Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
971
questions
1
vote
1
answer
44
views
Social network id (GDPR compliant)
Assuming the answer from GDPR - is user social ID personal data is correct.
Let's consider the following case:
I have a social network with public user profiles and publicly exposed user IDs. I also ...
- 5,965
-5
votes
0
answers
50
views
Delete facebook account but unable to login? [closed]
Unfortunately I visited facebook after a longtime to permanently delete my account and did a password reset. It flagged the action as suspicious and I cannot go back but 'Upload photo ID'.
I then ...
- 91
0
votes
1
answer
62
views
Which EU country's regulation is applied when doing direct marketing from country A to a legal or natural person in country B?
So I'm wondering which country's legislation is used when, for example, a company from Sweden would do electronic direct marketing to another company in, say, Germany.
Assuming that Sweden and Germany ...
CommunityBot
- 1
1
vote
1
answer
132
views
Is just embedding YouTube thumbs GDPR conform?
Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?
CommunityBot
- 1
0
votes
1
answer
51
views
Is "gossip surveillance" processing personal data under the GDPR?
The Guardian has an article on "gossip surveillance" where strangers report on social media private conversations they are not party to in the hope of exposing duplicity from the speakers in ...
- 5,900
2
votes
2
answers
118
views
Is it legal/appropriate to email a GDPR SAR to the executive team if that is the only email address the company provides?
This is prompted by this question but I am fairly sure I do not have the correct answer so I am making this one.
My personal answer to "How do I get my data from company X under GDPR" is to ...
- 504
0
votes
1
answer
183
views
Right to be forgotten on internet forums [closed]
I was recently tricked by an admin into getting booted off a forum of his where I had been active for years.
This happened in a thread (my last) where this admin claims a number of things that are at ...
- 109
-3
votes
0
answers
88
views
When running a dropshipping business, how can business owners protect customer data in accordance with GDPR?
In accordance with GDPR laws, how can dropshippers protect their customers' personal data when it's being sent to suppliers in countries that don't have data protection laws as strict as the EU?
- 21.7k
6
votes
2
answers
3k
views
Are developers data processors?
This question is inspired by this other question: What are an employed/contracted software developer's responsibilities under the GDPR?
I wanted to understand more precisely the concept of a data ...
- 191
0
votes
1
answer
88
views
How to get user data from Foursquare/Swarm under GDPR?
Is there a way to download all my contributed check-in and reviews data from Foursquare/Swarm?
The foursquare.com doesn't seem to have a way to log in with the old foursquare/swarm credentials.
Isn't ...
- 109
0
votes
1
answer
132
views
What to do if a company starts sending abusive newsletters years after having asked them to stop? [closed]
Five years ago, I used my e-mail address once to buy a service from a company in the EU (so the GDPR applies). Since then, they subscribed me without asking to a newsletter and sent me several mails ...
- 103
16
votes
2
answers
4k
views
Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?
The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
- 225
9
votes
1
answer
4k
views
GDPR, online shopping and phone numbers for shipping - Is it legal?
Many webshops expect the phone number to be entered for shipping. My understanding of the GDPR is that you are not even allowed to ask information which is not absolutely needed for the given task. ...
- 5,786
-2
votes
1
answer
116
views
Are deleted comments left by U.K. based users retained and subject to subject access under U.K. GDPR?
Meet Bob; Bob left some comments on a post on stack exchange and some over zealous moderators decided that they were not needed and so to delete them. Bob wishes to access these comments for the ...
- 6,088
1
vote
2
answers
180
views
What are an employed/contracted software developer's responsibilities under the GDPR?
This is prompted by this question but that is rather complicated by the technical details. Suppose the following hypothetical:
Alice is a software developer for Bob Inc. perhaps as a normal employee, ...
- 35.1k
0
votes
1
answer
53
views
Does GDPR require consent to collect non-personal information?
If a website never assigns a user a unique identifier, does the website need to get explicit consent from the user before collecting non-personal information?
Examples of non-personal information that ...
- 5,900
4
votes
2
answers
3k
views
If this has nothing to do with GDPR, is this acceptable legally?
I was advised to ask only one question per post.
In my earlier post
Does this action violate GDPR
If a company is aware that a customer cannot provide a receipt, yet still requests their personal ...
- 348
3
votes
2
answers
179
views
What rules determine jurisdiction on the internet?
It is in the news that Clearview AI has won an appeal against the UK Information Commissioner's Office (ICO). The reasons for judgment are here: Clearview AI Inc v The Information Commissioner [2023] ...
- 198k
3
votes
1
answer
93
views
Can one person's genetic information be another persons personal information?
In the UK GDPR ‘personal data’ is defined as:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one ...
- 5,965
1
vote
1
answer
332
views
Does this action violate GDPR
If a company is aware that a customer cannot provide a receipt, yet still requests their personal information to facilitate a product exchange due to a defective item, but later denies the exchange ...
- 5,508
1
vote
0
answers
26
views
Multi Domain Cookies Consent —Special Category Data
Can cross domain cookie consent be applied to government websites which collect special category data?
Or is there any legal\policy guidance covering the use of multi domain cookies consent for the EU?...
- 11
1
vote
1
answer
53
views
Cookie Consent: Do we require consent for login or user preferences?
I would like my web site to be as GDPR friendly as possible. I don’t make use of tracking, advertising or analytics.
On a web site, we might have want to track the following:
Login cookies — has this ...
- 14.8k
3
votes
0
answers
78
views
When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?
When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately?
There exists an argument ...
- 198k
-4
votes
1
answer
94
views
Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?
Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to ...
- 198k
0
votes
0
answers
38
views
Is jigsaw identification enough to render a piece of information DPA-subject “personal data“? [duplicate]
In some legal contexts there is the notion of “jigsaw identification,” that is pieces of information that could allow certain people if adequately placed and privileged to other pieces of information ...
- 9,155
-2
votes
1
answer
81
views
Is changing my IP to test a website a violation of GDPR [closed]
My company is US based and we host and creates websites. Some websites are hosted in europe and some in the US, both are accessible to the EU though. We were wondering if for example there was a bug ...
- 14.5k
14
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 35.1k
10
votes
5
answers
4k
views
Is scraping an iCal link legal?
TL;DR: my university says my app is illegal
Since our university doesn't have a mobile app to check our schedules, I created one that does the following:
Opens an embedded web browser (in app) and ...
- 198k
0
votes
1
answer
101
views
Are outward facing security cameras’ footage on the outside of ambassadorial missions subject to subject access rights?
Bob walks past the front entrance of the embassy of the republic of Zwakilostan which is somehow under diplomatic protocols Zwakilostani sovereign territory. The cameras point outside toward the road ...
- 5,348
5
votes
2
answers
1k
views
Are server-logs personal data (GDPR-related)?
Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS). Should I state that in our privacy policy?
- 190
10
votes
4
answers
5k
views
Do I need to present a GDPR banner to IP addresses outside of GDPR regions?
The context of my question comes from this comment:
The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The ...
- 13.9k
-1
votes
1
answer
74
views
Is it reasonable for a data controller to require proof of one’s address before honouring a subject’s right of access
Alice has requested access to her personal data from a shopkeeper.
Barbara has submitted a SAR to a police force for BWV footage.
They both require one item of identification and another for evidence ...
- 14.8k
2
votes
1
answer
131
views
What exactly triggers the GDPR Article 14?
Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject:
Art. 14 ...
CommunityBot
- 1
3
votes
3
answers
278
views
Has a data loss taken place if, after the fact, it is discovered that the data was never lost
Data on external media was misplaced and all the protocols to report it as lost were followed.
A few months after, the media was discovered. It never left the secure location.
Given that data was ...
CommunityBot
- 1
0
votes
1
answer
85
views
Who is the data controller of footage taken on a retail worker’s personal phone?
An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer ...
CommunityBot
- 1
0
votes
2
answers
106
views
How to conduct a GDPR compliant survey if not collecting personal information, e.g. names, but potentially personally identifiable information?
If I were to conduct a survey of members of a public group in the EU (for my own personal interests) what should be considered in order to comply to GDPR regulations?
If the information does not ...
-7
votes
1
answer
87
views
Wat are the benfits of Temporal Tables for GDPR Compliance?
I am a software developer with some basic knowledge of the GDPR. I asked Chat GPT what the benefits are of temporal tables in SQL Server for GDPR Compliance. Is Chat GPT 4 right? And what could be ...
- 5,965
3
votes
1
answer
78
views
Can GDPR force public sector workers to fix an exploit they were notified of?
I live in some EU country and I rely on social security provided by the regional government. There is a website for residents who can sign up and claim benefits without physically visiting an office. ...
- 198k
3
votes
2
answers
1k
views
GDPR takedown request unsuccessful
I made the following request
My name is _ I am a citizen of the EU. My email addresses are _ and _
In accordance with Article 17 of the GDPR I request you to erase all personal data that you hold ...
- 3,298
1
vote
0
answers
88
views
Does the GDPR/data protection act contain any anti-reprisal provisions?
The Information Commissioner's Office ICO advisers state that one “shouldn't” be treated any directly or less favourably as a result of exercising one’s rights under the legislation. What legal ...
CommunityBot
- 1
10
votes
2
answers
4k
views
Is a "login timestamp" considered as personal data according to GDPR?
If software is saving the timestamp of the last login of a user, would that timestamp itself be considered personal data by GDPR?
- 43.5k
2
votes
1
answer
332
views
GDPR and privacy policy compliance for software used internally by customer company
We are developing software that are sold to and used by other companies. In the software, certain types of personal data, like name, email and phone number, can be stored when a user registers. The ...
- 14.8k
1
vote
2
answers
127
views
Are surveillance laws in EU member states necessary and proportionate? [closed]
On the 10th of July the EU Commission adopted a new adequacy decision, as a successor to the failed Safe Harbour and Privacy Shield agreements, to allow data transfers from the EU to the USA. The two ...
- 68
2
votes
1
answer
53
views
Can legal/ pre-action correspondence with a business be subject to a SAR?
Bob has been harmed by a business ACME inc. He sends them a letter before claiming damages as under the pre action protocol. They send him a reply.
Bob loses his copy of both of these articles of ...
- 23.9k
16
votes
5
answers
7k
views
Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?
On day one of my first year in high school me and basically every other students were given a few documents to sign. One of them included a clause that allowed the school to publish pictures of us ...
0
votes
0
answers
67
views
how long might the regulatory action against Meta’s GDPR flouting take to play out?
Meta Inc is known to flout subject access request under the GDPR and numerous complaints have been lodged. What is the timeframe for these processes to play out?
How does Facebook justify non-...
- 9,155
8
votes
1
answer
3k
views
Does GDPR apply when PII is already publicly available?
Pretend there is a website, it might be free to access, or be a paid per search service, where the users get access to summarised information on the people that they search for.
All of the information ...
- 105
3
votes
1
answer
997
views
If website uses cookies only after users login, can I ask for cookie consent during account creation instead of website launch?
I have a website that uses cookies only if the user logs in. Is it necessary to show a cookie popup banner at website launch or can I ask for consent when user is creating an account (the standard I ...
- 23.9k
4
votes
1
answer
92
views
How can Standard Contractual Clauses overcome Schrems II?
My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
- 23.9k
-4
votes
4
answers
122
views
GDPR Privacy Policy - how to handle non standard cases without much budget
I want to market a little side hustle of mine and due to GDPR need to create some data privacy policy. Since as any reasonable developer I try to leverage the power of frameworks like Firebase, Stripe,...
- 87