Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

55 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
1answer
120 views

Can I request to delete an account with a government?

This concerns my student loans repayment account which is managed by the gov.uk website. I have paid my loan back in full and have had a confirmatory letter stating this as well, as I wanted to ensure ...
2
votes
2answers
86 views

Is it legal to process PII in EU of customers which are not in EU?

So I have an app that processes the PII of users and their interests, the app is south Asia based. The app doesn't support EU customers and is geo-blocked by default. I would like to process and store ...
2
votes
1answer
134 views

Has a data loss taken place if, after the fact, it is discovered that the data was never lost

Data on external media was misplaced and all the protocols to report it as lost were followed. A few months after, the media was discovered. It never left the secure location. Given that data was ...
2
votes
0answers
53 views

How does the GDPR differ from national data protection law?

Before the GDPR came into effect, I had to deal with both the German Bundesdatenschutzgesetz and the Italian Codice in materia di dati personali, and recall them having very similar provisions (though ...
2
votes
0answers
57 views

Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?

From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
2
votes
0answers
299 views

Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?

It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
2
votes
0answers
243 views

How to notify the use of cookies (Cookie Law Notice)

I have been investigating notifications about the use of cookies and a question has come up: Why 99.9% of websites do not report correctly about the use of cookies and nothing happens? With "...
2
votes
0answers
116 views

Ebay - GDPR - Legality of re-assigning Data Controllers?

This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016. According to Article 27 (...
2
votes
0answers
338 views

Explanations for GDPR if no personal data is collected?

I have a website that is a travel search engine and I am very concerned about GDPR. I am not interested in any private information from the users for marketing or such things. I just use Google ...
2
votes
0answers
44 views

What happens to SARs recieved before the 25th May?

With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May. However, in ...
2
votes
0answers
108 views

GDPR and logging which user accessed which personal information

If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what ...
2
votes
0answers
131 views

Who is the data controller of users' data of a SaaS platform?

Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU. The B company uses the software to keep track of its customers, ...
2
votes
0answers
65 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
1
vote
0answers
37 views

Data representatives in EU, UK, Switzerland - are there more countries requiring this?

The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
1
vote
0answers
30 views

GDPR data deletion: can I ask the company to delete the data it had exported in the United States?

I am located in Italy. I have subscribed to a service and provided some PII that "could be exported in the United States". If I send a GDPR request to delete my data, can I ask them to also ...
1
vote
0answers
35 views

GDPR data deletion: do I have a right to have the company specify which data it retained and why?

I requested the DPO of a company to delete all my data under GDPR. After a step of "account ownership" verification, it replied that: XXXX has deleted all of your personal data except where ...
1
vote
0answers
113 views

Mendeley is encrypting my data on my hard disk with a key only available to them: can I ask for unencrypted data under GDPR?

I use Mendeley Desktop to manage my bibliography. Now I want to switch to Zotero. Zotero used to be able to import the Mandeley's database. However, Mendeley 1.19 encrypted my data on my HDD with a ...
1
vote
0answers
48 views

University diploma / various certificates under GDPR

Background: I'm considering building a web (focused to Europe) which, for one of it's part, would require users to upload their university diplomas and/or other similar certificates of achieved ...
1
vote
0answers
47 views

Corporate responsibility when allowing biometric authentication

At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for ...
1
vote
0answers
44 views

Is Apple's default Privacy settings GDPR compliant?

I recently realized that some apps were able to "link" my identity to Facebook. I checked my off facebook activity and could see some apps that I've never given my email. Investigating ...
1
vote
0answers
33 views

Company acquired a website with existing users. Is GDPR announcement obligatory?

When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
1
vote
0answers
48 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
1
vote
0answers
83 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
1
vote
0answers
72 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
1
vote
0answers
59 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
1
vote
0answers
58 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
1
vote
0answers
119 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
1
vote
1answer
244 views

GDPR and a cell phone paid through work?

Company Contacts page From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B. For instance my private email is regulated by GDPR, but my work ...
1
vote
0answers
474 views

Offering GDPR privacy policy for voice mail?

Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
1
vote
0answers
186 views

Under GDPR Data Processing Officer's email address bounces - what to do?

In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts. So I had sent ...
1
vote
0answers
273 views

Can a developer have access to live data within GDPR?

Segregation of Duties in IT I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
1
vote
0answers
609 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
1
vote
1answer
109 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
1
vote
1answer
67 views

to be in photo and video, and right to ask for removal these data relying on GDPR

At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs. Now, I want my pictures to be erased, or any data, ...
0
votes
0answers
52 views

Is securely storing and using customer credentials and passwords in customer-commissioned software GDPR compliant?

My team is in charge of developing integration software for our customers. The customer integrates their system with our platform in order to use our services. Numerous customers avoid managing their ...
0
votes
0answers
217 views

Twitter has no "delete account" button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement

I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that. But Twitter has no "delete account" button. There is only a "...
0
votes
0answers
45 views

I do not understand the EU's requirement to have a GDPR representative located in the EU

I do not really understand the EU's requirement to have a GDPR representative located in the EU for a data controller and/or processor located outside the EU. From the EU's point of view they ...
0
votes
0answers
44 views

Mandatory languages for privacy policies in Japan (APPI)

I work on Apps, currently Android, which are distributed via Google Play. As the EU has GDPR, in Japan they have APPI (Act on the Protection of Personal Information) which is something like the ...
0
votes
0answers
63 views

Very simple static website with Google Analytics. How to make it GDPR compliant?

There is a very simple static website for a commerce. That website only shows information. It has Google Analytics to count visits with the default GA script placed in : <head> <script>...
0
votes
0answers
29 views

GDPR legitimate interest and Contact Picker API

There is a draft web standard Contact Picker API see here and here. An explicit use case is "bootstrapping a user’s social graph for social networks". I'm interested in what ways this can ...
0
votes
0answers
63 views

GDPR - Who Called Me type of situation

I would like to ask how does it work with GDPR and a service like "who called me". Basically there are no publicly listed phone numbers as these kind of websites are using pretty much every ...
0
votes
0answers
65 views

How to describe your experience in your CV/Resume without breaking copyright / GDPR rules?

Are there rules (EU & US) defining how far one can go in decribing his professional experience as a software developer, and telling about the projects he worked on? For example, if I do not ...
0
votes
0answers
93 views

Is it illegal to refuse to fix a hacked website?

Suppose there's a website or a server that has been hacked. There is no personal data stored anywhere, so there hasn't been a real data breach, because basically there's no valuable data to steal at ...
0
votes
0answers
48 views

Is the Absence of Account deletion possibility legal in Europe? (GDPR)

This website explicitly states there is no easy way to "delete your account". It is accessible from within Europe. How legal is this? What would be my lever to force them to delete my ...
0
votes
0answers
52 views

If a user of my site gives me info of a third party they claim to be affiliated with, am I allowed to contact that third party to check?

I am developing an app where a part of the on-boarding process requires users to enter the email / company name of the agency that they are affiliated with (the 3rd party). I need to confirm that they ...
0
votes
2answers
102 views

What is the law regarding web/mobile applications and "personal" data?

I'm developing an application for mobile/web/desktop that will (in very watered down basic terms) store free text strings they've self-contributed and access them freely. As it stands, these ...
0
votes
0answers
78 views

Facebook vs GDPR - Is Facebook never deleting the Searches you do?

I frequently delete the Search History from my account's Activity Log. However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past. Suggestions ...
0
votes
0answers
82 views

Is WhatsApp GDPR compliant as it allows backups for group chat?

Currently WhatsApp claims it uses end to end encryption. However the app provisions users to switch on backups to Google Drive and other providers. So if I am in a group chat with a set of users and ...
0
votes
0answers
38 views

Data Privacy: Should a user be allowed to change another users profile information?

In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)? What laws (US & EU) would give guidance either way? ...
0
votes
0answers
49 views

Question Regarding GDPR

I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...