Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1 vote
3 answers
311 views

Can i request a religious forum to delete my posts for GDPR compliance?

It's a forum discussing religious stances and personal practice. Is it possible to request posts to be removed along with the account registry? As i understand it, forums in general don't have to ...
user avatar
1 vote
1 answer
58 views

Can one make a Subject Access Request of a telephone Communications Provider?

I have received a suspected scam telephone call. Searching the internet for the number I found that "phone block 247520 is operated by DIDWW Ireland Limited". Searching this I came across ...
User65535's user avatar
  • 5,878
5 votes
1 answer
160 views

Does a US company moving its PII and web servers to the EU solve the Meta fine problem?

As discussed in this question about the Meta fine it is a problem for companies that host websites with access to EU user registration data in US datacenters. This is based on the 'Schrems II' ...
User65535's user avatar
  • 5,878
20 votes
2 answers
4k views

Are global user account systems now illegal following the EU's May 2023 fine of Meta?

The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta Like any website, we have an account system where people log in to access their ...
Per's user avatar
  • 303
1 vote
0 answers
51 views

What are the limits to what the information commissioner can take action upon?

It is in the news that a doctor inappropriately accessed and distributed a patients medical records. They did this through their employer, Cambridge University Hospitals (CUH) at Addenbrookes. The ...
User65535's user avatar
  • 5,878
8 votes
1 answer
3k views

Can a non-profit organization record attendance by name without permission?

I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
Tripartio's user avatar
  • 201
2 votes
1 answer
150 views

I have found my email address online in a .txt file. What should be my next step? [closed]

A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails ...
Ahania's user avatar
  • 33
4 votes
1 answer
247 views

What does "Household Exception" to the GDPR mean?

GDPR Section 2 Recital 18 (?) reads: Not Applicable to Personal or Household Activities This Regulation does not apply to the processing of personal data by a natural person in the course of a purely ...
User65535's user avatar
  • 5,878
2 votes
0 answers
44 views

Search engine data breaches, osint

Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
J.G.'s user avatar
  • 43
1 vote
1 answer
195 views

Do US companies need a cookie consent banner for EU traffic?

Example: US website, targeting customers in the US. They use Google Analytics and Google Ads cookies etc. Do they need a cookie consent banner for EU traffic? Or should they just not load any tracking ...
Henrik's user avatar
  • 13
7 votes
3 answers
4k views

On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?

I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in ...
Nik's user avatar
  • 173
0 votes
1 answer
241 views

Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?

Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls. The fact that it's now allowed again makes me wonder if Italy (and the ...
GDPR's user avatar
  • 47
0 votes
1 answer
74 views

Utilizing Browser IP for Service Security

Suppose a web designer plans to use IPs for security purposes to prevent botting unique clicks and brute force attempts. And, the site only stores a hash of the IP address for a limited amount of time ...
Davis Ray's user avatar
3 votes
1 answer
70 views

GDPR protection for non-EU individuals by using EU services through VPN use?

REASON FOR QUESTION: I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
Bruno Genovese's user avatar
4 votes
1 answer
251 views

Choosing DPA to submit data breach complaint (EU-specific)

Context The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it. The offenders ...
Vassilis Markos's user avatar
4 votes
1 answer
98 views

How does GDPR's right to erasure apply to deduplicated storage?

I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case: Company A offers a online data storage service that is intended to be used by the users ...
Tomas's user avatar
  • 43
1 vote
1 answer
71 views

Do any other consumer rights laws have extraterritorial applicability to international organisations that cater to British or European customers?

The GDPR purports to bind any organisation, wheresoever it may be based, that serves individuals based in the EU, or (as the case may be) the UK. The GDPR governs the obligations of organisations and ...
Seeking answers's user avatar
0 votes
1 answer
30 views

Can two or more different entities simultaneously be data controllers for the same data?

Suppose Alice is a customer of a business ACME who holds data on her like email correspondence. ACME uses a third party to manage their email, suppose Fastmail.fm. Fastmail.fm in turn delegates their ...
Seeking answers's user avatar
6 votes
2 answers
619 views

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
Seeking answers's user avatar
0 votes
2 answers
115 views

Publishing personal data obtained on a Swedish server - GDPR implications

Imagine a small social media chat platform is hosted in Sweden and subject to GDPR. Party A sends personal information to party B using the platform, using a private message. The information was ...
user49938's user avatar
0 votes
1 answer
65 views

Can a user opt-out of embedded services without prior account-linking?

Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
Martin Braun's user avatar
-2 votes
1 answer
55 views

Old backups containing login information [closed]

I've been keeping an old website backup of a website that I used to work on on my PC for the last year or so. It was all my own work and wanted to just keep it in case I ever wanted to reuse it or use ...
AnotherUser's user avatar
-1 votes
2 answers
68 views

What would constitute personal data? [duplicate]

For example, would a name in the form first initial last name be considered personal data, considering this could apply to many people? What about if we added in a hobby, perhaps that they watch ...
AnotherUser's user avatar
0 votes
0 answers
51 views

What is the legality and consequence of blocking one who submits a SAR? [duplicate]

Alice submits a subject access request to Bob via WhatsApp, Bob responds to this by blocking Alice, but otherwise ignores her. What is the legality and consequences of Bob’s response to her SAR?
Seeking answers's user avatar
3 votes
2 answers
118 views

Access rights to professional photographs

An independent professional photographer uses a sales tactic of candidly taking photos of others in public and then approaching them and offering them copies for a price. Suppose one of these ...
Seeking answers's user avatar
0 votes
1 answer
85 views

Who is the data controller of footage taken on a retail worker’s personal phone?

An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer ...
Seeking answers's user avatar
0 votes
2 answers
494 views

Can a customer of a business make a recording of an employee on the business’s privately premises?

Suppose a customer enters a store. The business, through an employee, treats the customer unlawfully. Perhaps this is by verbally or physically abusing them, discriminating against them, or denying ...
Seeking answers's user avatar
-1 votes
2 answers
124 views

Can data protection rights of a subject be voluntarily waived?

Presumably not on protrusion by a service provider as a condition of their service. But what if someone writes to someone super busy whom they admire and says “look I really respect you and don’t want ...
Seeking answers's user avatar
2 votes
2 answers
94 views

Is training an AI on the internet processing personal information?

There is an article on El Reg where the author asks ChatGPT about themselves, and they get back some information. If this data acquisition and dissemination process was being performed specifically ...
User65535's user avatar
  • 5,878
0 votes
1 answer
52 views

EU and CLOUD Act [closed]

I can't find anything what's on this in 2023 - is EU anyhow working towards and agreement with US to allow not to give away private data? - As I see on Wikipedia, so far only UK has got this agreement ...
J. Doe's user avatar
  • 457
0 votes
1 answer
115 views

Is just embedding YouTube thumbs GDPR conform?

Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?
Johann Heyne's user avatar
0 votes
3 answers
107 views

What does "necessary" mean with regards GDPR and cookie consent

The GDPR makes use of the word "necessary". For example article 6. Lawfulness of processing 1. (f) says "processing is necessary for the purposes of the legitimate interests pursued by ...
User65535's user avatar
  • 5,878
0 votes
1 answer
54 views

If I have concurrent user consents then can I combine these consents?

I have an app that supports concurrent user consents. Assume that I have: Consent A that gives access to https://example.com/resources/a Consent B that gives access to https://example.com/resources/b....
Szyszka947's user avatar
14 votes
1 answer
2k views

How can consent-banner as a service be GDPR compliant?

A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
Samuel's user avatar
  • 243
2 votes
2 answers
155 views

Is a bank account history of transactions considered personal data in the sense of GDPR?

For archival purposes, I'm trying to get the full history of transactions on my bank account since I opened it in 2019. I know my bank still has it since it's visible in the mobile app (I can scroll ...
zdimension's user avatar
1 vote
1 answer
38 views

GDPR When using an external CV formatting company

As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
Sara's user avatar
  • 11
0 votes
1 answer
142 views

Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?

ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
Seeking answers's user avatar
3 votes
1 answer
255 views

What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?

What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server? The social network Mastodon https://en.wikipedia.org/wiki/Mastodon_(social_network) ...
markratledge's user avatar
5 votes
3 answers
3k views

GDPR: Do I have to IP log "every" login for a customer?

IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. ...
cagatay117's user avatar
0 votes
1 answer
51 views

GDPR @ ePrivacy & Data Controller & Local processing PII & Mobile App

I'm developing an open source client mobile app that allows user to use third-party social media. So the app logs in directly to the interface with the credentials entered by the user and makes direct ...
HenryFin123's user avatar
10 votes
2 answers
2k views

GDPR - Are technical identifiers personal data?

I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
kol's user avatar
  • 203
1 vote
1 answer
86 views

What are GDPR Laws concerning requirement to back up data

I want to create an application where I want to act as a data controller & data processor. The only data I want to record myself is basic user data like username, address , etc. But I want to run ...
Shaurya Chaudhuri's user avatar
0 votes
1 answer
37 views

Can a Data Controller refuse a second SAR from the same person?

Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
David Siegel's user avatar
3 votes
2 answers
1k views

What is the U.K. GDPR?

I understand that the DPA implemented the GDPR in British law as an act of Parliament. Then there was Brexit, and the U.K. GDPR was introduced to stand in for the no longer binding EU GDPR, with only ...
Seeking answers's user avatar
2 votes
0 answers
77 views

Is there anything to stop a subject access requester from being barred by a business?

A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
Seeking answers's user avatar
4 votes
1 answer
749 views

Is it a breach of GDPR and DPA to say a colleague is sick and off work?

This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer ...
Heddy's user avatar
  • 617
-2 votes
1 answer
68 views

How shall I handle user consent "remember" option [closed]

I get consent from user for some operation. While consenting user can check "remember consent" option and this is handled as below: Consent is saved to db Some action is done and consent is ...
Szyszka947's user avatar
0 votes
1 answer
76 views

Practical implications of failing to follow GDPR for online businesses

Suppose a person based in UK has started a one-man business online, for example, a web blog where people can read articles and post comments. Now, the business owner is focused on testing out the ...
Adden's user avatar
  • 35
-1 votes
1 answer
54 views

SAR before claim: tactical and legal considerations [closed]

A claimant C intends to sue a business B, which is also a data controller. Independently of the prospect of any civil action, C is entitled to make a SAR (Subject Access Request) to B under the Data ...
Seeking answers's user avatar
3 votes
1 answer
94 views

Processing screenshots of people's browser windows on a web server

Suppose that a software developer (April) living in the UK,has created a simple browser plug-in that takes screenshots of a user's browser windows and allows the user to enhance and "prettify&...
Adden's user avatar
  • 35

1
2
3 4 5
20