Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
122
questions
15
votes
3
answers
13k
views
Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers
I asked this question to Facebook:
I would like to know how can I permanently delete private messages
from both sides of the conversation. For example, conversations I had
in the past with ...
- 1,003
14
votes
4
answers
1k
views
What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?
My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
- 242
8
votes
1
answer
3k
views
GDPR Compliance: Do all Cookies require Opt-In?
Given a Web Site which uses cookies for the following:
User Preferences
Bookmarked Articles
Cookie Preferences
what explicit permissions would be required from the user?
Here I anticipate the ...
- 213
7
votes
4
answers
1k
views
Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?
The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data:
by a natural person in the course of a ...
- 3,202
27
votes
2
answers
27k
views
How to satisfy GDPR's consent requirement for IP logging?
Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
- 373
9
votes
1
answer
377
views
As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?
The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
- 4,296
8
votes
2
answers
3k
views
Is it really possible to use Google Analytics without consent, and if so, why exactly?
I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
- 1,828
5
votes
2
answers
2k
views
GitHub pages and GDPR - controller, processor and DPA
I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain.
The only potentially personal data that the site will ...
- 205
3
votes
1
answer
256
views
Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever
I have a small static personal website, where I publish some technical articles and my personal CV.
Do I need to include a privacy-policy if:
There are no (third- or first party) tracking services ...
- 33
12
votes
2
answers
3k
views
Why does the GDPR matter to me, a US citizen with no property in Europe?
I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
- 13.9k
9
votes
2
answers
845
views
Are GDPR-Walls legal?
Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information.
I see two possible legal problems:
GDPR forbids coupling of ...
- 190
6
votes
4
answers
3k
views
GDPR - Is consent really necessary for contact form?
I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer.
The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
- 163
5
votes
2
answers
817
views
"Right of access by the data subject" if the IP address is the only personal data
IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
- 1,136
5
votes
1
answer
252
views
In which jurisdictions outside the EU can the GDPR be enforced?
The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens.
Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
- 1,714
2
votes
1
answer
2k
views
Who needs to implement Cookie Consent for embedded content?
Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <iframe>...
2
votes
2
answers
1k
views
GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?
I'm wondering if anyone can shed any light on this for me please. I've been doing alot of research about GDPR lately and how it is going to effect my websites using Google Analytics.
From what I can ...
- 175
-1
votes
1
answer
705
views
Google AdWords banned my account. Can I request complete deletion under GDPR?
GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on ...
- 121
42
votes
2
answers
8k
views
GDPR + git history
Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required?
Git is a ...
- 521
15
votes
2
answers
6k
views
Would GDPR affect my own personal website?
I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public.
As I am the only person who is in charge (my personal site), would I have to oblige to ...
- 271
11
votes
2
answers
7k
views
Is hash of a username still personal data?
I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
- 213
11
votes
4
answers
1k
views
Do cookie banners need to change for GDPR compliance?
Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
7
votes
4
answers
5k
views
GDPR: are faces always considered identifiable information?
Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
- 125
7
votes
3
answers
284
views
Is it illegal to intentionally design a social network that can't comply with right-to-be-forgotten (and possibly other laws)?
If I intentionally design (and program) a social network that uses a technology (blockchain,...) which does not allow for alteration / erasing of user data, what happens in case of a right-to-be-...
- 171
5
votes
3
answers
1k
views
Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?
Background
Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
- 325
4
votes
1
answer
813
views
User consent required under GDPR
I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user.
For this reason I have drafted a ...
- 203
4
votes
2
answers
836
views
Do web applications as hobby projects need to comply with the GDPR?
I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation.
2) This Regulation does ...
- 419
4
votes
1
answer
252
views
Was my GDPR request not complied with?
On the 12th of December I made a GDPR request to a major online retailer in the UK.
While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
4
votes
1
answer
325
views
GDPR and Storing Non-EU Citizen Data as an EU-based company
I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
- 143
3
votes
3
answers
360
views
Does the GDPR apply to the data subject's computers?
In this answer to a GDPR question about processing conducted by an app on the user's computer I wrote:
The GDPR only applies to data processed by you on your computer. Any processing that happens on ...
- 13k
3
votes
2
answers
3k
views
Storing IP's and GDPR Compliance
Suppose a web designer plans to store hashed IP's in a database for analytical purposes of tracking unique clicks, and for security purposes to prevent botting unique clicks. Suppose the site only ...
- 43
3
votes
3
answers
801
views
According to GDPR, do I need a contract for processing on behalf with my e-mail provider?
It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster.
Now, I am wondering whether the same is true for the e-...
- 374
3
votes
2
answers
261
views
What consequences are there to ignoring GDPR rules as a non-EU entity?
If a non-EU entity ignores the GDPR rules, including not paying any fines they receive from not following them, what consequences are they subject to? Can a company simply decide to ignore GDPR rules ...
- 967
3
votes
1
answer
373
views
GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?
I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service.
...
- 83
1
vote
0
answers
479
views
Twitter has no "delete account" button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement
I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that.
But Twitter has no "delete account" button. There is only a "...
- 1,586
1
vote
1
answer
107
views
How far up the chain of internet provision does my GDPR responsibility go?
Say I host a web page on my computer, and you visit that site from somewhere in Europe. The web server on my computer will know your IP address, and I can choose to "forget" it as soon as ...
- 817
0
votes
1
answer
154
views
What's the rationale for "joint controller" instead of keeping every entity doing stricly separate?
After reading Case C-40/17 and Case C-210/16 I still cannot figure out why GDPR would require "joint controller" decision.
Wouldn't it be much simpler to decide that e.g. in "Fashion ID&...
0
votes
1
answer
278
views
Opt Out Consent under GDPR
I am having an Android App which uses certain service such as Analytics, Ad Networks.
I am taking the consent from the user at when the app starts, i.e. before collecting any info.
But there are ...
- 203
59
votes
4
answers
20k
views
Does GDPR include UK customers, or not anymore?
Now that Brexit happened, does GDPR include UK customers, or not anymore?
- 1,003
49
votes
2
answers
7k
views
Is requesting waiving the right to deletion of contributions against GDPR?
I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage:
(For GitLab ...
- 533
30
votes
2
answers
5k
views
Accessing public CCTV footage about you
Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
- 429
22
votes
2
answers
32k
views
Do the GDPR and Cookie-Law regulations apply to localStorage?
We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
- 323
20
votes
2
answers
4k
views
Are global user account systems now illegal following the EU's May 2023 fine of Meta?
The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta
Like any website, we have an account system where people log in to access their ...
- 303
14
votes
3
answers
3k
views
GDPR & Blocking EU Visitors?
I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
- 197
14
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 1,491
14
votes
3
answers
2k
views
Why can't I add a governing law to my terms of service to avoid GDPR?
I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
- 141
10
votes
4
answers
5k
views
Is there a way to determine if an email address is personal information?
The GDPR defines personal data as:
Personal data is information that relates to an identified or identifiable individual.
My understanding is that this means that [email protected] is ...
- 5,890
9
votes
2
answers
3k
views
GDPR. Where to store users consent?
A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
- 113
9
votes
3
answers
832
views
GDPR - Withdrawn user consent
I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent.
The user gives his consent to use his data and ...
- 193
8
votes
1
answer
2k
views
Deducing and using an email address under GDPR
I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this.
The work email ...
7
votes
2
answers
2k
views
Do family pictures and videos in public places fall under GDPR?
The Czech Data Protection Authority fined Mr. Rynes for filming
members of the public without their consent. Mr. Rynes appealed,
arguing that he was covered by the personal and household ...
user31127