
0
votes
0answers
12 views

Is a privacy policy required for storing user preferences?

I wanted to use localStorage (which I think technically counts as a cookie) to store a user's preferences in a simple web app. The stored data doesn't identify the user and is never sent to any sort ...
0
votes
0answers
15 views

Handling of names, emails, phone numbers and messages submitted through website forms under GDPR

I am developing a website for a one-man, Swedish, acupressure company. The site contains a contact form that requires the user to submit a name, email and message. It also contains a booking form that ...
4
votes
2answers
147 views

Do I have a “legitimate interest” under GDPR to not delete data my software needs to fulfil its function?

The GDPR gives users the right to have their stored data deleted. How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by ...
0
votes
2answers
146 views

Institution can access my email (inbox/sent items/etc) and edit it?

First of all, I have thoroughly read the answers to the following questions and none of them answer my queries: Can Google Chrome read/scan my ProtonMail inbox page? Can my IT department read my ...
-1
votes
0answers
37 views

Legal requirements to save videos [closed]

I am developing an app that provides added value to the user using its smartphone camera. We were wondering what requirements do we need to fulfill in order to start sending these videos to our cloud....
2
votes
1answer
207 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
2
votes
1answer
52 views

GDPR - does a unique device identifier count as personal data?

I'm planning to sell my software online. The payment process is handled by a reseller (FastSpring), so the personal data collected (like the buyer's name and e-Mail address) is never stored on my ...
1
vote
1answer
80 views

Is it possible to create data subject to the GDPR without any involvement by the person in question?

Say I email a colleague, in a professional capacity: I have been thinking about offering John Smith, who currently works at Big Corp, a job John Smith has had no involvement with my organisation. ...
2
votes
2answers
54 views

Process IP address without GDPR consent

We are trying to log the location of our visitors, without storing their actual IP address on our servers. To geolocate the IP address, we use an external service, to which we make an API request ...
24
votes
5answers
14k views

Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?

I have recently come across this part of an app from a well-known US company: Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of ...
1
vote
2answers
113 views

Do you have to provide the name and email address of your data protection officer?

Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them: You can contact Valve's data protection officer at the address below. While we ...
0
votes
2answers
74 views

What should I reply when someone ask about their GDPR information against a cold marketing email?

I recently received an email says "..please send me a GDPR information about all my data you have assigned to this email.." I collect the email address from a public domain (say GitHub) and ...
0
votes
1answer
19 views

GDPR & CCPA compliance involving terms of service violation

If a user writes a comment on a website that gets flagged and removed+archived are we still obligated to delete the user content and/or the association of that comment with the person? According to ...
1
vote
0answers
32 views

Company acquired a website with existing users. Is GDPR announcement obligatory?

When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
7
votes
2answers
1k views

Would a business that has no office in EU still have to worry about GDPR, and if so, why?

This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR. Although opportunistic lawsuits against US-based businesses on their ...
0
votes
0answers
44 views

Is WhatsApp legally obligated to remove my chat on every device, based on the GDPR? [duplicate]

Dear Law StackExchange community, I'm attempting to get chat history removed with another party dating back a long time ago. I don't want the chats to remain existent on any device whatsoever, so I ...
3
votes
2answers
116 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
0
votes
1answer
42 views

Does GDPR disclosure apply to European citizen temporarily in United States?

For some background: the EU "[Data Protection Directive][1]" is a European Union directive which regulates the processing of personal data within the European Union, as explained in [this Wikipedia ...
0
votes
1answer
43 views

Which EU-related jurisdictions in Americas apply the GDPR regulation?

According to some information, a person will need to be a resident in an EU country in order to be protected by the GDPR regulation. Are there jurisdictions in North or South America where residency ...
1
vote
1answer
399 views

Parent company GDPR compliance

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
0
votes
1answer
141 views

Right to be forgotten in US legal system. Practical approach for erasure?

As it commonly known, the right to be forgotten is a fundamental right in the modern informational society. It is the right of an individual to obtain erasure of his personal data from the online and ...
0
votes
0answers
35 views

Data Privacy: Should a user be allowed to change another users profile information?

In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)? What laws (US & EU) would give guidance either way? ...
1
vote
1answer
64 views

GDPR dilemma: Does a full name contained in a URL constitute PII as stated by Google Analytics?

But wait, it gets better: This full name belongs to person who was interviewed in an article under this URL. https://support.google.com/analytics/answer/7686480?hl=en What Google considers PII: ......
1
vote
1answer
128 views

GDPR - Recording simple page views

We are currently using google analytics to track our site. The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the ...
0
votes
1answer
126 views

GDPR and a cell phone paid through work?

Company Contacts page From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B. For instance my private email is regulated by GDPR, but my work ...
-1
votes
1answer
73 views

My hashed IPV4 was published by an administrator on an anonymous imageboard (EU country)

some days ago it on an anonymous imageboard it was opened by an administrator a thread with a .png showing all my posts on that website, and each posts had my hashed ipv4 attached to it. Since i ...
0
votes
2answers
79 views

Is it illegal to NOT store logs within the UK? (VPN related)

Introduction: I co-run a VPN company. I have a few legal questions since our service has a strict NO-LOG policy enforced. Question: In the UK, it is illegal to store sensitive and private customer ...
3
votes
1answer
119 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
2
votes
1answer
129 views

A website is refusing or failing to remove personal data I've requested removed: is this against GRPR?

I have been a member of a website for 13 years and would like all of my old posts removed. I have contacted their support team however the experience has been dreadful: it look a lot of back and ...
4
votes
1answer
82 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
1
vote
1answer
36 views

Can someone enlighten me about the main task of the independent supervision of data protection law

So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
1
vote
1answer
61 views

User-solicited personal information beyond consent

What does the GDPR say about personal information provided by a user about themselves, in the case that the service sign-up process and ToS have always asked of the users not to provide personal ...
1
vote
1answer
437 views

GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?

I'm wondering if anyone can shed any light on this for me please. I've been doing alot of research about GDPR lately and how it is going to effect my websites using Google Analytics. From what I can ...
0
votes
1answer
51 views

Which Cookies require consent for GDPR

I use a number of different cookies on my website for tracking and saving preference. I'm very confused about which can and cannot be set with and without consent under GDPR I'm certain I need ...
0
votes
1answer
49 views

Hiding order invoice information, GDPR

I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like: Name Surname ...
4
votes
1answer
76 views

Do I have to send one of those emails after updating my privacy policy for GDPR?

We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?...
1
vote
1answer
58 views

GDPR in a scientific, transborder scenario

Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole ...
1
vote
2answers
47 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
2
votes
3answers
117 views

What an employer can legally ask to monitor about user activity

I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's ...
0
votes
2answers
57 views

Is anonymous analytics data subject to GDPR?

I am reading the definition of "personal data" here https://gdpr-info.eu/issues/personal-data/. My understanding is that GDPR comes into play when information is about personal data. Let's say there ...
11
votes
3answers
4k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
0
votes
2answers
66 views

GDPR compliance in ads SDK for iOS/Android

I have opened this question in SO, but was suggested to ask here, as the solution might come from a lawyer, rather than developer. I work on a native ads SDK for iOS/Android (banner, interstitial, ...
0
votes
1answer
85 views

Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
2
votes
4answers
293 views

How often does a website have to ask for cookie consent?

I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or ...
0
votes
1answer
57 views

GDPR - We're a global company and are expanding to Europe, do we need to save data there?

We're a global company and are expanding to Europe. We have users log in to our service and then they can use it. If a user is from the EU, do we have to store all of their personal information ...
1
vote
1answer
74 views

Can the GDPR be used to ask free race photographs?

A lot of time pictures of participants are taken during a sports event. These are often sold afterwards for e.g. 10 euro each. Some people just share the watermarked image on social media. But my ...