Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
60 votes
2 answers
5k views

How does SE's arbitration clause hold up under the GDPR?

Today the new Terms of Service of Stack Exchange have been released, sparking a lot of unrest about its arbitration clause; see the comments and answers on the linked meta above, and also this ...
  • 685
58 votes
4 answers
20k views

Does GDPR include UK customers, or not anymore?

Now that Brexit happened, does GDPR include UK customers, or not anymore?
  • 993
49 votes
2 answers
7k views

Is requesting waiving the right to deletion of contributions against GDPR?

I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage: (For GitLab ...
  • 533
41 votes
2 answers
8k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
35 votes
2 answers
6k views

How to store refusal of cookie consent

If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
  • 475
30 votes
4 answers
9k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
  • 419
30 votes
2 answers
5k views

Accessing public CCTV footage about you

Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
27 votes
2 answers
8k views

Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?

So, I've been receiving a lot of spammails recently and I'm pretty fed up with them. I've also been wondering, how they got access to my mail-address, so I sent a request of information so I can see, ...
25 votes
5 answers
16k views

Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?

I have recently come across this part of an app from a well-known US company: Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of ...
  • 359
25 votes
2 answers
24k views

How to satisfy GDPR's consent requirement for IP logging?

Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
  • 353
24 votes
2 answers
7k views

Can I request a copy of my password hash with GDPR?

People often use personal information to create them, like first name / date of birth, and people often reuse passwords across several sites, so I guess passwords are considered personal data since ...
23 votes
3 answers
10k views

In Europe, can I refuse to use Gsuite / Office365 at work?

See above. In a country where GDPR applies (Italy in my case), do I have the right to refuse giving consent to Google and Microsoft to store my personal data, if this account is for work use? Or, in ...
22 votes
2 answers
2k views

Other use of profile photos: legality fair-use and permissions

I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). ...
22 votes
2 answers
3k views

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
  • 231
22 votes
1 answer
6k views

Am I obligated to decrypt lots of data for GDPR requests?

I am providing a B2B service where customer data of businesses are stored in an SQL table. As I never need to query for this personal data, the data at rest there is asymmetrically encrypted with the ...
21 votes
4 answers
15k views

GDPR - reCAPTCHA with user's consent?

This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data. I was reading briefly about ePrivacy regulations ...
  • 311
20 votes
2 answers
27k views

Do the GDPR and Cookie-Law regulations apply to localStorage?

We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
  • 303
18 votes
1 answer
4k views

GDPR rights when subject dies; does family inherit subject rights?

Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.). What if the subject is deceased? Does the widow/widower or do the children ...
  • 1,327
17 votes
4 answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
  • 447
17 votes
1 answer
3k views

Can Slack really claim not to be a data controller?

I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response: Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
  • 271
15 votes
3 answers
3k views

GDPR & Blocking EU Visitors?

I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
  • 205
15 votes
2 answers
5k views

Does GDPR apply if my web app stores personal data on the user's phone only?

My web app stores personal data about the user, but on the user's phone only (HTML5 Local Storage). The data is never touched by any server or database. I can't see the data. My server can't see the ...
  • 253
15 votes
3 answers
12k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
  • 993
15 votes
2 answers
5k views

Would GDPR affect my own personal website?

I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public. As I am the only person who is in charge (my personal site), would I have to oblige to ...
  • 271
14 votes
3 answers
2k views

Why can't I add a governing law to my terms of service to avoid GDPR?

I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
  • 141
14 votes
1 answer
2k views

How can consent-banner as a service be GDPR compliant?

A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
  • 243
14 votes
4 answers
1k views

What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
13 votes
6 answers
5k views

What should a website do if the end user refuses to accept the necessary cookies?

Suppose that a data controller chooses the consent legal basis for GDPR article 6 purposes. Then, the data controller says something along these lines in a cookie consent banner on their website: We ...
13 votes
1 answer
3k views

Does the German GDPR require storing the data in a German datacenter for a tele-health company?

I co-founded a tele-health startup, we are expanding to Germany, we have gone through the GDPR, and implemented most of it, however, we didn't quite understand the data residency part and found ...
  • 233
13 votes
2 answers
3k views

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member. I will explain the best I can: ...
13 votes
5 answers
2k views

Are auto-generated identifiers PII if they cannot be linked to an identity?

The reason for this post is to express a contradiction that seems to be widespread in some places on the internet. I'm not a lawyer, I'm a software developer doing my best to comply with the GDPR and ...
  • 313
13 votes
2 answers
3k views

Why does the GDPR matter to me, a US citizen with no property in Europe?

I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
  • 11.3k
13 votes
2 answers
2k views

Does the Companies Act 2006 trump an individual's right to be forgotten?

I once was a contractor and ran a limited company. At the time all my details and my secretary's were published on the Companies House website. edit: This information includes full names and addresses....
  • 241
12 votes
5 answers
4k views

How can I get more than 10 years of transaction history from my bank?

I will shamefully admit that it was only in the year 2021 that I finally built my own bookkeeping system. Yes, I should have done it 10-20 years ago, but I didn't. So now I'm in this situation: First ...
  • 147
12 votes
5 answers
4k views

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

Service providers like Google and Facebook are pretty much part of people's lives. Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
  • 1,471
12 votes
2 answers
2k views

Are users' personal notes about other users subjected to the GDPR right of access?

Some applications, like Discord or Mastodon, allow a user A to put private notes (only accessible to A) next to the profile of another user B. This data is very probably Personal Identifiable ...
12 votes
1 answer
1k views

Is an email enumeration vulnerability a breach of GDPR?

I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows: User inputs their email If the email belongs to an existing user, ...
  • 163
11 votes
4 answers
4k views

Is there a way to determine if an email address is personal information?

The GDPR defines personal data as: Personal data is information that relates to an identified or identifiable individual. My understanding is that this means that firstname.lastname@example.com is ...
  • 3,338
11 votes
4 answers
4k views

Do I need to present a GDPR banner to IP addresses outside of GDPR regions?

The context of my question comes from this comment: The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The ...
11 votes
4 answers
1k views

Do cookie banners need to change for GDPR compliance?

Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
11 votes
2 answers
7k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
  • 113
11 votes
2 answers
1k views

To comply to GDPR, are social networks required to have a button to "Export your Data"?

Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
  • 993
11 votes
1 answer
2k views

GDPR Compliance - notification of data breach

In Art. 33, the GDPR specifies that a controller must notify a personal data breach to the supervisory authority after having become aware of it. Case 1: A database dump with personal data is hosted ...
  • 211
10 votes
6 answers
4k views

GDPR and right to provide meter readings

My energy company have estimated the opening meter readings for my move in date for a property. I have the correct readings in photos taken on that date, but the energy company won't allow me to ...
  • 277
10 votes
3 answers
3k views

Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?

Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store. Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head ...
10 votes
2 answers
3k views

Can a company actually become GDPR compliant? Is there such a thing?

(This question could be expanded to other auditing procedures too) How do huge multinational companies that want to become GDPR compliant start off this? I mean, I guess one has to read the regulation,...
  • 103
10 votes
2 answers
3k views

Can I store the names of arbitrary business associates in my CRM system?

I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships. For example, "Gina works on reception." Is this allowed ...
10 votes
2 answers
1k views

GDPR - Are technical identifiers personal data?

I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
  • 203
10 votes
1 answer
739 views

What actions to take when a Data Processor doesn't respect GDPR?

We've recently exchanged emails with one of our Data Processors, because they don't grant the ability to permanently delete hosted documents (pdf, png, etc.) on their platform. Such documents might ...
9 votes
2 answers
2k views

GDPR & EPR regards maintaining email blacklist

Note a user call YIVI had previously stated that you could store a hash of the users email address to avoid the requirements of General Data Protection Regulation (GDRP) and ePrivacy Directive (EPD). ...
user avatar

1
2 3 4 5
18