Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
896
questions
0
votes
0
answers
33
views
MDR - Is an app that supports physiotherapy patients in doing their exercises regularly a medical device according to the MDR?
With the introduction of the medical device regulation (MDR), there is a lot of ambiguity about which risk-class specific software is. And developing a medical device is linked to a lot of work and ...
- 53
13
votes
6
answers
5k
views
What should a website do if the end user refuses to accept the necessary cookies?
Suppose that a data controller chooses the consent legal basis for GDPR article 6 purposes.
Then, the data controller says something along these lines in a cookie consent banner on their website:
We ...
- 399
1
vote
1
answer
70
views
Incomplete/unserviceable SAR submissions and deletion timeframes
Bob was party to an incident in a shop that keeps CCTV footage for 30 days. 28 days later he submits a request for this responsive footage, but neglects to include with it adequate selfidentification ...
3
votes
1
answer
182
views
How can data received in online subject access request form be used by ACRO?
Meet Bob. Bob has requested his PNC file from ACRO Criminal Records Office
under the Data Protection Act.
Their online request form solicits much intrusive information. What purposes may information ...
10
votes
3
answers
3k
views
Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?
Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store.
Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head ...
3
votes
0
answers
50
views
Are apps required to notify users when they update their privacy policy or EULA?
I have noticed that many companies are doing this but definitely not all.
Furthermore, what about cases where companies or developers cannot notify users because some users are not logged-in or ...
- 151
9
votes
1
answer
144
views
Can I provide multiple legal bases for GDPR purposes?
I used Termly's privacy policy generator, and in the policy that they generated there are four Article
6 legal bases:
Consent
Legitimate Interests
Legal Obligations
Vital Interests
I took a ...
- 399
6
votes
1
answer
901
views
Applicability of Data Protection Laws When Talking to a Lawyer
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission.
Can I tell such details legally to my lawyer when referring to ...
- 71
3
votes
2
answers
81
views
Is anyone who develops websites or webapps for clients legally responsible for what they are creating and all the gdpr obligations?
Suppose the case of a european (italian) web developer who, at the request of a client, creates a web platform for him from scratch (also with database, saving user’s data, ecc.). When putting the ...
- 31
1
vote
2
answers
146
views
How do email delivery services store users' email addresses in a GDPR compliant way?
Mailchimp, Twilio, Hubspot and other services provide apis to save lists of email-addresses and send them emails (marketing, technical, etc.).
Even if a user asked to unsubscribe, those services will ...
- 113
5
votes
1
answer
266
views
GDPR - Consent to the use of personal data on mobile app - stored per device or signed up user?
For my mobile app, I need to get users' consent to process their personal data (and separately to use anonymized data for Google Analytics). I am unsure, however, how exactly I have to implement this.
...
- 53
0
votes
1
answer
55
views
GDPR storing vs processing / computing data (failover scenarios)
I'm having a hard time understanding what exactly is meant by 'data processing' in GDPR. There's one specific scenario which I'll explain later, but I will first try to simplify my question.
Let's say ...
- 103
0
votes
1
answer
61
views
Practical GDPR guidance for online businesses
When you start an online business, or even just create a website, there is a lot of confusion on what needs to be done to comply with GDPR. As many online resources (including StackExchange) suggest, ...
- 101
-1
votes
1
answer
71
views
By what mechanism does GDPR jurisdiction bind data controllers that operate outside the EU?
If you process the data of data subjects resident in the EU then you are supposed to be bound by the GDPR no matter where you are located.
Why care what the GDPR says if you don't have a presence in ...
4
votes
2
answers
160
views
What is the lawful basis for running Know Your Customer (KYC) checks on startup investors?
Suppose you have a startup that raises money from a number of angel investors, many of whom are investing as natural persons.
What is the lawful GDPR basis for processing the investors' personal data, ...
- 399
1
vote
1
answer
39
views
Understanding the last sentence in Article 25(2) of GDPR
Article 25(2) of GDPR says the following (emphasis mine):
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are ...
- 399
11
votes
4
answers
4k
views
Do I need to present a GDPR banner to IP addresses outside of GDPR regions?
The context of my question comes from this comment:
The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The ...
- 271
3
votes
1
answer
96
views
Does the GDPR's "right to be forgotten" extend to Google's search results?
I have recently "googled" my own full name and found out that some comments I made during my teens have been indexed by Google. Back then I have used my full name as a user-name on that ...
- 31
2
votes
2
answers
441
views
Is Pushshift.io compliant to GDPR if they refuse to delete collected content?
Pushshift.io collects posts and comments using Reddit API, and saves that data into their database. This service is used by websites that allow you to see deleted contents in Reddit. For example, if ...
- 39
0
votes
2
answers
88
views
Where should personal data be stored to comply with GDPR?
We are a company based in Europe.
We have personal data about our users worldwide (name, mail, phone number, company, title). And currently it is stored in Microsoft Azure. We don't know physically ...
- 103
-1
votes
1
answer
35
views
What are good tips and tricks to keep in mind when performing a subject access request for a comprehensive record of self-pertinent data from the met?
Bob would like to obtain as comprehensive as possible am archive of all data held on him by the metropolitan police, as well as any other police networks that they may be part of and share data with/...
1
vote
1
answer
47
views
Can I process personal data without consent if it it helps me serve the user sooner, rather than later?
I am designing an application and would like to process personal data in a way that may not be strictly necessary to fulfill a customer's request, but that would facilitate my doing so.
It'd be a bit ...
- 2,758
6
votes
2
answers
1k
views
Are push tokens considered PII under the GDPR or the CCPA?
I'm building a server for an app and I'm trying to get my privacy protections right.
The app allows users to opt in to push notifications. If the user opts in, then I save a push notification token ...
- 163
3
votes
1
answer
72
views
What exactly triggers the GDPR Article 14?
Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject:
Art. 14 ...
- 3,368
2
votes
1
answer
156
views
Do I need a cookie policy/cookie consent on my website just because I use PayPal buttons?
I'm building a website, and the only third party element in it is a PayPal button I use for payments. The PayPal button opens a pop-up window which has its own cookie consent banner. Does that mean I ...
- 21
11
votes
4
answers
4k
views
Is there a way to determine if an email address is personal information?
The GDPR defines personal data as:
Personal data is information that relates to an identified or identifiable individual.
My understanding is that this means that firstname.lastname@example.com is ...
- 3,368
1
vote
0
answers
24
views
Do we need GDPR policy statement if we do not use Cookies or obtain personal information from users? [duplicate]
I am developing a static website to provide some blogs and documentation related to company products. It's a simple website and we have decided not to use any Cookies or obtain personal information ...
- 111
4
votes
1
answer
89
views
Any GDPR implications when displaying publicly accessible info on a website?
There's a simple static website written by a couple of university students that provides useful information about it, containing among other things contact information of faculty members (email, ...
1
vote
1
answer
70
views
Is satelite data personal data?
It is in the news that artificial intelligence (AI) has been applied to aerial photography to identify homeowners who have made unauthorised additions of swimming pools to their properties in France. ...
- 3,368
1
vote
2
answers
186
views
Is password reset to a known default value GDPR compliant?
I am working in a project where there are two procedure to change user password :
The more common technique, in which user click on "change password" button (or "forgot password")....
- 115
5
votes
3
answers
2k
views
Does GDPR restrict handling data that the user has certified is not personal information
If my site ToS has this:
By submitting data to the this site, you certify that the data is not of a nature that would cause me to have any special obligations under applicable law.
And someone from ...
- 11.6k
1
vote
1
answer
29
views
Responsabilities on data breaches UK Data Protection Act
Following a question from THIS StackExchange about Data Protection Act application in the UK, there is an aspect about "proactivity" and "responsabilities" that I do not fully ...
- 15
0
votes
1
answer
37
views
Does GDPR apply to a non-EU company communicating with me?
Someone used my e-mail address to create an account at one on-line service in a country that is not in EU. I told the company about that and they responded with that they have undone that.
But now, I ...
- 151
0
votes
1
answer
44
views
Does the UK have a (enforcable) law linked with the Data Protection Act to control document's metadata?
Reading the information on the ICO's website, I came across a few items mentioning how to handle metadata on my organization's workflow like THIS or THIS.
I noticed they use expressions like "...
- 15
1
vote
2
answers
36
views
How to conduct a GDPR compliant survey if not collecting personal information, e.g. names, but potentially personally identifiable information?
If I were to conduct a survey of members of a public group in the EU (for my own personal interests) what should be considered in order to comply to GDPR regulations?
If the information does not ...
- 155
2
votes
1
answer
334
views
Can we use Firebase Authentication and be GDPR compliant?
The Firebase Authentication is processing data exclusively in the United States, and is therefore not GDPR compliant. However, they are saying on the same site that:
Firebase has moved to reliance on ...
- 21
1
vote
1
answer
24
views
GDPR: hashed variable linking customer database with survey answers?
I was reading a similar question (A salt hashed with user password is anonymous data for GDPR?) but it's not 100% clear to me whether this applies to my question as well. I'll describe the issue in an ...
1
vote
1
answer
77
views
Is using Gists on GitHub Pages a GDPR violation?
I'm using GitHub pages to serve my little blog. On some posts, I'm embedding Gists to nicely render little code snippets, e. g. here:
Now the Privacy Badger browser extension reports that gist.github....
- 113
4
votes
1
answer
117
views
GDPR issues with Google sharing suspected child abuse images with law enforcement
I recently read of a man who had a Google account. His son's doctor asked for photos of a medical issue his son was having around his groin area, so his wife used his phone to take some. Google ...
- 1,722
3
votes
1
answer
153
views
Do I violate the EU GDPR when I host a static website on Google?
To my knowledge IP addresses are considered personal data under the GDPR and thus may only be processed under one of several conditions (one being user consent). There has also been a verdict in a ...
- 31
4
votes
1
answer
55
views
Do I need to consider GDPR when conducting a survey for a personal project from people in a public Facebook group within the EU?
I am a member of a Facebook group that exists to help people apply for citizenship and provide advice in the process. The timeline for applying for citizenship varies wildly depending on a number of ...
- 155
1
vote
1
answer
56
views
Can a company take legal action if the GDPR requestor is not a European citizen?
I want to request the "Right to be forgotten" from a company that complies with the GDPR regulations. In the email, I have included the below:
As laid down in Article 12(3) GDPR, you have ...
- 11
3
votes
1
answer
69
views
Tenancies and the GDPR
If Tim the tenant and Larry the landlord enter into a tenancy, then do either of them become a data controller of the others name and address? Does the landlord as the "provider" of the ...
5
votes
2
answers
1k
views
Under GDPR, does blurhash of a profile picture count as personal data
Suppose I have a web service where users can have a profile page with name and picture. Blurhash is a technology that allows me to create a significantly blurred representation of an image, as a ...
- 161
1
vote
1
answer
80
views
"Find my device" and GDPR compliance
Google and Apple both offer a "Find my Device" service which allows to track or even remotely wipe a stolen device. Yet some companies claim that tracking stolen devices is not a legitimate ...
- 1,337
0
votes
2
answers
90
views
Server side analytics events
If I track a 'questionnaire started' event with a user's GUID for analytics purposes server side, could that contravene any UK data laws such as GDPR or the ePrivacy / cookie consent law?
The reason I ...
- 101
2
votes
2
answers
80
views
Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?
Suppose I check into a German hotel and a Johann stayed in room 123 on the previous night.
Presumably, he is the only Johann who stayed in the room on that night.
There are many Johanns within Germany ...
- 2,758
22
votes
2
answers
2k
views
Other use of profile photos: legality fair-use and permissions
I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). ...
- 349
0
votes
2
answers
44
views
If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?
Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with ...
- 3,368
1
vote
1
answer
109
views
Under what circumstances is it lawful or unlawful for police to disclose one's information to third parties, e.g. complainants?
Is it basically neither prohibited nor required and thus entirely to police discretion as to whether or not to disclose parties' details to either their purported victims, or to other parties like ...