Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1
vote
1answer
50 views

Can GDPR be used to reset an account?

I have an issue with AirBnb: My account is something like 7-8 years old and I didn't use it for 6+ year. I don't have the password anymore so I did a password reset, but it wants me to confirm my ...
0
votes
4answers
155 views

Data Protection Laws

Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/...
1
vote
3answers
62 views

Does GDPR apply to personal information entered in a password-field?

If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply? For example if someone enters their email, phone number or name in a password-field? If so, ...
0
votes
2answers
73 views

Is a company still required to pay fines if the applicability of a law changes during the investigation?

This question was inspired by this question on Security.SE, regarding a data breach in a UK-based company. In short, the data of a UK-based company was leaked by an US-based contractor. Since the UK ...
1
vote
1answer
80 views

Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications

I originally posted this on another Stack Exchange website but was advised this might be a better place for it. Original is here: https://security.stackexchange.com/questions/215300/is-it-ok-to-assume-...
1
vote
0answers
46 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
0
votes
1answer
31 views

Does anonymised Google Analytics require positive opt-in under GDPR/PECR?

The EU defines personal data as: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can ...
1
vote
1answer
33 views

Am I responsible of the personal data of a second degree user according to GDPR

Suppose we have an flight ticket booking system. As with many of these systems the account booking the ticket doesn't have to be the one using the ticket (i.e. you can book for someone else the ticket)...
4
votes
2answers
89 views

Opting out of cookies by emailing a company

Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than ...
-1
votes
1answer
63 views

Do I have to include a GDPR in my app even tho I don't collect data from users? [closed]

I have written an android app The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user? Is is ...
0
votes
2answers
40 views

GDPR Information and consent

I am building a game that stores score/level on the local device and uses non-personalized AdMob. Do I need to inform the user about storing the score locally? Do I need consent for using non-...
0
votes
0answers
25 views

Application of the GDPR to emails one has sent [duplicate]

Reading https://gdpr-info.eu/issues/personal-data/, it seems you could use the GDPR for, well, unexpected request. For example, if I ask Google to remove any email from me I have send, not only from ...
1
vote
1answer
102 views

Can I use GDPR to read an Airbnb review about me before I post mine?

I just had a bad experience with Airbnb. The circumstances would be too long to describe and not relevant to my question. The fact is that I just have had an email that the host (I am the guest) let ...
10
votes
1answer
2k views

GDPR Compliance - notification of data breach

In Art. 33, the GDPR specifies that a controller must notify a personal data breach to the supervisory authority after having become aware of it. Case 1: A database dump with personal data is hosted ...
0
votes
1answer
55 views

Allowing access to data before employment

If a company wishes to allow access to their system (e.g a new manager to view HR records, salary etc) before their employment start date, does this break any privacy, GDPR laws etc? Lets say they ...
0
votes
2answers
49 views

GDPR - Service storing other people's clients' emails

I am working on a service that allows people to import data regarding their sales within a particular platform. This data is imported in an excel format (CSV) and contains all sales informations for a ...
1
vote
1answer
43 views

Google Analytics on mobile: possible to use without consent?

I saw this thread where it's possible to use Google Analytics without consent on websites: Is it really possible to use Google Analytics without consent, and if so, why exactly? My question is: does ...
1
vote
2answers
102 views

Does GDPR's physical address rule apply to my real world hobby art group?

I run an art group (in the UK) that meets up every other month to give feedback on each others' work. To share the meeting dates and to share the work we're giving feedback on that month, I have an ...
-1
votes
1answer
42 views

Is there a proper lexicon for legal documents? [closed]

My apologies in advance for such a childish manner of asking a question here. If it deserves a downvote - go ahead. Yet for me it is that simple, but so lethal. As far as we all human beings, I am ...
1
vote
1answer
77 views

Is it illegal to state in your website that an employee of a company emailed you?

I have an open source project regarding software used in banking and I have received emails about it from employees working in top banks/consultancies. I am considering to mention this in the website,...
3
votes
1answer
51 views

GDPR: Transfer (chapter V)

I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web ...
1
vote
1answer
73 views

GDPR: Can I collect non-personally identifiable information?

I'm creating a game that collects data in two ways: Unity Analytics for usage stats, and bug reports that sends me a report of an issue along with several files to help me diagnose the issue. However, ...
3
votes
2answers
45 views

GDPR - am I the processor if I don't host the website?

I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase ...
17
votes
1answer
3k views

GDPR rights when subject dies; does family inherit subject rights?

Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.). What if the subject is deceased? Does the widow/widower or do the children ...
0
votes
1answer
99 views

Is deterministic anonymization of test data ok?

Deterministic anonymization of test data? When anonymizing multiple data sources and preserving data consistency we usually end up with a mapping table for "real to anonymized" values. Typically ...
-1
votes
1answer
70 views

Is identification of an employee by another employee restricted by GDPR? [closed]

Does GDPR require anonymization of user idents when used in testing and development? User idents will identify an employee by other employees because it's linked to login system. Outside of the ...
3
votes
1answer
107 views

Under GDPR, why is google not considering the index entries as personal data?

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling. Following this, I make the assumption that this qualifies as personal data under GDPR ...
3
votes
1answer
58 views

Do I need user consent to respond to their email sent through my website's contact form?

I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message. I'm not storing any of the data in a database or in cookies. When the user ...
2
votes
2answers
65 views

Under GDPR, are service operators allowed to record all clicks of logged in users?

Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either: The user consents to having ...
-2
votes
2answers
106 views

GDPR no opt out option [closed]

Is it legal if we do not offer an explicit opt-out option in our app for non-persnonal data collection? We planned to explain to the user what data we collect and at the bottom of the screen there ...
3
votes
2answers
155 views

Do default Apache logs violate the GDPR?

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
6
votes
4answers
203 views

Do internal annotations on user accounts fall under the GDPR?

In a platform such as Stack Exchange or any other moderated forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may ...
0
votes
2answers
51 views

GDPR - Company employee [closed]

I believe to know that an employee at a company that I'm customer at, I believe has accessed my customer profile and gotten personal information, such as my full name, ID number and address. I know ...
0
votes
1answer
50 views

GDPR: legal to combine (clickstreams) tracking and survey?

I am working on a website that collects clickstream data using Google Analytics. There is also a opti-layer. In the near future a survey to ask in which industry a visitor works shall be integrated, ...
2
votes
1answer
55 views

Legal sending personal information to a third party if the user supplied incorrect contact information?

To clarify the title, here is an example: Alice wants to sign up to online store Nile.com Alice enters the email bob@mailprovider.com by accident Nile.com does not send a verification that Alice has ...
4
votes
1answer
88 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
0
votes
2answers
48 views

GDPR question about processing personal data for research purposes that yield aggregated results

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...
1
vote
1answer
74 views

Store browser width / screen size and browser type without user consent?

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design ...
3
votes
2answers
76 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
4
votes
2answers
140 views

“no logs” website in eu - is it illegal?

As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
0
votes
2answers
88 views

Do I need permission to publish a FOI response in a blog post or open letter?

I recently submitted a FOI request to my local council, and had a response. Part of the response stated the following: You are free to use this information for your own use, including for non-...
2
votes
2answers
118 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
29
votes
4answers
8k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
1
vote
1answer
37 views

Copy of ID card: blacken / hide fields that are not relevant (Switzerland)

In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht. In article there is written that ...
0
votes
2answers
152 views

Are Steam account IDs (and telemetry data associated with Steam IDs) deemed personal data?

A few friends and were having an argument on the following situation: People can sign up for Steam accounts for free, letting them purchase games and play games over their network. Users are able to ...
2
votes
1answer
71 views

Can liability for data disclosure be waived by T&Cs under GDPR?

I live in Ireland, an EU county subject to the GDPR. I see in a service T&Cs the line: "Despite our use of commercially reasonable efforts to protect your Personal Information from ...
2
votes
4answers
236 views

How often does a website have to ask for cookie consent?

I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or ...
0
votes
1answer
111 views

Locate me data obtained from european register

There is an entry on locatefamily.com that I know because it has certain details that were used on a European domain register in 2014. I an EU citizen living in the states. Does the GDPR apply to them ...
0
votes
1answer
84 views

Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
0
votes
0answers
36 views

Single sign on via cookies and GDPR compliance?

Going to call my two sites "identity provider" and "WordPress site". Flow is: User logs in on identity provider User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token ...