We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

49 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
47 views

Is Google's privacy policy compliant with GDPR for the data processing agreement between a controller and a processor?

If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google ...
4
votes
0answers
61 views

Do I have to send one of those emails after updating my privacy policy for GDPR?

We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?...
3
votes
1answer
96 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
2
votes
0answers
54 views

Does LinkedIn act illegally if asking me whether I want to share my email contacts and send them invitations?

From time to time LinkedIn asks me whether I would like upload emails of my contacts. In terms of GDPR I would say it is not allowed action if I do not have signatures of my contacts that they agree I ...
2
votes
0answers
56 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
2
votes
0answers
84 views

How to notify the use of cookies (Cookie Law Notice)

I have been investigating notifications about the use of cookies and a question has come up: Why 99.9% of websites do not report correctly about the use of cookies and nothing happens? With "...
2
votes
0answers
79 views

Ebay - GDPR - Legality of re-assigning Data Controllers?

This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016. According to Article 27 (...
2
votes
0answers
31 views

GDPR which practice is compliant?

I have seen many ways of requiring user acceptance of their data usage on the internet. Which are conforming? Keep in mind I am talking just about the consent acquiring mechanism. In order from the ...
2
votes
0answers
259 views

Explanations for GDPR if no personal data is collected?

I have a website that is a travel search engine and I am very concerned about GDPR. I am not interested in any private information from the users for marketing or such things. I just use Google ...
2
votes
0answers
42 views

What happens to SARs recieved before the 25th May?

With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May. However, in ...
2
votes
0answers
93 views

GDPR and logging which user accessed which personal information

If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what ...
2
votes
0answers
75 views

Who is the data controller of users' data of a SaaS platform?

Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU. The B company uses the software to keep track of its customers, ...
2
votes
0answers
60 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
1
vote
0answers
41 views

GDPR in a scientific, transborder scenario

Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole ...
1
vote
0answers
33 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
1
vote
1answer
68 views

does the GDPR apply to publicly available data?

There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little ...
1
vote
0answers
45 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
1
vote
0answers
58 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
1
vote
0answers
99 views

Is opt-in now required for iOS app using Fabric/Crashlytics/Flurry due to GDPR?

It's been a while since I last pushed out an app to the iOS store, and since then the new EU requirements for data protection General Data Protection Regulation Compliance, GDPR, came into force. Most ...
1
vote
0answers
55 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
1
vote
0answers
43 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
1
vote
0answers
63 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
1
vote
0answers
196 views

GDPR: How does Airbnb get away with their signup form?

We're looking at making our signup form GDPR friendly along with sending users more timely, personalised marketing and account update emails. Asking if a user wants to receive all these different ...
1
vote
1answer
117 views

GDPR - Recording simple page views

We are currently using google analytics to track our site. The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the ...
1
vote
0answers
51 views

Derogation for small companies in GDPR

Question What does Recital 13 in GDPR make exempt? refers to Article 30 on the technical definition on record keeping. But I am interested in another aspect of this sentence: To take account of ...
1
vote
1answer
179 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
1
vote
0answers
61 views

Russian bank calling Russian citizen who is tourist in EU - GDPR issues

Let's say I'm Russian citizen (no dual citizenship) and on a tourist visa in the EU. I got a call on my roaming Russian mobile phone number from a Russian bank who tries to offer me a new product. I'm ...
1
vote
0answers
298 views

Offering GDPR privacy policy for voice mail?

Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
1
vote
0answers
169 views

Under GDPR Data Processing Officer's email address bounces - what to do?

In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts. So I had sent ...
1
vote
1answer
359 views

Parent company GDPR compliance

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
1
vote
0answers
57 views

How does GDPR affect me if I am processing 3rd Party Data for My IOS App?

We are updating our app based on GDPR and as per GDPR, the user has Right to Access data anytime. In My IOS App we are using FitBit's Data after taking User Consent. Now my question is: When the ...
1
vote
0answers
170 views

Can a developer have access to live data within GDPR?

Segregation of Duties in IT I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
1
vote
0answers
491 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
1
vote
0answers
70 views

Are data processors allowed to locally store live customer information for testing GDPR

We develop software for another company and use their live data to test our applications locally before they go live. This means we keep live customer information on office computers. Will this be ...
1
vote
1answer
96 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
1
vote
1answer
63 views

to be in photo and video, and right to ask for removal these data relying on GDPR

At the beginning of 2010s, with a consent through email, I gave permission to some people, to put my pictures in a catalog, or online catalogs. Now, I want my pictures to be erased, or any data, ...
0
votes
1answer
27 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
0
votes
0answers
42 views

Does USA have a law similar to GDPR that gives you the right to a copy of the information a religious organization has on you?

For some background: the EU "Data Protection Directive" is a European Union directive which regulates the processing of personal data within the European Union, as explained in this Wikipedia article. ...
0
votes
0answers
43 views

Question Regarding GDPR

I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
0
votes
0answers
13 views

Are previous communiication preferences retained with form submissions?

I'm trying to understand the correct procedure when dealing with storing a users email subscription types, and the behaviour in relation to legitimate interest and consent to communicate. And the ...
0
votes
0answers
13 views

Complying with GDPR when storing emails and IPs for a refferal campaign

I want to start an email referral campaign to collect emails for the upcoming launch of a videogame and was warned that I need to comply with the GDPR rules of privacy. I'll be storing the email ...
0
votes
0answers
36 views

Single sign on via cookies and GDPR compliance?

Going to call my two sites "identity provider" and "WordPress site". Flow is: User logs in on identity provider User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token ...
0
votes
0answers
35 views

How does GDPR apply for normal email communication?

I am a member in an association and in charge of membership management and general IT. We exchange information about the work of the association by email using private mailing lists the association ...
0
votes
0answers
12 views

Do you have to provide information about processing personal data for contact persons?

Two companies write a legal agreement between themselves and contain contact details of their representatives in its content. Assuming that these contact details are personal data, are these companies ...
0
votes
0answers
27 views

Cause of action for data processor where the data controller neglects to notify supervisory authority

By reading the GDPR I have gathered that a data processor is obligated to notify the data controller of a breach within 72 hours and the data controller is likewise obligated to notify the supervisory ...
0
votes
0answers
31 views

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer ? Is above fundamental right's affected by Clauses in temporary employment contract like '...
0
votes
0answers
26 views

Changes to the privacy policy that require the user's consent: GDPR compliance

Suppose you have an online service, with a privacy policy that the users have accepted. Then at some point you want to introduce some changes to that privacy policy, in a way that requires the user's ...
0
votes
0answers
27 views

How do platform sites ensure their users do not abuse forwarded user data?

I am asking this question based upon the specific case of open source software sites, but the concept should probably apply equally to other websites that serve as a "platform" for their users to ...
0
votes
1answer
101 views

GDPR and a cell phone paid through work?

Company Contacts page From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B. For instance my private email is regulated by GDPR, but my work ...