Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
969
questions
63
votes
2
answers
5k
views
How does SE's arbitration clause hold up under the GDPR?
Today the new Terms of Service of Stack Exchange have been released, sparking a lot of unrest about its arbitration clause; see the comments and answers on the linked meta above, and also this ...
- 715
59
votes
4
answers
20k
views
Does GDPR include UK customers, or not anymore?
Now that Brexit happened, does GDPR include UK customers, or not anymore?
- 1,003
49
votes
2
answers
7k
views
Is requesting waiving the right to deletion of contributions against GDPR?
I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage:
(For GitLab ...
- 533
42
votes
2
answers
8k
views
GDPR + git history
Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required?
Git is a ...
- 521
36
votes
2
answers
6k
views
How to store refusal of cookie consent
If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
30
votes
4
answers
9k
views
ISP is not hashing the password I log in with online. Should I take any action?
I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
- 419
30
votes
2
answers
5k
views
Accessing public CCTV footage about you
Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
- 429
27
votes
2
answers
27k
views
How to satisfy GDPR's consent requirement for IP logging?
Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
- 373
26
votes
2
answers
8k
views
Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?
So, I've been receiving a lot of spammails recently and I'm pretty fed up with them.
I've also been wondering, how they got access to my mail-address, so I sent a request of information so I can see, ...
- 363
26
votes
5
answers
16k
views
Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?
I have recently come across this part of an app from a well-known US company:
Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of ...
- 369
24
votes
2
answers
7k
views
Can I request a copy of my password hash with GDPR?
People often use personal information to create them, like first name / date of birth, and people often reuse passwords across several sites, so I guess passwords are considered personal data since ...
- 341
23
votes
2
answers
2k
views
Other use of profile photos: legality fair-use and permissions
I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). ...
- 351
23
votes
3
answers
10k
views
In Europe, can I refuse to use Gsuite / Office365 at work?
See above. In a country where GDPR applies (Italy in my case), do I have the right to refuse giving consent to Google and Microsoft to store my personal data, if this account is for work use? Or, in ...
- 684
22
votes
2
answers
4k
views
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
- 231
22
votes
1
answer
6k
views
Am I obligated to decrypt lots of data for GDPR requests?
I am providing a B2B service where customer data of businesses are stored in an SQL table.
As I never need to query for this personal data, the data at rest there is asymmetrically encrypted with the ...
- 323
22
votes
2
answers
32k
views
Do the GDPR and Cookie-Law regulations apply to localStorage?
We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
- 323
22
votes
4
answers
15k
views
GDPR - reCAPTCHA with user's consent?
This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data.
I was reading briefly about ePrivacy regulations ...
- 321
20
votes
2
answers
4k
views
Are global user account systems now illegal following the EU's May 2023 fine of Meta?
The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta
Like any website, we have an account system where people log in to access their ...
- 303
18
votes
1
answer
4k
views
GDPR rights when subject dies; does family inherit subject rights?
Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.).
What if the subject is deceased? Does the widow/widower or do the children ...
- 1,368
17
votes
4
answers
6k
views
Under GDPR, can I give permission once to allow everyone to store and process my data?
If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
- 457
17
votes
1
answer
3k
views
Can Slack really claim not to be a data controller?
I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response:
Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
- 271
16
votes
5
answers
7k
views
Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?
On day one of my first year in high school me and basically every other students were given a few documents to sign. One of them included a clause that allowed the school to publish pictures of us ...
- 161
16
votes
2
answers
4k
views
Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?
The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
- 5,868
15
votes
2
answers
5k
views
Does GDPR apply if my web app stores personal data on the user's phone only?
My web app stores personal data about the user, but on the user's phone only (HTML5 Local Storage). The data is never touched by any server or database. I can't see the data. My server can't see the ...
- 253
15
votes
3
answers
13k
views
Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers
I asked this question to Facebook:
I would like to know how can I permanently delete private messages
from both sides of the conversation. For example, conversations I had
in the past with ...
- 1,003
15
votes
2
answers
5k
views
Would GDPR affect my own personal website?
I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public.
As I am the only person who is in charge (my personal site), would I have to oblige to ...
- 271
14
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 1,491
14
votes
3
answers
3k
views
GDPR & Blocking EU Visitors?
I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
- 197
14
votes
3
answers
2k
views
Why can't I add a governing law to my terms of service to avoid GDPR?
I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
- 141
14
votes
2
answers
3k
views
Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?
This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member.
I will explain the best I can:
...
- 151
14
votes
1
answer
2k
views
How can consent-banner as a service be GDPR compliant?
A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
- 243
14
votes
4
answers
1k
views
What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?
My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
- 242
13
votes
1
answer
4k
views
Does the German GDPR require storing the data in a German datacenter for a tele-health company?
I co-founded a tele-health startup, we are expanding to Germany,
we have gone through the GDPR, and implemented most of it, however, we didn't quite understand the data residency part and found ...
- 233
13
votes
5
answers
3k
views
Are auto-generated identifiers PII if they cannot be linked to an identity?
The reason for this post is to express a contradiction that seems to be widespread in some places on the internet.
I'm not a lawyer, I'm a software developer doing my best to comply with the GDPR and ...
- 293
12
votes
4
answers
5k
views
How can I get more than 10 years of transaction history from my bank?
I will shamefully admit that it was only in the year 2021 that I finally built my own bookkeeping system. Yes, I should have done it 10-20 years ago, but I didn't. So now I'm in this situation:
First ...
- 147
12
votes
6
answers
7k
views
What should a website do if the end user refuses to accept the necessary cookies?
Suppose that a data controller chooses the consent legal basis for GDPR article 6 purposes.
Then, the data controller says something along these lines in a cookie consent banner on their website:
We ...
- 371
12
votes
2
answers
3k
views
Why does the GDPR matter to me, a US citizen with no property in Europe?
I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
- 13.7k
12
votes
2
answers
2k
views
Does the Companies Act 2006 trump an individual's right to be forgotten?
I once was a contractor and ran a limited company.
At the time all my details and my secretary's were published on the Companies House website.
edit: This information includes full names and addresses....
- 231
12
votes
1
answer
1k
views
Is an email enumeration vulnerability a breach of GDPR?
I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows:
User inputs their email
If the email belongs to an existing user, ...
- 173
11
votes
2
answers
2k
views
Are users' personal notes about other users subjected to the GDPR right of access?
Some applications, like Discord or Mastodon, allow a user A to put private notes (only accessible to A) next to the profile of another user B. This data is very probably Personal Identifiable ...
- 113
11
votes
5
answers
2k
views
GDPR: Can a city request deletion of all personal data that uses a certain domain for logins?
A city in Finland asked me to delete all data for everyone whose login uses a certain domain. The domain contains "edu" in it and "oppilas" (which translates to "student")...
- 211
11
votes
4
answers
1k
views
Do cookie banners need to change for GDPR compliance?
Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
11
votes
2
answers
7k
views
Is hash of a username still personal data?
I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
- 213
11
votes
2
answers
1k
views
To comply to GDPR, are social networks required to have a button to "Export your Data"?
Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
- 1,003
10
votes
4
answers
5k
views
Is there a way to determine if an email address is personal information?
The GDPR defines personal data as:
Personal data is information that relates to an identified or identifiable individual.
My understanding is that this means that [email protected] is ...
- 5,868
10
votes
2
answers
4k
views
Is a "login timestamp" considered as personal data according to GDPR?
If software is saving the timestamp of the last login of a user, would that timestamp itself be considered personal data by GDPR?
- 233
10
votes
6
answers
4k
views
GDPR and right to provide meter readings
My energy company have estimated the opening meter readings for my move in date for a property.
I have the correct readings in photos taken on that date, but the energy company won't allow me to ...
- 305
10
votes
4
answers
5k
views
Do I need to present a GDPR banner to IP addresses outside of GDPR regions?
The context of my question comes from this comment:
The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The ...
- 261
10
votes
3
answers
3k
views
Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?
Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store.
Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head ...
10
votes
2
answers
3k
views
Can a company actually become GDPR compliant? Is there such a thing?
(This question could be expanded to other auditing procedures too)
How do huge multinational companies that want to become GDPR compliant start off this? I mean, I guess one has to read the regulation,...
- 103