Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

MDR - Is an app that supports physiotherapy patients in doing their exercises regularly a medical device according to the MDR?

With the introduction of the medical device regulation (MDR), there is a lot of ambiguity about which risk-class specific software is. And developing a medical device is linked to a lot of work and ...
  • 53
13 votes
6 answers
5k views

What should a website do if the end user refuses to accept the necessary cookies?

Suppose that a data controller chooses the consent legal basis for GDPR article 6 purposes. Then, the data controller says something along these lines in a cookie consent banner on their website: We ...
1 vote
1 answer
70 views

Incomplete/unserviceable SAR submissions and deletion timeframes

Bob was party to an incident in a shop that keeps CCTV footage for 30 days. 28 days later he submits a request for this responsive footage, but neglects to include with it adequate selfidentification ...
3 votes
1 answer
182 views

How can data received in online subject access request form be used by ACRO?

Meet Bob. Bob has requested his PNC file from ACRO Criminal Records Office under the Data Protection Act. Their online request form solicits much intrusive information. What purposes may information ...
10 votes
3 answers
3k views

Do data protection officers typically have any actual incentive to integrity in their performance of statutory duty?

Meet Bob. Bob was brutally assaulted by store security in a big corporate chain store. Bob would like to obtain evidence of the same and thus submits a gdpr subject access request to the central head ...
3 votes
0 answers
50 views

Are apps required to notify users when they update their privacy policy or EULA?

I have noticed that many companies are doing this but definitely not all. Furthermore, what about cases where companies or developers cannot notify users because some users are not logged-in or ...
  • 151
9 votes
1 answer
144 views

Can I provide multiple legal bases for GDPR purposes?

I used Termly's privacy policy generator, and in the policy that they generated there are four Article 6 legal bases: Consent Legitimate Interests Legal Obligations Vital Interests I took a ...
6 votes
1 answer
901 views

Applicability of Data Protection Laws When Talking to a Lawyer

According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. Can I tell such details legally to my lawyer when referring to ...
  • 71
3 votes
2 answers
81 views

Is anyone who develops websites or webapps for clients legally responsible for what they are creating and all the gdpr obligations?

Suppose the case of a european (italian) web developer who, at the request of a client, creates a web platform for him from scratch (also with database, saving user’s data, ecc.). When putting the ...
1 vote
2 answers
146 views

How do email delivery services store users' email addresses in a GDPR compliant way?

Mailchimp, Twilio, Hubspot and other services provide apis to save lists of email-addresses and send them emails (marketing, technical, etc.). Even if a user asked to unsubscribe, those services will ...
  • 113
5 votes
1 answer
266 views

GDPR - Consent to the use of personal data on mobile app - stored per device or signed up user?

For my mobile app, I need to get users' consent to process their personal data (and separately to use anonymized data for Google Analytics). I am unsure, however, how exactly I have to implement this. ...
  • 53
0 votes
1 answer
55 views

GDPR storing vs processing / computing data (failover scenarios)

I'm having a hard time understanding what exactly is meant by 'data processing' in GDPR. There's one specific scenario which I'll explain later, but I will first try to simplify my question. Let's say ...
  • 103
0 votes
1 answer
61 views

Practical GDPR guidance for online businesses

When you start an online business, or even just create a website, there is a lot of confusion on what needs to be done to comply with GDPR. As many online resources (including StackExchange) suggest, ...
-1 votes
1 answer
71 views

By what mechanism does GDPR jurisdiction bind data controllers that operate outside the EU?

If you process the data of data subjects resident in the EU then you are supposed to be bound by the GDPR no matter where you are located. Why care what the GDPR says if you don't have a presence in ...
4 votes
2 answers
160 views

What is the lawful basis for running Know Your Customer (KYC) checks on startup investors?

Suppose you have a startup that raises money from a number of angel investors, many of whom are investing as natural persons. What is the lawful GDPR basis for processing the investors' personal data, ...
1 vote
1 answer
39 views

Understanding the last sentence in Article 25(2) of GDPR

Article 25(2) of GDPR says the following (emphasis mine): The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are ...
11 votes
4 answers
4k views

Do I need to present a GDPR banner to IP addresses outside of GDPR regions?

The context of my question comes from this comment: The problem with solving GDPR compliance with country codes is, it is not in general sufficient to determine if a user is covered by the GDPR. The ...
3 votes
1 answer
96 views

Does the GDPR's "right to be forgotten" extend to Google's search results?

I have recently "googled" my own full name and found out that some comments I made during my teens have been indexed by Google. Back then I have used my full name as a user-name on that ...
  • 31
2 votes
2 answers
441 views

Is Pushshift.io compliant to GDPR if they refuse to delete collected content?

Pushshift.io collects posts and comments using Reddit API, and saves that data into their database. This service is used by websites that allow you to see deleted contents in Reddit. For example, if ...
  • 39
0 votes
2 answers
88 views

Where should personal data be stored to comply with GDPR?

We are a company based in Europe. We have personal data about our users worldwide (name, mail, phone number, company, title). And currently it is stored in Microsoft Azure. We don't know physically ...
  • 103
-1 votes
1 answer
35 views

What are good tips and tricks to keep in mind when performing a subject access request for a comprehensive record of self-pertinent data from the met?

Bob would like to obtain as comprehensive as possible am archive of all data held on him by the metropolitan police, as well as any other police networks that they may be part of and share data with/...
1 vote
1 answer
47 views

Can I process personal data without consent if it it helps me serve the user sooner, rather than later?

I am designing an application and would like to process personal data in a way that may not be strictly necessary to fulfill a customer's request, but that would facilitate my doing so. It'd be a bit ...
  • 2,758
6 votes
2 answers
1k views

Are push tokens considered PII under the GDPR or the CCPA?

I'm building a server for an app and I'm trying to get my privacy protections right. The app allows users to opt in to push notifications. If the user opts in, then I save a push notification token ...
3 votes
1 answer
72 views

What exactly triggers the GDPR Article 14?

Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject: Art. 14 ...
  • 3,368
2 votes
1 answer
156 views

Do I need a cookie policy/cookie consent on my website just because I use PayPal buttons?

I'm building a website, and the only third party element in it is a PayPal button I use for payments. The PayPal button opens a pop-up window which has its own cookie consent banner. Does that mean I ...
  • 21
11 votes
4 answers
4k views

Is there a way to determine if an email address is personal information?

The GDPR defines personal data as: Personal data is information that relates to an identified or identifiable individual. My understanding is that this means that firstname.lastname@example.com is ...
  • 3,368
1 vote
0 answers
24 views

Do we need GDPR policy statement if we do not use Cookies or obtain personal information from users? [duplicate]

I am developing a static website to provide some blogs and documentation related to company products. It's a simple website and we have decided not to use any Cookies or obtain personal information ...
4 votes
1 answer
89 views

Any GDPR implications when displaying publicly accessible info on a website?

There's a simple static website written by a couple of university students that provides useful information about it, containing among other things contact information of faculty members (email, ...
1 vote
1 answer
70 views

Is satelite data personal data?

It is in the news that artificial intelligence (AI) has been applied to aerial photography to identify homeowners who have made unauthorised additions of swimming pools to their properties in France. ...
  • 3,368
1 vote
2 answers
186 views

Is password reset to a known default value GDPR compliant?

I am working in a project where there are two procedure to change user password : The more common technique, in which user click on "change password" button (or "forgot password")....
  • 115
5 votes
3 answers
2k views

Does GDPR restrict handling data that the user has certified is not personal information

If my site ToS has this: By submitting data to the this site, you certify that the data is not of a nature that would cause me to have any special obligations under applicable law. And someone from ...
  • 11.6k
1 vote
1 answer
29 views

Responsabilities on data breaches UK Data Protection Act

Following a question from THIS StackExchange about Data Protection Act application in the UK, there is an aspect about "proactivity" and "responsabilities" that I do not fully ...
  • 15
0 votes
1 answer
37 views

Does GDPR apply to a non-EU company communicating with me?

Someone used my e-mail address to create an account at one on-line service in a country that is not in EU. I told the company about that and they responded with that they have undone that. But now, I ...
  • 151
0 votes
1 answer
44 views

Does the UK have a (enforcable) law linked with the Data Protection Act to control document's metadata?

Reading the information on the ICO's website, I came across a few items mentioning how to handle metadata on my organization's workflow like THIS or THIS. I noticed they use expressions like "...
  • 15
1 vote
2 answers
36 views

How to conduct a GDPR compliant survey if not collecting personal information, e.g. names, but potentially personally identifiable information?

If I were to conduct a survey of members of a public group in the EU (for my own personal interests) what should be considered in order to comply to GDPR regulations? If the information does not ...
  • 155
2 votes
1 answer
334 views

Can we use Firebase Authentication and be GDPR compliant?

The Firebase Authentication is processing data exclusively in the United States, and is therefore not GDPR compliant. However, they are saying on the same site that: Firebase has moved to reliance on ...
1 vote
1 answer
24 views

GDPR: hashed variable linking customer database with survey answers?

I was reading a similar question (A salt hashed with user password is anonymous data for GDPR?) but it's not 100% clear to me whether this applies to my question as well. I'll describe the issue in an ...
1 vote
1 answer
77 views

Is using Gists on GitHub Pages a GDPR violation?

I'm using GitHub pages to serve my little blog. On some posts, I'm embedding Gists to nicely render little code snippets, e. g. here: Now the Privacy Badger browser extension reports that gist.github....
  • 113
4 votes
1 answer
117 views

GDPR issues with Google sharing suspected child abuse images with law enforcement

I recently read of a man who had a Google account. His son's doctor asked for photos of a medical issue his son was having around his groin area, so his wife used his phone to take some. Google ...
  • 1,722
3 votes
1 answer
153 views

Do I violate the EU GDPR when I host a static website on Google?

To my knowledge IP addresses are considered personal data under the GDPR and thus may only be processed under one of several conditions (one being user consent). There has also been a verdict in a ...
  • 31
4 votes
1 answer
55 views

Do I need to consider GDPR when conducting a survey for a personal project from people in a public Facebook group within the EU?

I am a member of a Facebook group that exists to help people apply for citizenship and provide advice in the process. The timeline for applying for citizenship varies wildly depending on a number of ...
  • 155
1 vote
1 answer
56 views

Can a company take legal action if the GDPR requestor is not a European citizen?

I want to request the "Right to be forgotten" from a company that complies with the GDPR regulations. In the email, I have included the below: As laid down in Article 12(3) GDPR, you have ...
3 votes
1 answer
69 views

Tenancies and the GDPR

If Tim the tenant and Larry the landlord enter into a tenancy, then do either of them become a data controller of the others name and address? Does the landlord as the "provider" of the ...
5 votes
2 answers
1k views

Under GDPR, does blurhash of a profile picture count as personal data

Suppose I have a web service where users can have a profile page with name and picture. Blurhash is a technology that allows me to create a significantly blurred representation of an image, as a ...
1 vote
1 answer
80 views

"Find my device" and GDPR compliance

Google and Apple both offer a "Find my Device" service which allows to track or even remotely wipe a stolen device. Yet some companies claim that tracking stolen devices is not a legitimate ...
0 votes
2 answers
90 views

Server side analytics events

If I track a 'questionnaire started' event with a user's GUID for analytics purposes server side, could that contravene any UK data laws such as GDPR or the ePrivacy / cookie consent law? The reason I ...
2 votes
2 answers
80 views

Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?

Suppose I check into a German hotel and a Johann stayed in room 123 on the previous night. Presumably, he is the only Johann who stayed in the room on that night. There are many Johanns within Germany ...
  • 2,758
22 votes
2 answers
2k views

Other use of profile photos: legality fair-use and permissions

I'm building an app that works across mobile devices and browsers. There is a chat component and I will be showing the profile photos that I find on the user's phone book (not from the image folders). ...
0 votes
2 answers
44 views

If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?

Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with ...
  • 3,368
1 vote
1 answer
109 views

Under what circumstances is it lawful or unlawful for police to disclose one's information to third parties, e.g. complainants?

Is it basically neither prohibited nor required and thus entirely to police discretion as to whether or not to disclose parties' details to either their purported victims, or to other parties like ...

1
2
3 4 5
18