Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0
votes
0answers
64 views

Facebook vs GDPR - Is Facebook never deleting the Searches you do?

I frequently delete the Search History from my account's Activity Log. However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past. Suggestions ...
1
vote
1answer
90 views

Subject Access Request (SAR) of data relating to cookies?

Take a search engine (e.g. Google), where user A can make searches without logging in with their account. The search engine collects, processes and stores, over time, a number of data about the user A,...
2
votes
1answer
879 views

Will storing hashed phone numbers violate GDPR?

I've read GDPR document from start to end, but I am still not sure about one thing. Let's say I have a system where I store phone numbers in hashed form (let's say bcrypt). Will this violate GDPR if ...
0
votes
1answer
35 views

Which article of the GDPR implies that one should use the BCC field in order not to dissiminate personal mail addresses?

Which article of the GDPR implies that one should use the BCC field in order not to dissiminate personal mail addresses when sending mails?
2
votes
1answer
36 views

How to obtain the legal basis for the processing of personal data from the controller?

If someone has not kept the information recieved under Article 13 or 14, then referring to which article he or she can obtain information about the legal basis for processing of personal data? I do ...
1
vote
1answer
60 views

Voicemail recordings and transcription email fall under GDPR

A client calls, leaves a voicemail with his name and number. A vendor calls, leaves account information and address information. This call is also transcribed and sent via email. The above are ...
0
votes
0answers
43 views

Is WhatsApp GDPR compliant as it allows backups for group chat?

Currently WhatsApp claims it uses end to end encryption. However the app provisions users to switch on backups to Google Drive and other providers. So if I am in a group chat with a set of users and ...
0
votes
1answer
49 views

Does my own company also need to be EU-US Privacy Shield certified if we use AWS to store data of European customers?

We're based in United States. We understand that any sub-processor that we use should be EU-US Privacy Shield certified and GDPR compliant. So, we can use AWS and Google Cloud. Both of them are EU-US ...
2
votes
2answers
95 views

GDPR: What is the legal situation on documenting cases of “Right to be forgotten” claims?

I wasnt able to find an explanation inside the GDPR whether a data privacy officer (or similar responsible) is allowed or required to document cases where individuals claimed the right to be forgotten....
1
vote
2answers
79 views

Laws and IP logging

Given I do not collect any personal data with an online service, at least IPs will be logged by the web server. An IP can be mapped to a person. What I've read recently, with nginx for example you ...
1
vote
2answers
166 views

GDPR and CDN (content delivery networks)

I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content. A CDN is, basically, a distributed network of servers. ...
1
vote
0answers
41 views

Corporate responsibility when allowing biometric authentication

At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for ...
0
votes
1answer
88 views

Is it legal to display user airline seat info on a public platform with absolute user consent

Planning a public platform to display user seating info after taking proper user consent , will that still attract legalities if user is ok with it , will it fall under any legal clauses under GDPR ...
0
votes
2answers
75 views

GDPR: can vendors accept core dumps or logs

As a software vendor, am I allowed to accept core dumps or application logs from my customers to investigate a crash or malfunction even though they most likely contain personally identifiable ...
2
votes
2answers
380 views

Is the UUID considered personal data?

I am planning to build a mobile platform which I would use the UUID as the username, and a password of user’s choice. So that users would just need to type a chosen password to use my services. ...
1
vote
0answers
36 views

Is Apple's default Privacy settings GDPR compliant?

I recently realized that some apps were able to "link" my identity to Facebook. I checked my off facebook activity and could see some apps that I've never given my email. Investigating ...
0
votes
1answer
65 views

Must the Privacy Policy be Included In-App, or is a Hyperlink Good Enough?

The title says it: I'm wondering if my company has to have a copy of our app's Privacy Policy included in the actual software package. On the one hand, I could see a copy of the Policy being required,...
1
vote
2answers
75 views

Is storing business data considered personal data?

I want to create an online application. The visitor could enter his website URL then the application will make some analysis. The application asks the visitor if he wants a regular website report on e-...
0
votes
1answer
126 views

Is “Advanced Matching” of Facebook against GDPR?

I am wondering if sharing a hashed email or phone number with facebook with the purpose of matching that hashed value on Facebook's side is against GDPR? https://www.facebook.com/business/help/...
2
votes
1answer
528 views

Accidentally used “to” instead of using “bcc” while sending out email [GDPR violation]

I, as the admin of a small mailing group, used "to" field instead of "bcc" while sending an email to 10 people. One out of the 10 emails turned out to wrong, and of a lawyer, who pointed out that we ...
1
vote
2answers
54 views

Where is the line between transactional vs marketing emails with GDPR?

If a company that offers a product where the user logs in, such as a SAAS product, and they send emails with certain intentions, where is the line drawn between a transactional and a marketing email? ...
3
votes
1answer
61 views

Cookie laws: Do I have to show a banner for technical cookies?

I am aware that technical cookies don't need consent, only marketing cookies need consent. However, if my site only uses functional cookies, do I still have to display a cookie banner that says what ...
4
votes
1answer
53 views

Extraterritorial Scope of Brazil's LGPD

How can a national legislation, like the recent Brazil's LGPD apply to companies which are not established in Brazil, but may offer services to Brazilian citizens via the Internet? Imagine a website (...
54
votes
4answers
19k views

Does GDPR include UK customers, or not anymore?

Now that Brexit happened, does GDPR include UK customers, or not anymore?
0
votes
0answers
21 views

Does my personal website GDPR compliant? [duplicate]

I made a basic chat website. Shows active users with nicknames or if not given nickname, random given name. There is no register or login I take users nickname and save it to cookies. Nickname can be ...
0
votes
0answers
16 views

Is a privacy policy required for storing user preferences?

I wanted to use localStorage (which I think technically counts as a cookie) to store a user's preferences in a simple web app. The stored data doesn't identify the user and is never sent to any sort ...
0
votes
0answers
29 views

Handling of names, emails, phone numbers and messages submitted through website forms under GDPR

I am developing a website for a one-man, Swedish, acupressure company. The site contains a contact form that requires the user to submit a name, email and message. It also contains a booking form that ...
0
votes
2answers
187 views

Institution can access my email (inbox/sent items/etc) and edit it?

First of all, I have thoroughly read the answers to the following questions and none of them answer my queries: Can Google Chrome read/scan my ProtonMail inbox page? Can my IT department read my ...
5
votes
3answers
222 views

Do I have a “legitimate interest” under GDPR to not delete data my software needs to fulfil its function?

The GDPR gives users the right to have their stored data deleted. How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by ...
3
votes
1answer
146 views

GDPR - does a unique device identifier count as personal data?

I'm planning to sell my software online. The payment process is handled by a reseller (FastSpring), so the personal data collected (like the buyer's name and e-Mail address) is never stored on my ...
2
votes
0answers
46 views

How does the GDPR differ from national data protection law?

Before the GDPR came into effect, I had to deal with both the German Bundesdatenschutzgesetz and the Italian Codice in materia di dati personali, and recall them having very similar provisions (though ...
1
vote
2answers
69 views

Process IP address without GDPR consent

We are trying to log the location of our visitors, without storing their actual IP address on our servers. To geolocate the IP address, we use an external service, to which we make an API request ...
0
votes
1answer
55 views

Cookie opt-in required on paid-for web-based software-as-a-service application?

Context: We provide a paid-for web-based software-as-a-service application. This application requires users to register an account, and agree to our terms & conditions and privacy policy to be ...
-1
votes
2answers
89 views

What should I reply when someone ask about their GDPR information against a cold marketing email?

I recently received an email says "..please send me a GDPR information about all my data you have assigned to this email.." I collect the email address from a public domain (say GitHub) and ...
0
votes
1answer
21 views

GDPR & CCPA compliance involving terms of service violation

If a user writes a comment on a website that gets flagged and removed+archived are we still obligated to delete the user content and/or the association of that comment with the person? According to ...
1
vote
1answer
85 views

Is it possible to create data subject to the GDPR without any involvement by the person in question?

Say I email a colleague, in a professional capacity: I have been thinking about offering John Smith, who currently works at Big Corp, a job John Smith has had no involvement with my organisation. ...
1
vote
0answers
32 views

Company acquired a website with existing users. Is GDPR announcement obligatory?

When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
24
votes
5answers
14k views

Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?

I have recently come across this part of an app from a well-known US company: Is this a legal way of handling some of the technical obstacles GDPR introduced? Is this a "flexible" interpretation of ...
0
votes
0answers
50 views

Is WhatsApp legally obligated to remove my chat on every device, based on the GDPR? [duplicate]

Dear Law StackExchange community, I'm attempting to get chat history removed with another party dating back a long time ago. I don't want the chats to remain existent on any device whatsoever, so I ...
0
votes
1answer
49 views

Which EU-related jurisdictions in Americas apply the GDPR regulation?

According to some information, a person will need to be a resident in an EU country in order to be protected by the GDPR regulation. Are there jurisdictions in North or South America where residency ...
0
votes
1answer
46 views

Does GDPR disclosure apply to European citizen temporarily in United States?

For some background: the EU "[Data Protection Directive][1]" is a European Union directive which regulates the processing of personal data within the European Union, as explained in [this Wikipedia ...
0
votes
1answer
148 views

Right to be forgotten in US legal system. Practical approach for erasure?

As it commonly known, the right to be forgotten is a fundamental right in the modern informational society. It is the right of an individual to obtain erasure of his personal data from the online and ...
0
votes
0answers
36 views

Data Privacy: Should a user be allowed to change another users profile information?

In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)? What laws (US & EU) would give guidance either way? ...
1
vote
1answer
94 views

GDPR dilemma: Does a full name contained in a URL constitute PII as stated by Google Analytics?

But wait, it gets better: This full name belongs to person who was interviewed in an article under this URL. https://support.google.com/analytics/answer/7686480?hl=en What Google considers PII: ......
-1
votes
1answer
102 views

My hashed IPV4 was published by an administrator on an anonymous imageboard (EU country)

some days ago it on an anonymous imageboard it was opened by an administrator a thread with a .png showing all my posts on that website, and each posts had my hashed ipv4 attached to it. Since i ...
0
votes
2answers
102 views

Is it illegal to NOT store logs within the UK? (VPN related)

Introduction: I co-run a VPN company. I have a few legal questions since our service has a strict NO-LOG policy enforced. Question: In the UK, it is illegal to store sensitive and private customer ...
4
votes
1answer
90 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
2
votes
1answer
133 views

A website is refusing or failing to remove personal data I've requested removed: is this against GRPR?

I have been a member of a website for 13 years and would like all of my old posts removed. I have contacted their support team however the experience has been dreadful: it look a lot of back and ...
1
vote
1answer
39 views

Can someone enlighten me about the main task of the independent supervision of data protection law

So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
0
votes
1answer
96 views

Which Cookies require consent for GDPR

I use a number of different cookies on my website for tracking and saving preference. I'm very confused about which can and cannot be set with and without consent under GDPR I'm certain I need ...

1
2
3 4 5
11