Skip to main content

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

76 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
1 answer
141 views

GDPR issues with Google sharing suspected child abuse images with law enforcement

I recently read of a man who had a Google account. His son's doctor asked for photos of a medical issue his son was having around his groin area, so his wife used his phone to take some. Google ...
user's user avatar
  • 1,876
3 votes
0 answers
43 views

Does there exist an example of meaningful information about an automated individual decision-making algorithm?

The GDPR Article 14 includes provisions for the data subject to have meaningful information about an automated individual decision-making algorithm that which produces legal effects concerning him or ...
User65535's user avatar
  • 7,572
3 votes
0 answers
92 views

Does consenting the usage of tracking Cookies also cover tracking Pixels under GDPR?

Last December Stack Overflow announced a change to the network advertisement policies. “Retargeting pixels are not allowed on any campaign. allowed for a limited number of vetted and pre-approved ...
SPArcheon - on strike's user avatar
3 votes
0 answers
81 views

When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?

When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately? There exists an argument ...
GolDDranks's user avatar
3 votes
0 answers
50 views

Search engine data breaches, osint

Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
J.G.'s user avatar
  • 53
3 votes
0 answers
90 views

Are apps required to notify users when they update their privacy policy or EULA?

I have noticed that many companies are doing this but definitely not all. Furthermore, what about cases where companies or developers cannot notify users because some users are not logged-in or ...
Matt's user avatar
  • 151
3 votes
0 answers
187 views

GDPR compliance for software that lets users store PII of other people

Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential ...
Oli's user avatar
  • 131
2 votes
0 answers
78 views

Is there anything to stop a subject access requester from being barred by a business?

A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
TylerDurden's user avatar
2 votes
0 answers
62 views

GDPR data deletion: can I ask the company to delete the data it had exported in the United States?

I am located in Italy. I have subscribed to a service and provided some PII that "could be exported in the United States". If I send a GDPR request to delete my data, can I ask them to also ...
robertspierre's user avatar
2 votes
0 answers
60 views

GDPR data deletion: do I have a right to have the company specify which data it retained and why?

I requested the DPO of a company to delete all my data under GDPR. After a step of "account ownership" verification, it replied that: XXXX has deleted all of your personal data except where ...
robertspierre's user avatar
2 votes
0 answers
63 views

Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?

From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
J. Doe's user avatar
  • 447
2 votes
0 answers
339 views

Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?

It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
Nostradamus's user avatar
2 votes
0 answers
270 views

How to notify the use of cookies (Cookie Law Notice)

I have been investigating notifications about the use of cookies and a question has come up: Why 99.9% of websites do not report correctly about the use of cookies and nothing happens? With "...
Brahim Khallota's user avatar
2 votes
0 answers
171 views

Ebay - GDPR - Legality of re-assigning Data Controllers?

This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016. According to Article 27 (...
John Smith Optional's user avatar
2 votes
0 answers
382 views

Explanations for GDPR if no personal data is collected?

I have a website that is a travel search engine and I am very concerned about GDPR. I am not interested in any private information from the users for marketing or such things. I just use Google ...
J0ANMM's user avatar
  • 121
2 votes
0 answers
44 views

What happens to SARs recieved before the 25th May?

With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May. However, in ...
Bilkokuya's user avatar
  • 234
2 votes
0 answers
120 views

GDPR and logging which user accessed which personal information

If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what ...
Masza's user avatar
  • 121
2 votes
0 answers
232 views

Who is the data controller of users' data of a SaaS platform?

Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU. The B company uses the software to keep track of its customers, ...
Arne Evertsson's user avatar
2 votes
0 answers
70 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
Mr Cholmondley Warner's user avatar
1 vote
0 answers
45 views

How specific does the information need to be relating to personal information transfer between data controllers?

When personal information is transferred between data controllers the GDPR imposses certain requirements. Among these are information that must be provided to the data subject. As I understand it ...
User65535's user avatar
  • 7,572
1 vote
1 answer
89 views

What exactly is a decision wrt. GDPR Automated individual decision-making?

The GDPR Article 22 provides rights relating to automated individual decision-making, including profiling. It starts: The data subject shall have the right not to be subject to a decision based ...
User65535's user avatar
  • 7,572
1 vote
0 answers
46 views

Multi Domain Cookies Consent —Special Category Data

Can cross domain cookie consent be applied to government websites which collect special category data? Or is there any legal\policy guidance covering the use of multi domain cookies consent for the EU?...
NiallL's user avatar
  • 11
1 vote
0 answers
94 views

Does the GDPR/data protection act contain any anti-reprisal provisions?

The Information Commissioner's Office ICO advisers state that one “shouldn't” be treated any directly or less favourably as a result of exercising one’s rights under the legislation. What legal ...
TylerDurden's user avatar
1 vote
0 answers
102 views

What information can insurance companies share with brokers?

I'm currently in the process of buying my first home, and have a mortgage broker helping me through the process. Our broker found us life insurance (to cover the cost of the mortgage) through a large ...
Chelsie Wright's user avatar
1 vote
0 answers
65 views

Receive written confirmation about non-breached data

Context: I am working for an institution which has recently suffered a data breach. There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
Vassilis Markos's user avatar
1 vote
0 answers
52 views

What are the limits to what the information commissioner can take action upon?

It is in the news that a doctor inappropriately accessed and distributed a patients medical records. They did this through their employer, Cambridge University Hospitals (CUH) at Addenbrookes. The ...
User65535's user avatar
  • 7,572
1 vote
0 answers
44 views

Data representatives in EU, UK, Switzerland - are there more countries requiring this?

The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
UweD's user avatar
  • 1,388
1 vote
0 answers
178 views

Mendeley is encrypting my data on my hard disk with a key only available to them: can I ask for unencrypted data under GDPR?

I use Mendeley Desktop to manage my bibliography. Now I want to switch to Zotero. Zotero used to be able to import the Mandeley's database. However, Mendeley 1.19 encrypted my data on my HDD with a ...
robertspierre's user avatar
1 vote
0 answers
512 views

Twitter has no "delete account" button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement

I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that. But Twitter has no "delete account" button. There is only a "...
robertspierre's user avatar
1 vote
0 answers
55 views

University diploma / various certificates under GDPR

Background: I'm considering building a web (focused to Europe) which, for one of it's part, would require users to upload their university diplomas and/or other similar certificates of achieved ...
Marek Schwarz's user avatar
1 vote
0 answers
97 views

Facebook vs GDPR - Is Facebook never deleting the Searches you do?

I frequently delete the Search History from my account's Activity Log. However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past. Suggestions ...
Nuno's user avatar
  • 1,033
1 vote
0 answers
515 views

Corporate responsibility when allowing biometric authentication

At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for ...
Grooke's user avatar
  • 111
1 vote
0 answers
50 views

Is Apple's default Privacy settings GDPR compliant?

I recently realized that some apps were able to "link" my identity to Facebook. I checked my off facebook activity and could see some apps that I've never given my email. Investigating ...
gingerlime's user avatar
1 vote
0 answers
34 views

Company acquired a website with existing users. Is GDPR announcement obligatory?

When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
Kate's user avatar
  • 11
1 vote
0 answers
77 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
user27419's user avatar
1 vote
0 answers
157 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
howtopythonpls's user avatar
1 vote
0 answers
87 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
Rick Jelier's user avatar
1 vote
0 answers
60 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
SSSS's user avatar
  • 11
1 vote
0 answers
62 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
zzmaster's user avatar
  • 111
1 vote
0 answers
262 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
startupsmith's user avatar
1 vote
0 answers
566 views

Offering GDPR privacy policy for voice mail?

Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
unor's user avatar
  • 1,144
1 vote
0 answers
191 views

Under GDPR Data Processing Officer's email address bounces - what to do?

In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts. So I had sent ...
Grzegorz Oledzki's user avatar
1 vote
0 answers
393 views

Can a developer have access to live data within GDPR?

Segregation of Duties in IT I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
Per Digre's user avatar
  • 354
1 vote
0 answers
755 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
CaterinaG's user avatar
1 vote
1 answer
119 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
user103220's user avatar
1 vote
1 answer
68 views

to be in photo and video, and right to ask for removal these data relying on GDPR

At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs. Now, I want my pictures to be erased, or any data, ...
user avatar
0 votes
0 answers
17 views

Does the transfer occurring under Article 45, 46 or 49 affect the Right of Access under Article 15.2?

Transfer of personal data from the UK to the US can, at least in theory, occur under Articles 45, 46 and 49. These all have different requirements. Article 15 of the GDPR the Right of access includes ...
User65535's user avatar
  • 7,572
0 votes
0 answers
21 views

What does being "informed of the appropriate safeguards pursuant to Article 46" mean?

Article 15 of the GDPR the Right of access includes section 2: Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be ...
User65535's user avatar
  • 7,572
0 votes
0 answers
57 views

Does the GDPR right to deletion in Art. 17 effectively include some "disproportionate effort" exception?

Some provisions of the GDPR have explicit exceptions about "disproportionate effort". Particularly relevant is the one in Article 19: The controller shall communicate any rectification or ...
User65535's user avatar
  • 7,572
0 votes
0 answers
67 views

Is it legal under GDPR for a website owner to link to their Google Calendar or WhatsApp for scheduling and communication?

I sometimes see websites that provide links to external services such as Google Calendar and WhatsApp for appointment scheduling and communication purposes. I also noticed these sites rarely document ...
Adrien's user avatar
  • 9