Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
13
votes
3answers
8k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
8
votes
1answer
2k views

GDPR Compliance: Do all Cookies require Opt-In?

Given a Web Site which uses cookies for the following: User Preferences Bookmarked Articles Cookie Preferences what explicit permissions would be required from the user? Here I anticipate the ...
12
votes
4answers
717 views

What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
7
votes
4answers
881 views

Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?

The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data: by a natural person in the course of a ...
22
votes
2answers
14k views

How to satisfy GDPR's consent requirement for IP logging?

Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
8
votes
1answer
1k views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
11
votes
2answers
3k views

Would GDPR affect my own personal website?

I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public. As I am the only person who is in charge (my personal site), would I have to oblige to ...
8
votes
2answers
652 views

Are GDPR-Walls legal?

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information. I see two possible legal problems: GDPR forbids coupling of ...
5
votes
1answer
157 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
5
votes
2answers
454 views

“Right of access by the data subject” if the IP address is the only personal data

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
5
votes
2answers
508 views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
3
votes
4answers
586 views

GDPR - Is consent really necessary for contact form?

I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer. The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
0
votes
1answer
184 views

Who needs to implement Cookie Consent for embedded content?

Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <iframe>...
-1
votes
1answer
451 views

Google AdWords banned my account. Can I request complete deletion under GDPR?

GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on ...
35
votes
2answers
6k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
10
votes
2answers
5k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
2
votes
1answer
688 views

GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?

I'm wondering if anyone can shed any light on this for me please. I've been doing alot of research about GDPR lately and how it is going to effect my websites using Google Analytics. From what I can ...
11
votes
2answers
1k views

Do cookie banners need to change for GDPR compliance?

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
3
votes
1answer
642 views

User consent required under GDPR

I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user. For this reason I have drafted a ...
3
votes
3answers
380 views

According to GDPR, do I need a contract for processing on behalf with my e-mail provider?

It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster. Now, I am wondering whether the same is true for the e-...
7
votes
4answers
3k views

GDPR: are faces always considered identifiable information?

Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
7
votes
1answer
106 views

As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?

The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
5
votes
3answers
1k views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
3
votes
1answer
289 views

GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?

I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service. ...
1
vote
2answers
72 views

What consequences are there to ignoring GDPR rules as a non-EU entity?

If a non-EU entity ignores the GDPR rules, including not paying any fines they receive from not following them, what consequences are they subject to? Can a company simply decide to ignore GDPR rules ...
0
votes
1answer
49 views

What's the rationale for “joint controller” instead of keeping every entity doing stricly separate?

After reading Case C-40/17 and Case C-210/16 I still cannot figure out why GDPR would require "joint controller" decision. Wouldn't it be much simpler to decide that e.g. in "Fashion ID&...
0
votes
1answer
224 views

Opt Out Consent under GDPR

I am having an Android App which uses certain service such as Analytics, Ad Networks. I am taking the consent from the user at when the app starts, i.e. before collecting any info. But there are ...
0
votes
0answers
160 views

Twitter has no “delete account” button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement

I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that. But Twitter has no "delete account" button. There is only a "...
48
votes
2answers
7k views

Is requesting waiving the right to deletion of contributions against GDPR?

I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage: (For GitLab ...
9
votes
2answers
2k views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
7
votes
1answer
368 views

GDPR - am I a data controller as an app owner if I do not have access to the data?

Let's assume that I created a mobile app for iPhone that is tracking rides on a bike so that means the app is collecting GPS coordinates of the phone and later this mobile app shows some statistics ...
5
votes
1answer
1k views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
4
votes
1answer
772 views

Are hobby projects exempt from GDPR?

Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database. GDPR ...
2
votes
2answers
198 views

How can you block GDPR users from US based sites?

(I originally asked this question on Server Fault with GDPR tag, but due to minimal response was advised to try asking here) As I understand it, GDPR is European legislation promoted as protecting EU ...
14
votes
3answers
2k views

Why can't I add a governing law to my terms of service to avoid GDPR?

I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
5
votes
1answer
2k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
5
votes
2answers
232 views

Excluding all people from the EU from my blog - is this allowed?

There's a new law from the European Union I simply cannot comply with (GDPR). Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my ...
5
votes
1answer
187 views

Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?

How does GDPR apply to companies getting someone else's personal data from a legitimate source? For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a ...
5
votes
5answers
4k views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
3
votes
2answers
129 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
3
votes
1answer
5k views

Under the GDPR, should transaction data be deleted on account deletion or on user request?

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted? Or if the user can buy ...
3
votes
2answers
483 views

Do web applications as hobby projects need to comply with the GDPR?

I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation. 2) This Regulation does ...
2
votes
1answer
473 views

google analytics cookie consent with anonymized ip on

I am not even sure how is this possible, so here I am. I have google analytics with anonymized IP on, my users can activate and deactivate google analytics cookies at any time. BUT, on top of that, ...
2
votes
1answer
183 views

Using GDPR against cold-call marketing emails

I recently received a "cold-call" email from a salesman to my professional email address, which is in the form firstname.lastname@company.com. The firstname is a very formal version unlikely to be ...
1
vote
3answers
113 views

Is offline-only processing a “‘processing” as understood by GDPR?

GDPR, article 4, point (1) states: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as ...
9
votes
3answers
739 views

GDPR - Withdrawn user consent

I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent. The user gives his consent to use his data and ...
7
votes
1answer
865 views

Deducing and using an email address under GDPR

I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this. The work email ...
7
votes
1answer
120 views

Is it sufficient to provide a privacy policy only in english language?

Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language? Is a translation necessary for every country of the EU ...
7
votes
1answer
166 views

Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?

I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation. Anyway, if I ...
6
votes
2answers
649 views

Are server-logs reckoned as storing of personal data by website (GDPR)?

Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS). Should I state that in our privacy policy?