Skip to main content

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
5 votes
2 answers
121 views

How do Wi-Fi Positioning Systems interact with the GDPR?

There is a paper (described in the news) that details how to use Apple's Wi-Fi Positioning System (WPS) facilitates mass surveillance, even of those not using Apple devices. The system is described ...
User65535's user avatar
  • 6,864
-2 votes
0 answers
34 views

Android mobile app - is explicit GDPR consent in the app needed when Google Play Data safety is filled? [closed]

Our Android app allows users to create an account, so we're storing their email. We filled this in the Google Play Data safety form, and we have this in our privacy policy that is linked in our Google ...
Bonco's user avatar
  • 1
1 vote
1 answer
62 views

EU Data Act - Receive access logs of managed wifi access points from service provider

As an employee of company A I would like to statistically analyse access logs of wifi access points, which are located in offices of company A, but managed by a service provider (company B). company B ...
PSanetra's user avatar
  • 119
-5 votes
1 answer
60 views

Does anonymous tracking require user consent according to GDPR and CCPA? [closed]

I'm designing a special tracking service for my web applications. Its sole purpose is to detect malicious activities and block/list source IP addresses. The thing is that to effectively implement this ...
Subtle Development Space's user avatar
-3 votes
1 answer
62 views

Do I have meaningful information about the logic of the automated decision-making by all reputable data brokers?

From previous questions, GDPR Article 14, the requirement to inform the data subject after a data transfer has taken place, is generally fulfilled by ensuring the data subject has the data prior to ...
User65535's user avatar
  • 6,864
-1 votes
0 answers
34 views

How does corporate bankruptcy law and GDPR data transfer law intersect?

I know very little about corporate bankruptcy law, but I know it is very complicated and varies a lot within states (cf. chapter 7 vs. 11 in the US) and between states. From the end users ...
User65535's user avatar
  • 6,864
-5 votes
2 answers
90 views

What does it mean for a data subject to have information?

Article 14 of the GDPR covers information to be provided where personal data has not been obtained from the data subject. It requires the data subject to be provided with details when a data ...
User65535's user avatar
  • 6,864
13 votes
1 answer
3k views

I forgot to BCC people in music promotion email [closed]

I am a small musician promoting a new song but forgot to put the recipients of a promotional email as BCC (I got the emails off of my presave list). One person has emailed me concerned about their ...
Claire's user avatar
  • 147
1 vote
2 answers
118 views

Is a name of person in an blog interview personal identifiable information that requires author disclosure in privacy policy?

Lets say one has a blog and makes an in person interview with someone. The blog mentions this person name. The interview then is posted to the blog. Except for that,blog doesn't collect anything from ...
Mike's user avatar
  • 119
0 votes
0 answers
55 views

Is it legal under GDPR for a website owner to link to their Google Calendar or WhatsApp for scheduling and communication?

I sometimes see websites that provide links to external services such as Google Calendar and WhatsApp for appointment scheduling and communication purposes. I also noticed these sites rarely document ...
Adrien's user avatar
  • 9
0 votes
2 answers
137 views

Under which federal and / or state laws could GDPR be enforced in the United States?

Imagine company Z (spooky, I know). Company Z processes what counts in the EU GDPR as personal information, but company Z will refuse to comply with any requests from the EU, which would make it GDPR ...
tuskiomi's user avatar
  • 255
1 vote
1 answer
199 views

Should restaurants provide information to the data subject when taking reservations

As per Article 13 of the GDPR, the data controller shall provide information to the data subject when collecting personal data. I will use a specific example for this case. I am an EU citizen. I ...
hintauh's user avatar
  • 23
2 votes
2 answers
125 views

Is analysis of personal data without saving considered data processing?

One of GDPR's main topics is processing data. Article 4 tells: (2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or ...
ZygD's user avatar
  • 163
3 votes
5 answers
1k views

Standards for data availability for internal employees

Our organization possesses a lot of personal data, and when we provide the data to external partners we are very strict on complying with all the data confidentiality rules, recommendations, etc. The ...
ZygD's user avatar
  • 163
1 vote
1 answer
25 views

Data processing agreement with license seller or Saas host [closed]

If we (company) are buying a Saas licenses via a reseller, do we need a data processing agreement with the reseller or with the origial Saas provider. Example: We buy a hosted email services. Company ...
Høgni Beinisson's user avatar
0 votes
0 answers
23 views

Would a GDPR SAR cover the evidence an online company would be expected to provide to enforce a contractual debt?

It is in the news that HelloFresh is accused of charging people for deliveries they did not request, and said they would "send a third-party debt collector round" in the case of non-payment. ...
User65535's user avatar
  • 6,864
-4 votes
1 answer
184 views

How do I keep my web site out of Europe?

Say I want to publish a web page that includes URLs for for Google-hosted font files in its stylesheet. If your user agent deigns to, it can download those font files and display the page with them. ...
interfect's user avatar
  • 3,491
2 votes
2 answers
85 views

Does a "Data Controller" need to decide on behalf of others over their Data to become a Data Controller? [closed]

We provide Software for a school, more specifically for the Students Councils there. Hence we don't sign our contract with the school, but with "the Head" of the Students Council, which is ...
captain_joni's user avatar
1 vote
0 answers
41 views

Does a Push Notification Service (Apple/Google) have to be mentioned in an DPA. Do i need a DPA with the Service Providers? [closed]

We are a Software Company that provides a Software (an IOS and Android Application) to our Customers. That Customer itself would be treated as an Data Controller and thus we are the Data Processor, ...
captain_joni's user avatar
3 votes
1 answer
169 views

What's the legal difference between a security camera and filming on your smartphone?

In the Netherlands you should not have your security cameras record the public space (e.g. the road in front of your house), basically because recording the public space would infringe on people's ...
David Mulder's user avatar
  • 1,238
0 votes
1 answer
121 views

Google consent mode and GDPR

Suppose one had a facebook pixel tags set up on google tag manager, and they are firing with google consent mode, meaning, if people refuse the cookies, a cookieless ping will be sent (for instance) ...
PTaq's user avatar
  • 11
0 votes
1 answer
84 views

What recourse does one have against unsolicited marketing?

An academic email address seems to be a magnet for all kinds of spam, and while some of it is obvious grift, some is from otherwise legitimate companies. They will even often include an "...
Komi Golov's user avatar
1 vote
1 answer
61 views

What does "reasonable and proportionate" mean wrt GDPR SAR ID requirements?

When one makes a GDPR Subject Access Request (SAR) the data controller should confirm that the request is really coming from the data subject. From here Recital 64 of GDPR states; “The controller ...
User65535's user avatar
  • 6,864
0 votes
2 answers
121 views

Is there a cryptographic solution to the GDPR SAR ID check problem?

There are two bits of apparently contradictory advice on the internet. The first is somewhat harder to find because it seems so obvious: Don't give out your personal information unless you first ...
User65535's user avatar
  • 6,864
-1 votes
1 answer
120 views

User ID and GDPR

Is the user ID compliant with GDPR? Imagine that a company starts associating a userID when you create an account on the website. Just the company will be able to associate the userID with a specific ...
PTaq's user avatar
  • 11
1 vote
2 answers
98 views

GDPR - client and server side data

I am trying to figure out if with the following scenario, a user can still be identified somehow and if it follows GDPR rules. The scenario is the following: A user visits a page and a unique user_id ...
Orestis uRic's user avatar
4 votes
1 answer
850 views

Collecting Pseudonymous order information without consent - GDPR

Could I store a copy of very basic Pseudonymous order data in a non-essential place (Google Analytics) without user consent to essential cookies (which normally loads Google Analytics)? Either: Order ...
Simkoo's user avatar
  • 43
0 votes
1 answer
241 views

GDPR compliance - Font Awesome

I am building a simple website and therefore wanted to avoid worrying about GDPR compliance by simply not processing or tracking any user data. However, when investigating my only third-party service &...
Ph.lpp's user avatar
  • 103
4 votes
1 answer
107 views

What happens when data that was not personal information become personal information?

Supposed there is some data that is not associated with an individual. This data is processed by a company and distributed on the web. At a later date this data becomes associated with an individual ...
User65535's user avatar
  • 6,864
0 votes
1 answer
203 views

Does GDPR consider any audio recording to be "data"?

If an audio recording was made between two consenting parties, would that recording be considered "data" and subject to GDPR, (like a photograph) or would it depend on the subject and ...
Michael Hall's user avatar
  • 4,594
0 votes
0 answers
36 views

Is a third party which solicits and accepts personal data from a customer on another’s behalf a processor or a controller?

Alice contracts with ACME insurance which sends her to their identity verification solution provider’s app/website (BCME KYC SOLUTIONS Inc). BCME’s portal asks Alice for photos of herself and other ...
TylerDurden's user avatar
-1 votes
1 answer
84 views

GDPR cookie bar, auto accept when changing pages

Can i add a GDPR cookie bar on home page that will allow the users to accept or rejects the cookies but to also write on the bar something like: "You agree accept all cookies if you switch to ...
Alex's user avatar
  • 1
-3 votes
1 answer
132 views

How is Bob meant to obtain Cameron’s contact address for Data Protection concerns?

Cameron is almost certainly a data controller for the prose of the the UKGDPR. How can Bob practically go about seeking recourse and a means to reach Cameron, or an address on which to serve ...
TylerDurden's user avatar
0 votes
0 answers
65 views

Is amateur/hobbyist journalism/photography a purely household purpose?

Alice takes photos of people in public and puts them into a portfolio binder for grading by her photography class instructor but does not publish them. Barbara takes photos on her nights out and ...
TylerDurden's user avatar
1 vote
1 answer
150 views

Is Cameron a data controller?

Cameron doesn’t take greatly thoughtful pains in defining himself with respect to his street and online activities. Some may consider him a political activist, some a citizen and/or amateur journalist,...
TylerDurden's user avatar
3 votes
0 answers
73 views

Does consenting the usage of tracking Cookies also cover tracking Pixels under GDPR?

Last December Stack Overflow announced a change to the network advertisement policies. “Retargeting pixels are not allowed on any campaign. allowed for a limited number of vetted and pre-approved ...
SPArcheon's user avatar
  • 249
0 votes
0 answers
72 views

Who is responsible for search engine indexing? (GDPR) [duplicate]

I am currently trying to wrap my head around the GDPR by analysing mastodon.online. While going through their privacy policy and their privacy preferences of my Mastodon, I discovered the following ...
lukasl-dev's user avatar
1 vote
1 answer
55 views

Are data controllers required to acquire the means to appropriately redact data for disclosure to subjects?

Bob appears in CCTV footage that is held by all of ACME, BCME & CCME, but also features Alice and Charles. He requests access to the footage from all of the companies and receives three different ...
TylerDurden's user avatar
-1 votes
1 answer
78 views

Do data controllers have fewer obligations to self-represented data subjects than to their solicitors or insurers?

Bob makes a data protection request to a data controller who tells him that they are unable to comply with it and that he should therefore have his solicitors or insurers contact them. Do these types ...
TylerDurden's user avatar
1 vote
1 answer
75 views

Can either side of a GDPR SAR require the other to agree to ToS during the identification process?

I shall use a real situation that happened to me, but this is just to demonstrate my point. I am definitely not going to do anything about it. This is a purely theoretical question, I am not ...
User65535's user avatar
  • 6,864
1 vote
1 answer
63 views

Social network id (GDPR compliant)

Assuming the answer from GDPR - is user social ID personal data is correct. Let's consider the following case: I have a social network with public user profiles and publicly exposed user IDs. I also ...
nick318's user avatar
  • 113
0 votes
1 answer
94 views

Is "gossip surveillance" processing personal data under the GDPR?

The Guardian has an article on "gossip surveillance" where strangers report on social media private conversations they are not party to in the hope of exposing duplicity from the speakers in ...
User65535's user avatar
  • 6,864
0 votes
1 answer
285 views

Right to be forgotten on internet forums [closed]

I was recently tricked by an admin into getting booted off a forum of his where I had been active for years. This happened in a thread (my last) where this admin claims a number of things that are at ...
RJVB's user avatar
  • 109
2 votes
2 answers
173 views

Is it legal/appropriate to email a GDPR SAR to the executive team if that is the only email address the company provides?

This is prompted by this question but I am fairly sure I do not have the correct answer so I am making this one. My personal answer to "How do I get my data from company X under GDPR" is to ...
User65535's user avatar
  • 6,864
0 votes
1 answer
101 views

How to get user data from Foursquare/Swarm under GDPR?

Is there a way to download all my contributed check-in and reviews data from Foursquare/Swarm? The foursquare.com doesn't seem to have a way to log in with the old foursquare/swarm credentials. Isn't ...
ccpizza's user avatar
  • 101
16 votes
2 answers
4k views

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
User65535's user avatar
  • 6,864
0 votes
1 answer
70 views

Which EU country's regulation is applied when doing direct marketing from country A to a legal or natural person in country B?

So I'm wondering which country's legislation is used when, for example, a company from Sweden would do electronic direct marketing to another company in, say, Germany. Assuming that Sweden and Germany ...
undefined's user avatar
0 votes
1 answer
135 views

What to do if a company starts sending abusive newsletters years after having asked them to stop? [closed]

Five years ago, I used my e-mail address once to buy a service from a company in the EU (so the GDPR applies). Since then, they subscribed me without asking to a newsletter and sent me several mails ...
Karlo's user avatar
  • 103
9 votes
1 answer
4k views

GDPR, online shopping and phone numbers for shipping - Is it legal?

Many webshops expect the phone number to be entered for shipping. My understanding of the GDPR is that you are not even allowed to ask information which is not absolutely needed for the given task. ...
armset's user avatar
  • 101
6 votes
2 answers
3k views

Are developers data processors?

This question is inspired by this other question: What are an employed/contracted software developer's responsibilities under the GDPR? I wanted to understand more precisely the concept of a data ...
User8's user avatar
  • 67

1
2 3 4 5
21