Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
896
questions
60
votes
2
answers
5k
views
How does SE's arbitration clause hold up under the GDPR?
Today the new Terms of Service of Stack Exchange have been released, sparking a lot of unrest about its arbitration clause; see the comments and answers on the linked meta above, and also this ...
- 685
58
votes
4
answers
20k
views
Does GDPR include UK customers, or not anymore?
Now that Brexit happened, does GDPR include UK customers, or not anymore?
- 993
49
votes
2
answers
7k
views
Is requesting waiving the right to deletion of contributions against GDPR?
I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage:
(For GitLab ...
- 533
41
votes
2
answers
8k
views
GDPR + git history
Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required?
Git is a ...
- 511
35
votes
2
answers
6k
views
How to store refusal of cookie consent
If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
- 475
30
votes
4
answers
9k
views
ISP is not hashing the password I log in with online. Should I take any action?
I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
- 419
30
votes
2
answers
5k
views
Accessing public CCTV footage about you
Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
- 439
27
votes
2
answers
8k
views
Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?
So, I've been receiving a lot of spammails recently and I'm pretty fed up with them.
I've also been wondering, how they got access to my mail-address, so I sent a request of information so I can see, ...
- 373
25
votes
5
answers
16k
views
Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?
I have recently come across this part of an app from a well-known US company:
Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of ...
- 359
25
votes
2
answers
24k
views
How to satisfy GDPR's consent requirement for IP logging?
Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
- 353
24
votes
2
answers
7k
views
Can I request a copy of my password hash with GDPR?
People often use personal information to create them, like first name / date of birth, and people often reuse passwords across several sites, so I guess passwords are considered personal data since ...
- 341
23
votes
3
answers
10k
views
In Europe, can I refuse to use Gsuite / Office365 at work?
See above. In a country where GDPR applies (Italy in my case), do I have the right to refuse giving consent to Google and Microsoft to store my personal data, if this account is for work use? Or, in ...
- 502
22
votes
2
answers
2k
views
Other use of profile photos: legality fair-use and permissions
I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). ...
- 349
22
votes
2
answers
3k
views
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
- 231
22
votes
1
answer
6k
views
Am I obligated to decrypt lots of data for GDPR requests?
I am providing a B2B service where customer data of businesses are stored in an SQL table.
As I never need to query for this personal data, the data at rest there is asymmetrically encrypted with the ...
- 323
21
votes
4
answers
15k
views
GDPR - reCAPTCHA with user's consent?
This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data.
I was reading briefly about ePrivacy regulations ...
- 311
20
votes
2
answers
27k
views
Do the GDPR and Cookie-Law regulations apply to localStorage?
We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
- 303
18
votes
1
answer
4k
views
GDPR rights when subject dies; does family inherit subject rights?
Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.).
What if the subject is deceased? Does the widow/widower or do the children ...
- 1,327
17
votes
4
answers
6k
views
Under GDPR, can I give permission once to allow everyone to store and process my data?
If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
- 447
17
votes
1
answer
3k
views
Can Slack really claim not to be a data controller?
I'm an EU resident. I just sent in a GDPR removal request to Slack. Their response:
Per our Terms of Service and Privacy Policy, your Workspace Primary Owner (Customer) controls Customer Data. ...
- 271
15
votes
3
answers
3k
views
GDPR & Blocking EU Visitors?
I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
- 205
15
votes
2
answers
5k
views
Does GDPR apply if my web app stores personal data on the user's phone only?
My web app stores personal data about the user, but on the user's phone only (HTML5 Local Storage). The data is never touched by any server or database. I can't see the data. My server can't see the ...
- 253
15
votes
3
answers
12k
views
Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers
I asked this question to Facebook:
I would like to know how can I permanently delete private messages
from both sides of the conversation. For example, conversations I had
in the past with ...
- 993
15
votes
2
answers
5k
views
Would GDPR affect my own personal website?
I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public.
As I am the only person who is in charge (my personal site), would I have to oblige to ...
- 271
14
votes
3
answers
2k
views
Why can't I add a governing law to my terms of service to avoid GDPR?
I've heard from fairly reliable sources that you can't avoid GDPR by using your website's terms of service as way to circumvent that law. From what I have seen online, if your website serves European ...
- 141
14
votes
1
answer
2k
views
How can consent-banner as a service be GDPR compliant?
A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
- 243
14
votes
4
answers
1k
views
What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?
My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
- 242
13
votes
6
answers
5k
views
What should a website do if the end user refuses to accept the necessary cookies?
Suppose that a data controller chooses the consent legal basis for GDPR article 6 purposes.
Then, the data controller says something along these lines in a cookie consent banner on their website:
We ...
- 399
13
votes
1
answer
3k
views
Does the German GDPR require storing the data in a German datacenter for a tele-health company?
I co-founded a tele-health startup, we are expanding to Germany,
we have gone through the GDPR, and implemented most of it, however, we didn't quite understand the data residency part and found ...
- 233
13
votes
2
answers
3k
views
Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?
This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member.
I will explain the best I can:
...
- 141
13
votes
5
answers
2k
views
Are auto-generated identifiers PII if they cannot be linked to an identity?
The reason for this post is to express a contradiction that seems to be widespread in some places on the internet.
I'm not a lawyer, I'm a software developer doing my best to comply with the GDPR and ...
- 313
13
votes
2
answers
3k
views
Why does the GDPR matter to me, a US citizen with no property in Europe?
I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
- 11.3k
13
votes
2
answers
2k
views
Does the Companies Act 2006 trump an individual's right to be forgotten?
I once was a contractor and ran a limited company.
At the time all my details and my secretary's were published on the Companies House website.
edit: This information includes full names and addresses....
- 241
12
votes
5
answers
4k
views
How can I get more than 10 years of transaction history from my bank?
I will shamefully admit that it was only in the year 2021 that I finally built my own bookkeeping system. Yes, I should have done it 10-20 years ago, but I didn't. So now I'm in this situation:
First ...
- 147
12
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 1,471
12
votes
2
answers
2k
views
Are users' personal notes about other users subjected to the GDPR right of access?
Some applications, like Discord or Mastodon, allow a user A to put private notes (only accessible to A) next to the profile of another user B. This data is very probably Personal Identifiable ...
- 123
12
votes
1
answer
1k
views
Is an email enumeration vulnerability a breach of GDPR?
I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows:
User inputs their email
If the email belongs to an existing user, ...
- 163
11
votes
4
answers
4k
views
Is there a way to determine if an email address is personal information?
The GDPR defines personal data as:
Personal data is information that relates to an identified or identifiable individual.
My understanding is that this means that firstname.lastname@example.com is ...
- 3,338
11
votes
4
answers
4k
views
Do I need to present a GDPR banner to IP addresses outside of GDPR regions?
The context of my question comes from this comment:
The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The ...
- 271
11
votes
4
answers
1k
views
Do cookie banners need to change for GDPR compliance?
Many sites these days display a "cookie banner" which declares that cookies are being used on the site, generally with a link to a policy document, which state that continued use of the site amounts ...
11
votes
2
answers
7k
views
Is hash of a username still personal data?
I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
- 113
11
votes
2
answers
1k
views
To comply to GDPR, are social networks required to have a button to "Export your Data"?
Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
- 993
11
votes
1
answer
2k
views
GDPR Compliance - notification of data breach
In Art. 33, the GDPR specifies that a controller must notify a personal data breach to the supervisory authority after having become aware of it.
Case 1: A database dump with personal data is hosted ...
- 211
10
votes
6
answers
4k
views
GDPR and right to provide meter readings
My energy company have estimated the opening meter readings for my move in date for a property.
I have the correct readings in photos taken on that date, but the energy company won't allow me to ...
- 277
10
votes
3
answers
3k
views
Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?
Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store.
Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head ...
10
votes
2
answers
3k
views
Can a company actually become GDPR compliant? Is there such a thing?
(This question could be expanded to other auditing procedures too)
How do huge multinational companies that want to become GDPR compliant start off this? I mean, I guess one has to read the regulation,...
- 103
10
votes
2
answers
3k
views
Can I store the names of arbitrary business associates in my CRM system?
I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships.
For example, "Gina works on reception."
Is this allowed ...
- 111
10
votes
2
answers
1k
views
GDPR - Are technical identifiers personal data?
I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
- 203
10
votes
1
answer
739
views
What actions to take when a Data Processor doesn't respect GDPR?
We've recently exchanged emails with one of our Data Processors, because they don't grant the ability to permanently delete hosted documents (pdf, png, etc.) on their platform. Such documents might ...
- 201
9
votes
2
answers
2k
views
GDPR & EPR regards maintaining email blacklist
Note a user call YIVI had previously stated that you could store a hash of the users email address to avoid the requirements of General Data Protection Regulation (GDRP) and ePrivacy Directive (EPD). ...
user32690