Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
55
questions with no upvoted or accepted answers
4
votes
1
answer
117
views
GDPR issues with Google sharing suspected child abuse images with law enforcement
I recently read of a man who had a Google account. His son's doctor asked for photos of a medical issue his son was having around his groin area, so his wife used his phone to take some. Google ...
- 1,722
3
votes
0
answers
50
views
Are apps required to notify users when they update their privacy policy or EULA?
I have noticed that many companies are doing this but definitely not all.
Furthermore, what about cases where companies or developers cannot notify users because some users are not logged-in or ...
- 151
2
votes
0
answers
65
views
Is there anything to stop a subject access requester from being barred by a business?
A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
- 4,663
2
votes
0
answers
54
views
GDPR data deletion: can I ask the company to delete the data it had exported in the United States?
I am located in Italy.
I have subscribed to a service and provided some PII that "could be exported in the United States".
If I send a GDPR request to delete my data, can I ask them to also ...
- 1,576
2
votes
0
answers
49
views
GDPR data deletion: do I have a right to have the company specify which data it retained and why?
I requested the DPO of a company to delete all my data under GDPR.
After a step of "account ownership" verification, it replied that:
XXXX has deleted all of your personal data except where ...
- 1,576
2
votes
0
answers
57
views
Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?
From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
- 447
2
votes
0
answers
328
views
Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?
It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
- 215
2
votes
0
answers
262
views
How to notify the use of cookies (Cookie Law Notice)
I have been investigating notifications about the use of cookies and a question has come up:
Why 99.9% of websites do not report correctly about the use of cookies and nothing happens?
With "...
- 133
2
votes
0
answers
145
views
Ebay - GDPR - Legality of re-assigning Data Controllers?
This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016.
According to Article 27 (...
2
votes
0
answers
356
views
Explanations for GDPR if no personal data is collected?
I have a website that is a travel search engine and I am very concerned about GDPR.
I am not interested in any private information from the users for marketing or such things. I just use Google ...
- 121
2
votes
0
answers
44
views
What happens to SARs recieved before the 25th May?
With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May.
However, in ...
- 234
2
votes
0
answers
113
views
GDPR and logging which user accessed which personal information
If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what ...
- 121
2
votes
0
answers
172
views
Who is the data controller of users' data of a SaaS platform?
Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU.
The B company uses the software to keep track of its customers, ...
- 121
2
votes
0
answers
69
views
GDPR - Right of Access From Processor
If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller?
If ...
1
vote
0
answers
43
views
Data representatives in EU, UK, Switzerland - are there more countries requiring this?
The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
- 1,392
1
vote
0
answers
158
views
Mendeley is encrypting my data on my hard disk with a key only available to them: can I ask for unencrypted data under GDPR?
I use Mendeley Desktop to manage my bibliography. Now I want to switch to Zotero.
Zotero used to be able to import the Mandeley's database. However, Mendeley 1.19 encrypted my data on my HDD with a ...
- 1,576
1
vote
0
answers
410
views
Twitter has no "delete account" button - no mention of data deletion after 30 days of account deactivation - GDPR and European law enforcement
I want to delete my Twitter account. I believe Article 17(1)(a) of GDPR compels Twitter to give me the option to do that.
But Twitter has no "delete account" button. There is only a "...
- 1,576
1
vote
0
answers
50
views
University diploma / various certificates under GDPR
Background: I'm considering building a web (focused to Europe) which, for one of it's part, would require users to upload their university diplomas and/or other similar certificates of achieved ...
- 111
1
vote
0
answers
184
views
Corporate responsibility when allowing biometric authentication
At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for ...
- 111
1
vote
0
answers
47
views
Is Apple's default Privacy settings GDPR compliant?
I recently realized that some apps were able to "link" my identity to Facebook. I checked my off facebook activity and could see some apps that I've never given my email.
Investigating ...
- 111
1
vote
0
answers
33
views
Company acquired a website with existing users. Is GDPR announcement obligatory?
When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
- 11
1
vote
0
answers
57
views
Is it obligatory to store ToS and Privacy Policy consent for a web app?
I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should".
So my ...
- 11
1
vote
0
answers
117
views
Replace User ID with pseudonym, still need consent?
I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy.
My goal is to avoid collecting any ...
- 111
1
vote
0
answers
79
views
To achieve ECTS credits at my school a student is forced to drop his/her right of privacy
Some background about the situation:
I attend a vocational university (university of applied sciences)
I live in the Netherlands - Europe
We have a mandatory activity that provides us with ECTS ...
- 111
1
vote
0
answers
59
views
A company finds out that it has made a material decision based on incorrect personal data, what should it do?
A company terminates an employee based on what it believes to be a record of the actions of person gained from log files.
Months later the company finds out that this information is not correct.
...
- 11
1
vote
0
answers
61
views
Minimal GDPR requirements for a website
Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options:
Agree
Decline
"Read more" link to a common page "What are cookies?"
Additionally I ...
- 111
1
vote
0
answers
218
views
Is geocoding an IP address but not storing it considered processing under GDPR?
As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address.
If I geocode the IP address to get the visitor's country and ...
- 111
1
vote
0
answers
522
views
Offering GDPR privacy policy for voice mail?
Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
- 1,136
1
vote
0
answers
189
views
Under GDPR Data Processing Officer's email address bounces - what to do?
In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts.
So I had sent ...
- 203
1
vote
0
answers
339
views
Can a developer have access to live data within GDPR?
Segregation of Duties in IT
I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
- 344
1
vote
0
answers
684
views
Is disclosure of subprocessors absolutely necessary under the GDPR?
Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors?
Must I absolutely declare this information in the appropriate manner or can I ...
- 11
1
vote
1
answer
117
views
Can my employer gather personal data without written consent
I'm located in the EU.
My employer recently became a contractor for an american company. We deal with software.
A requirement of the american company was that on all machine of the people working ...
- 11
1
vote
1
answer
68
views
to be in photo and video, and right to ask for removal these data relying on GDPR
At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs.
Now, I want my pictures to be erased, or any data, ...
user14943
0
votes
1
answer
51
views
Who is the data controller of footage taken on a retail worker’s personal phone?
An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer ...
- 4,663
0
votes
1
answer
51
views
Is just embedding YouTube thumbs GDPR conform?
Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?
0
votes
0
answers
33
views
MDR - Is an app that supports physiotherapy patients in doing their exercises regularly a medical device according to the MDR?
With the introduction of the medical device regulation (MDR), there is a lot of ambiguity about which risk-class specific software is. And developing a medical device is linked to a lot of work and ...
- 53
0
votes
0
answers
47
views
I do not understand the EU's requirement to have a GDPR representative located in the EU
I do not really understand the EU's requirement to have a GDPR representative located in the EU for a data controller and/or processor located outside the EU.
From the EU's point of view they ...
- 1,392
0
votes
0
answers
62
views
Mandatory languages for privacy policies in Japan (APPI)
I work on Apps, currently Android, which are distributed via Google Play.
As the EU has GDPR, in Japan they have APPI (Act on the Protection of Personal Information) which is something like the ...
- 1,392
0
votes
0
answers
77
views
Very simple static website with Google Analytics. How to make it GDPR compliant?
There is a very simple static website for a commerce. That website only shows information. It has Google Analytics to count visits with the default GA script placed in :
<head>
<script>...
0
votes
0
answers
33
views
GDPR legitimate interest and Contact Picker API
There is a draft web standard Contact Picker API see here and here. An explicit use case is "bootstrapping a user’s social graph for social networks". I'm interested in what ways this can ...
0
votes
0
answers
68
views
GDPR - Who Called Me type of situation
I would like to ask how does it work with GDPR and a service like "who called me".
Basically there are no publicly listed phone numbers as these kind of websites are using pretty much every ...
- 1
0
votes
0
answers
66
views
How to describe your experience in your CV/Resume without breaking copyright / GDPR rules?
Are there rules (EU & US) defining how far one can go in decribing his professional experience as a software developer, and telling about the projects he worked on?
For example, if I do not ...
- 101
0
votes
0
answers
98
views
Is it illegal to refuse to fix a hacked website?
Suppose there's a website or a server that has been hacked. There is no personal data stored anywhere, so there hasn't been a real data breach, because basically there's no valuable data to steal at ...
- 1,818
0
votes
0
answers
56
views
Is the Absence of Account deletion possibility legal in Europe? (GDPR)
This website explicitly states there is no easy way to "delete your account". It is accessible from within Europe.
How legal is this?
What would be my lever to force them to delete my ...
- 101
0
votes
0
answers
53
views
If a user of my site gives me info of a third party they claim to be affiliated with, am I allowed to contact that third party to check?
I am developing an app where a part of the on-boarding process requires users to enter the email / company name of the agency that they are affiliated with (the 3rd party). I need to confirm that they ...
- 109
0
votes
0
answers
83
views
Facebook vs GDPR - Is Facebook never deleting the Searches you do?
I frequently delete the Search History from my account's Activity Log.
However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past.
Suggestions ...
- 993
0
votes
0
answers
92
views
Is WhatsApp GDPR compliant as it allows backups for group chat?
Currently WhatsApp claims it uses end to end encryption.
However the app provisions users to switch on backups to Google Drive and other providers. So if I am in a group chat with a set of users and ...
- 101
0
votes
0
answers
43
views
Data Privacy: Should a user be allowed to change another users profile information?
In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)?
What laws (US & EU) would give guidance either way? ...
- 1
0
votes
0
answers
49
views
Question Regarding GDPR
I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
- 11
0
votes
0
answers
34
views
Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer
Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer ?
Is above fundamental right's affected by
Clauses in temporary employment contract like '...
- 27