Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
2 votes
0 answers
69 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
5 votes
5 answers
9k views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
  • 159
9 votes
1 answer
751 views

GDPR and deleting users from wiki changelogs

According to the GDPR §17, users have a right to request the deletion of personal data. I am wondering how this applies to wikis. In my case, when users edit a page, that edit is associated with ...
5 votes
2 answers
978 views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
  • 151
0 votes
1 answer
127 views

How does one exercise their GDPR related rights?

In May, GDPR will become effective and have a global impact on how personal data is handled. Article 20 of the GDPR requires complying systems provide Data Portability. If a European citizen was to ...
4 votes
1 answer
158 views

As a web and mobile (iOS and Android) developer, how do I discover if GDPR applies to a user?

This is a really basic question about GDPR. If I have products that are intended only for US customers, but can be accessed by European Union residents, does GDPR apply? More specific example: A ...
  • 151
9 votes
2 answers
6k views

GDPR Compliance - does it extend to database backups and archived records?

How do the rules for GDPR affect database backups or archived data?As a company, you might have backups/archived data going back years. Based on the rules, when an individual invokes "forget me", it ...
  • 193
3 votes
3 answers
9k views

How to handle CVs / resumes with GDPR rules?

As a consultant my resume is personal information which is handed out to prospective clients frequently. How personal should it be? Should some data be anonymized? Should the resume be returned from ...
  • 344
8 votes
2 answers
7k views

Does vehicle information count as personal data?

Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation? How about the VIN? (Vehicle Identification Number)
2 votes
2 answers
337 views

GDPR seeking consent - Subjects not responding to the consent email

We have currently sent out emails to gain consent from subjects to receive our marketing content. For subjects who don't respond, can we send another email chasing the consent? (i feel doing this can ...
5 votes
1 answer
777 views

GDPR impact on genealogy website / uncontrolled user data

The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is ...
  • 151
4 votes
1 answer
238 views

GDPR email consent - Pre ticked "No" box

We are currently creating an email to gain consent from our customers to email allow us to market to them. We are currently using Mailchimp to put the email together and it is currently not allowing ...
5 votes
2 answers
305 views

GDPR with refusing medical information

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing ...
  • 328
7 votes
1 answer
4k views

Are chat logs against the new european GDPR?

Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation? I know you can't save data which can be linked to a natural person ...
  • 173
6 votes
1 answer
293 views

What did Flybe actually do wrong?

Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc. They sent an email to this ...
  • 67
8 votes
1 answer
420 views

If I’ve no WhatsApp account am I still a node on their social graph? And if so can I request to be deleted?

I have never used WhatsApp so I have never shared my phone’s contacts with them or consented to their terms. Many of my friends and family do use WhatsApp and they will all have me in thier contacts ...
  • 83
3 votes
1 answer
6k views

Under the GDPR, should transaction data be deleted on account deletion or on user request?

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted? Or if the user can buy ...
  • 133
6 votes
3 answers
704 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
5 votes
1 answer
359 views

Do employees have personal liability when working for a company that violates the GDPR?

I work for a company that doesn't take privacy laws very seriously. As far as I can tell, they're woefully unprepared for GDPR and don't seem to care very much. My tasks mainly consist of software ...
3 votes
2 answers
156 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
  • 131
2 votes
1 answer
119 views

Advice sought regarding GDPR and managing sensitive data

We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server. There are files that are ...
  • 23
3 votes
1 answer
319 views

What does 'Right to Erasure' actually cover?

According to GDPR, any person has 'Right to Erasure (Recital)' and have his/hers sensitive information deleted. Does that mean that an organization can keep all non-sensitive data for a user? For an ...
1 vote
0 answers
684 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
6 votes
2 answers
708 views

Does GDPR Recital 15 exempt unstructured electronic data?

GDPR Recital 15 states that Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation. I ...
2 votes
2 answers
179 views

Does the EU GDPR apply to these types of natural persons?

Does the GDPR apply to a website operator who is a natural person (not a company or non-profit) and uses the website directly for commercial activity uses the website to advertise his/her other ...
4 votes
1 answer
132 views

GDPR for small interest associations

What exactly does a small common interest club with 100 members need to do to comply with GDPR requirements?
  • 41
5 votes
1 answer
327 views

Contract necessary for the most basic processing under GPDR?

I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or ...
  • 151
2 votes
1 answer
55 views

GDPR: Applied Security vs Employee Contracts

An Organisation has 10,000 employees. All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation. Only 200 employees require access to the PII data for the ...
  • 123
0 votes
2 answers
174 views

GDPR - Confirm company terms and conditions by button click

This May the General Data Protection Regulation (GDPR) will be applied across the EU. I read somewhere that users have to always 'opt-in' after this law is effective. Since I'm concerned about ...
5 votes
1 answer
539 views

Establishing GDPR consent when the person doesn't access a system themself

My company hosts an online database for organisations to manage training data for their people. In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. ...
  • 151
6 votes
1 answer
2k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
  • 163
0 votes
1 answer
400 views

Is an incentivized consent considered freely given in GDPR?

Let's say someone offers you 50 bucks if you opt-in to a consent; would that consent be still considered freely given in the eyes of GDPR (General Data Protection Regulation)? My understanding is ...
  • 1,169
41 votes
2 answers
8k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
4 votes
1 answer
395 views

Can I count unique users without a cookie warning?

Is there a way to count (approximate) unique users on a website without having to display that silly cookie warning? The usual way to track unique users is to set a cookie. An alternative (less ...
  • 141
3 votes
1 answer
447 views

GDPR vs. Credit Card Chargebacks

I work for a company where we take credit card payments for the services we provide. As per the Card Scheme rules, the cardholder can request a charge-back up to (in the case of Visa) 13 months after ...
  • 133
7 votes
2 answers
1k views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
  • 171
4 votes
1 answer
1k views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
4 votes
2 answers
604 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
  • 344
3 votes
3 answers
1k views

GDPR: Citizens with Dual Nationality?

Do the GDPR Regulations apply to processing data of a citizen who has dual nationality?
3 votes
1 answer
97 views

According to GDPR Article 30, do I maintain a continuous record or just a one-off?

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification. See: https://www.privacy-regulation.eu/en/30.htm It states that a data controller ...shall maintain a record of ...
1 vote
1 answer
467 views

GDPR - Offshoring

We work for consulting company in India, call it Z. Z has a partnership with a European cards & transactions processing company Y. So the Indian consulting company Z does offshore production ...
  • 11
3 votes
1 answer
1k views

To comply with GDPR, do I need passwords hashed?

I currently have a website that will be going live soon. The passwords are hashed. Is that all I need to do to comply with General Data Protection Regulation's encryption article? Please cite and ...
6 votes
3 answers
2k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
1 vote
3 answers
11k views

Will the GDPR apply to small hobby clubs?

When it comes into force, how will the General Data Protection Regulation affect small hobbyist organisations? Will it apply to, for example, student societies that are holding lists of email ...
4 votes
2 answers
2k views

Does any host provider currently comply with GDPR?

According to Rec.81; Art.28(1)-(3) of the GDPR regulation, "The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding ...
2 votes
2 answers
660 views

Can I force a website/service to delete my private data

I would like to wipe my online data clean and make sure the people deleted my account. Considering that most services only offer to "close" or "suspend" the account and not delete the data like skype ...
  • 21

1
14 15 16 17
18