Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
61
votes
2answers
4k views

How does SE's arbitration clause hold up under the GDPR?

Today the new Terms of Service of Stack Exchange have been released, sparking a lot of unrest about its arbitration clause; see the comments and answers on the linked meta above, and also this ...
45
votes
2answers
6k views

Is requesting waiving the right to deletion of contributions against GDPR?

I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage: (For GitLab ...
32
votes
2answers
5k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
29
votes
4answers
8k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
20
votes
2answers
7k views

Can I request a copy of my password hash with GDPR?

People often use personal information to create them, like first name / date of birth, and people often reuse passwords across several sites, so I guess passwords are considered personal data since ...
17
votes
4answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
17
votes
1answer
3k views

GDPR rights when subject dies; does family inherit subject rights?

Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.). What if the subject is deceased? Does the widow/widower or do the children ...
17
votes
4answers
8k views

GDPR - reCAPTCHA with user's consent?

This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data. I was reading briefly about ePrivacy regulations ...
15
votes
1answer
2k views

Can Slack really claim not to be a data controller?

I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response: Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
13
votes
3answers
2k views

Why can't I add a governing law to my terms of service to avoid GDPR?

I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
12
votes
4answers
645 views

What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
10
votes
2answers
6k views

How to satisfy GDPR's consent requirement for IP logging?

Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
10
votes
1answer
2k views

GDPR Compliance - notification of data breach

In Art. 33, the GDPR specifies that a controller must notify a personal data breach to the supervisory authority after having become aware of it. Case 1: A database dump with personal data is hosted ...
10
votes
1answer
890 views

Do cookie banners need to change for GDPR compliance?

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
10
votes
3answers
3k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
9
votes
1answer
1k views

Does GDPR cover the collection of data by websites that crawl the web and resell user data

I have found that a lot of my personal info is now available on a bunch of websites that collect data and resell it. I'm talking about those 'find anything about anyone' websites. A lot of the data ...
9
votes
3answers
665 views

GDPR - Withdrawn user consent

I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent. The user gives his consent to use his data and ...
9
votes
2answers
2k views

Would GDPR affect my own personal website?

I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public. As I am the only person who is in charge (my personal site), would I have to oblige to ...
8
votes
3answers
672 views

Under GDPR, can I request to be forgotten and re-register for a trial?

Imagine an on-line service which offers 1 month of free trial for new users. Can I perpetually: register for the trial, use it for a month request my account deleted and my data forgotten repeat ?
8
votes
2answers
653 views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
8
votes
2answers
164 views

Does GDPR Prohibit Reading Unsolicited Emails?

I originally asked this question on Information Security and it was suggested it was a better fit over here. I'm a member of the management committee of an allotment society in the UK. The committee ...
8
votes
1answer
2k views

Are internet forum posts considered personal data under GDPR?

GDPR defines "personal data" as any information relating to an identified or identifiable natural person. ‘personal data’ means any information relating to an identified or identifiable natural ...
8
votes
1answer
232 views

If I’ve no WhatsApp account am I still a node on their social graph? And if so can I request to be deleted?

I have never used WhatsApp so I have never shared my phone’s contacts with them or consented to their terms. Many of my friends and family do use WhatsApp and they will all have me in thier contacts ...
7
votes
2answers
3k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
7
votes
4answers
2k views

GDPR: are faces always considered identifiable information?

Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
7
votes
1answer
181 views

Deducing and using an email address under GDPR

I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this. The work email ...
7
votes
3answers
511 views

Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?

The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data: by a natural person in the course of a ...
7
votes
1answer
174 views

Under GDPR right of access, do I have the right to receive a copy of scoring sheets / evaluation forms after a structured job interview?

Under the GDPR right of access, what rights do I have to employer assessment of myself in the role of a job applicant after a structured job interview? Presumably, in a structured job interview ...
7
votes
1answer
132 views

Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?

I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation. Anyway, if I ...
7
votes
1answer
79 views

Is it sufficient to provide a privacy policy only in english language?

Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language? Is a translation necessary for every country of the EU ...
7
votes
1answer
629 views

Legal aspects of Firebase Crashlytics SDK

Let's say we have a mobile app, where every user is associated with app-generated unique user id (ex. 57d2ef8b391277001aad7784). Having the uuid itself that's not possible to identify a user. ...
6
votes
1answer
933 views

Is it okay to store user locations?

I know it might sound quite bad. But here I explain the whole situation. I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
6
votes
2answers
1k views

Does vehicle information count as personal data?

Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation? How about the VIN? (Vehicle Identification Number)
6
votes
4answers
202 views

Do internal annotations on user accounts fall under the GDPR?

In a platform such as Stack Exchange or any other moderated forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may ...
6
votes
1answer
398 views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
6
votes
2answers
502 views

Are GDPR-Walls legal?

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information. I see two possible legal problems: GDPR forbids coupling of ...
6
votes
2answers
433 views

Are server-logs reckoned as storing of personal data by website (GDPR)?

Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS). Should I state that in our privacy policy?
6
votes
1answer
254 views

What did Flybe actually do wrong?

Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc. They sent an email to this ...
6
votes
2answers
227 views

If photos are PII under GDPR, how are most photos on the web legal?

It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal ...
6
votes
3answers
176 views

Is it illegal to intentionally design a social network that can't comply with right-to-be-forgotten (and possibly other laws)?

If I intentionally design (and program) a social network that uses a technology (blockchain,...) which does not allow for alteration / erasing of user data, what happens in case of a right-to-be-...
6
votes
1answer
329 views

Is Facebook's new cookie banner GDPR compliant?

Today I visited Facebook from a Google search to find the following cookie banner at the top of the page: To personalize content, tailor and measure ads, and provide a safer experience, we use ...
6
votes
1answer
454 views

GDPR - Do I have to log user's IP after consent for a cookie?

Do I really have to log a user's IP address and a timestamp after they consent to a cookie? Log example: 20.05.2018 18:56:32 - 127.0.0.1 - Cookie accepted I don't even need (I'm not using it in any ...
6
votes
1answer
102 views

GDPR and personal data that gets crawled and ends up on other websites

Data controllers must delete the users' personal data if they are asked to do so, according to the GDPR, except in some cases that don't really apply here. But what if that personal data has ended up ...
6
votes
2answers
245 views

Are publicly available password dumps legal under GDPR

When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or ...
6
votes
1answer
346 views

Is throw-away-the-key-encryption allowed under GDPR?

Article 15 of the GDPR says: The data subject shall have the right to obtain [...] personal data [if it is being "processed"] Article 4 says that "processing" includes storage. Therefore, all ...
6
votes
1answer
364 views

GDPR and deleting users from wiki changelogs

According to the GDPR §17, users have a right to request the deletion of personal data. I am wondering how this applies to wikis. In my case, when users edit a page, that edit is associated with ...
6
votes
1answer
2k views

Are chat logs against the new european GDPR?

Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation? I know you can't save data which can be linked to a natural person ...
6
votes
3answers
577 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
6
votes
1answer
199 views

GDPR - am I a data controller as an app owner if I do not have access to the data?

Let's assume that I created a mobile app for iPhone that is tracking rides on a bike so that means the app is collecting GPS coordinates of the phone and later this mobile app shows some statistics ...
6
votes
1answer
485 views

Does GDPR Recital 15 exempt unstructured electronic data?

GDPR Recital 15 states that Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation. I ...