Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
922
questions
9
votes
1
answer
751
views
Is Facebook's new cookie banner GDPR compliant?
Today I visited Facebook from a Google search to find the following cookie banner at the top of the page:
To personalize content, tailor and measure ads, and provide a safer experience, we use ...
- 93
1
vote
1
answer
77
views
Required data entry seemingly against GDPR
From https://security.stackexchange.com/questions/186327/why-do-some-gdpr-emails-require-me-to-opt-out-and-some-to-opt-in :
As a consequence the "G29", the group of national data protection
...
- 504
3
votes
3
answers
760
views
According to GDPR, do I need a contract for processing on behalf with my e-mail provider?
It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster.
Now, I am wondering whether the same is true for the e-...
- 374
0
votes
1
answer
111
views
Does the GDPR enforce an age restriction?
Many services limit the age of users in europe to 16+ bases on the GDPR. Does the GDPR really forces them to do this?
- 2,845
3
votes
1
answer
126
views
GDPR and forums: "Lawfulness of processing" email addresses used only for providing the service
I run a small hobby message board that is entirely non-commercial.
People need to provide an email address to register and use that for logging in.
I do not use their email address for anything else (...
1
vote
0
answers
189
views
Under GDPR Data Processing Officer's email address bounces - what to do?
In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts.
So I had sent ...
- 203
5
votes
1
answer
195
views
With GDPR, can you request 'real life data' be deleted/forgotten?
For example, can you request libraries remove your name from books you have checked out?
- 151
3
votes
2
answers
3k
views
What counts as material or non-material damage under the GDPR?
In Art. 82 GDPR: Right to compensation and liability it states:
(1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the ...
- 1,026
4
votes
1
answer
288
views
GDPR Right to erasure vs mailing list archive?
Consider a mailing list like mailman or listserv. The archives of these mailing lists, due to quoting, will contain names and email addresses. Now, the GDP Article 17, unless I am mistaken obliges ...
- 388
0
votes
1
answer
2k
views
Do aggregated personal data fall under GDPR personal data rules?
If I have statistics on users location data (i.e. city, country, etc.) aggregated from hundreds or thousands of users, are there any restrictions on storing and using these data under GDPR? I plan to ...
- 101
2
votes
0
answers
358
views
Explanations for GDPR if no personal data is collected?
I have a website that is a travel search engine and I am very concerned about GDPR.
I am not interested in any private information from the users for marketing or such things. I just use Google ...
- 121
3
votes
1
answer
1k
views
GDPR: Are Anticheat Logs personal data?
We are running an online game server and use an automated system to detect cheaters. When a cheater gets banned a log will be saved containing the names of the algorithms that detected the cheater.
We ...
- 33
5
votes
1
answer
172
views
Does GDPR affect individual contributor license agreements for opensource projects?
I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example Apache 2.0. The gathered information when ...
- 171
7
votes
1
answer
185
views
Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?
I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation.
Anyway, if I ...
- 171
9
votes
3
answers
1k
views
Under GDPR, can I request to be forgotten and re-register for a trial?
Imagine an on-line service which offers 1 month of free trial for new users. Can I perpetually:
register for the trial, use it for a month
request my account deleted and my data forgotten
repeat
?
- 203
4
votes
1
answer
91
views
Do I have to send one of those emails after updating my privacy policy for GDPR?
We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?...
- 140
49
votes
2
answers
7k
views
Is requesting waiving the right to deletion of contributions against GDPR?
I just got one of those GDPR mails from gitlab.com, which pointed me to a Web page where I had to accept some terms and conditions. The same as everywhere, except this passage:
(For GitLab ...
- 533
4
votes
1
answer
164
views
Can a data controller change their privacy policy without explicit consent?
While I read one of the updated privacy policies (PP) this week, the following section of a privacy policy seemed… off:
We may change this Privacy Policy from time to time, and all changes will be ...
- 143
2
votes
0
answers
44
views
What happens to SARs recieved before the 25th May?
With GDPR requiring companies to respond to Subject Access Requests, within a month - my employer has now ensured we have processes to deal with any SAR recieved after the 25th of May.
However, in ...
- 234
5
votes
1
answer
252
views
Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?
How does GDPR apply to companies getting someone else's personal data from a legitimate source?
For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a ...
- 328
4
votes
3
answers
200
views
Android Application: Is purchaseToken defined under GDPR as PII?
In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using this API ) and saving purchaseToken on our server to validate his license.
...
- 41
4
votes
1
answer
990
views
Are hobby projects exempt from GDPR?
Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database.
GDPR ...
- 41
1
vote
1
answer
76
views
European nexus into U.S. through Google product?
I'm in the U.S. with my websites. I'm not under European Union jurisdiction unless my use of one or another Google product puts me under EU jurisdiction. I need to find out if any Google product gives ...
- 317
0
votes
1
answer
185
views
Autoresponders and GDPR - do they comply with the law?
Would it be GDPR compliant to have an autoresponder request opt-in permission?
For example, a customer makes an enquiry by sending an email to the company in question. The company in question then ...
2
votes
1
answer
545
views
Cookie compliance with GDPR when cookies don't collect the PII?
We are using Google Analytics and Facebook Login button (Which comes with preset Facebook Analytics).
So here is the question with Google Analytics we are not assigning users with GA UserID and IP ...
- 23
3
votes
2
answers
615
views
Is the GDPR applicable to data stored in human memory?
If data is stored in human memory, is the GDPR applicable?
Say, an employee of a company remembers an email address of a client, their date of birth, or even what their face looks like, does the ...
- 157
0
votes
1
answer
177
views
GPDR Soft opt-in requirements for pre-GDPR customers
The UK ICO documentation on GDPR definition of legitimate interest says that emails/text messages to existing customers – obtained using ‘soft opt-in’ are allowed.
From ICO Direct Marketing Guidance: ...
- 83
2
votes
1
answer
107
views
GDPR, email lists, a few email subscribers in the EU
Situation:
Say you are an organization that regularly sends out e-newsletter updates to an email list that has been curated over the years by people signing up at events and/or through online sign-up ...
- 2,790
1
vote
1
answer
218
views
Does GDPR apply to announcement/technical emails?
I work on a SaaS website offering both free, and paid subscriptions to B2C customers.
On it, I collect statistics, and emails(subscribed and double-opt-in users only)
As far as newsletters and ...
- 113
2
votes
2
answers
945
views
GDPR privacy policy - Data controller vs Data processor
I'm wondering if someone can shed some light on this for me please and help distinguish the differences between what I need to mention In my privacy policy for a data controller and data processor.
...
- 175
1
vote
2
answers
152
views
GDPR: what can I record about website visitors?
My use case is very simple. I have a website, on which I have articles that I wrote. It behooves me to learn about the people who visit my site so that I know what articles are popular and why, mainly....
- 111
1
vote
1
answer
836
views
GDPR and local data storage in mobile app
Let's say that I have a mobile app that tracks the user and saves his GPS coordinates locally only on a mobile device so that he can check where he was. The mobile application does not send this data ...
- 189
1
vote
2
answers
237
views
Can anonymized data be collected under GDPR without consent?
I am having an Android App in which I want to track the usage of the app. But the usage will not have anyone identity for eg. I would collect one user used my app for around 10 minutes but who is that ...
- 203
6
votes
1
answer
1k
views
GDPR - Do I have to log user's IP after consent for a cookie?
Do I really have to log a user's IP address and a timestamp after they consent to a cookie?
Log example: 20.05.2018 18:56:32 - 127.0.0.1 - Cookie accepted
I don't even need (I'm not using it in any ...
- 163
14
votes
4
answers
1k
views
What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?
My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of ...
- 242
5
votes
2
answers
907
views
Are server-logs reckoned as storing of personal data by website (GDPR)?
Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS). Should I state that in our privacy policy?
- 190
0
votes
1
answer
263
views
Opt Out Consent under GDPR
I am having an Android App which uses certain service such as Analytics, Ad Networks.
I am taking the consent from the user at when the app starts, i.e. before collecting any info.
But there are ...
- 203
1
vote
1
answer
431
views
Is it still legal to include an invitation based service in a program after GDPR?
I just started a cross-platform mobile application within users could invite other people to join as new users. The invitation would require the existing user to enter the new user's name (not ...
- 13
4
votes
2
answers
1k
views
Does GDPR apply to internal employees data?
Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has ...
- 234
0
votes
1
answer
233
views
Data Subject Rights under GDPR
I am having an Android App which uses Advertising networks and other Analytics services.
Now under the GDPR the data controller which is me in my case is required to provide some rights to the user ...
- 203
26
votes
2
answers
25k
views
How to satisfy GDPR's consent requirement for IP logging?
Countless websites are served by webserver software (Apache, nginx, etc.) which logs the source IP address of every web page visit. The GDPR considers an IP address "personal data" that is subject to ...
- 363
0
votes
1
answer
160
views
GDPR: Detecting duplicate accounts in online services with customer data
If I have a game or some other online service I host in which:
It is forbidden for a subscriber to hold more than one account, OR
Even if it is not forbidden, to detect one person on multiple ...
- 103
3
votes
1
answer
355
views
GDPR: Receiving marketing as precondition for receiving a free service, legitimate interest?
I am interested in the situation where a company provides a free service on condition that they can market to the customer (by electronic message) until the customer unsubscribes from the service.
...
- 83
7
votes
4
answers
1k
views
Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?
The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data:
by a natural person in the course of a ...
- 3,172
1
vote
1
answer
621
views
Parent company GDPR compliance
Situation:
Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
- 11
3
votes
1
answer
441
views
Should email addresses be anonymized/pseudonymized under GDPR?
GDPR states recommendation to pseudonymise or even anonymise Personal Data. A lot — most of — web sites and services require email address on signup.
Should, from the Data Controller's point of view, ...
- 131
1
vote
1
answer
57
views
GDPR - If am am allowing user to post on twitter and Facebook from my IOS app?
If am allowing user to post on twitter and Facebook from my IOS app, Do I have to get user consent ? If yes what do I have to mention in user consent ?
- 41
3
votes
2
answers
420
views
GDPR - A mobile App that allows user to store media do we have to option user consent?
I have a few doubts about GDPR law. If we are a mobile app, that allows user to store data inside our application like photos, videos, notes. etc., then do we have to get user consent or anything ...
- 41
3
votes
1
answer
112
views
Using Personal data before consent
I am having an Android App which is going to use some services such as Google Analytics, Firebase etc.
I have a thought of having two different consent screens for different region user such as EU ...
- 203
0
votes
1
answer
81
views
GDPR Retention - Secondary Database
GDPR requires retaining personal data after a certain time period defined based on the following clauses:
the current and future value of the information;
the costs, risks and liabilities associated ...
- 3