Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
969
questions
1
vote
3
answers
311
views
Can i request a religious forum to delete my posts for GDPR compliance?
It's a forum discussing religious stances and personal practice.
Is it possible to request posts to be removed along with the account registry?
As i understand it, forums in general don't have to ...
user50579
1
vote
1
answer
58
views
Can one make a Subject Access Request of a telephone Communications Provider?
I have received a suspected scam telephone call. Searching the internet for the number I found that "phone block 247520 is operated by DIDWW Ireland Limited". Searching this I came across ...
- 5,878
5
votes
1
answer
160
views
Does a US company moving its PII and web servers to the EU solve the Meta fine problem?
As discussed in this question about the Meta fine it is a problem for companies that host websites with access to EU user registration data in US datacenters. This is based on the 'Schrems II' ...
- 5,878
20
votes
2
answers
4k
views
Are global user account systems now illegal following the EU's May 2023 fine of Meta?
The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta
Like any website, we have an account system where people log in to access their ...
- 303
1
vote
0
answers
51
views
What are the limits to what the information commissioner can take action upon?
It is in the news that a doctor inappropriately accessed and distributed a patients medical records. They did this through their employer, Cambridge University Hospitals (CUH) at Addenbrookes. The ...
- 5,878
8
votes
1
answer
3k
views
Can a non-profit organization record attendance by name without permission?
I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
- 201
2
votes
1
answer
150
views
I have found my email address online in a .txt file. What should be my next step? [closed]
A few days ago someone tried to log into my bank account, the attempt was unsuccessful but it was quite concerning. I’ve spent the past weekend moving my most important accounts to alternate emails ...
- 33
4
votes
1
answer
247
views
What does "Household Exception" to the GDPR mean?
GDPR Section 2 Recital 18 (?) reads:
Not Applicable to Personal or Household Activities
This Regulation does not apply to the processing of personal data by a natural person in the course of a purely ...
- 5,878
2
votes
0
answers
44
views
Search engine data breaches, osint
Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
- 43
1
vote
1
answer
195
views
Do US companies need a cookie consent banner for EU traffic?
Example:
US website, targeting customers in the US. They use Google Analytics and Google Ads cookies etc.
Do they need a cookie consent banner for EU traffic? Or should they just not load any tracking ...
- 13
7
votes
3
answers
4k
views
On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?
I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in ...
- 173
0
votes
1
answer
241
views
Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?
Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls.
The fact that it's now allowed again makes me wonder if Italy (and the ...
- 47
0
votes
1
answer
74
views
Utilizing Browser IP for Service Security
Suppose a web designer plans to use IPs for security purposes to prevent botting unique clicks and brute force attempts. And, the site only stores a hash of the IP address for a limited amount of time ...
3
votes
1
answer
70
views
GDPR protection for non-EU individuals by using EU services through VPN use?
REASON FOR QUESTION:
I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
4
votes
1
answer
251
views
Choosing DPA to submit data breach complaint (EU-specific)
Context
The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
The offenders ...
- 153
4
votes
1
answer
98
views
How does GDPR's right to erasure apply to deduplicated storage?
I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case:
Company A offers a online data storage service that is intended to be used by the users ...
- 43
1
vote
1
answer
71
views
Do any other consumer rights laws have extraterritorial applicability to international organisations that cater to British or European customers?
The GDPR purports to bind any organisation, wheresoever it may be based, that serves individuals based in the EU, or (as the case may be) the UK.
The GDPR governs the obligations of organisations and ...
- 9,001
0
votes
1
answer
30
views
Can two or more different entities simultaneously be data controllers for the same data?
Suppose Alice is a customer of a business ACME who holds data on her like email correspondence. ACME uses a third party to manage their email, suppose Fastmail.fm. Fastmail.fm in turn delegates their ...
- 9,001
6
votes
2
answers
619
views
Is a sent email in someone else’s inbox subject to data subject rights of the sender?
Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
- 9,001
0
votes
2
answers
115
views
Publishing personal data obtained on a Swedish server - GDPR implications
Imagine a small social media chat platform is hosted in Sweden and subject to GDPR. Party A sends personal information to party B using the platform, using a private message. The information was ...
0
votes
1
answer
65
views
Can a user opt-out of embedded services without prior account-linking?
Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
- 111
-2
votes
1
answer
55
views
Old backups containing login information [closed]
I've been keeping an old website backup of a website that I used to work on on my PC for the last year or so. It was all my own work and wanted to just keep it in case I ever wanted to reuse it or use ...
- 135
-1
votes
2
answers
68
views
What would constitute personal data? [duplicate]
For example, would a name in the form first initial last name be considered personal data, considering this could apply to many people?
What about if we added in a hobby, perhaps that they watch ...
- 135
0
votes
0
answers
51
views
What is the legality and consequence of blocking one who submits a SAR? [duplicate]
Alice submits a subject access request to Bob via WhatsApp, Bob responds to this by blocking Alice, but otherwise ignores her. What is the legality and consequences of Bob’s response to her SAR?
- 9,001
3
votes
2
answers
118
views
Access rights to professional photographs
An independent professional photographer uses a sales tactic of candidly taking photos of others in public and then approaching them and offering them copies for a price. Suppose one of these ...
- 9,001
0
votes
1
answer
85
views
Who is the data controller of footage taken on a retail worker’s personal phone?
An on-duty retail employee draws their personal smartphone while in uniform and commences recording a customer. Who is the data recorded and held/controlled by, for GDPR purposes? Does the customer ...
- 9,001
0
votes
2
answers
494
views
Can a customer of a business make a recording of an employee on the business’s privately premises?
Suppose a customer enters a store. The business, through an employee, treats the customer unlawfully. Perhaps this is by verbally or physically abusing them, discriminating against them, or denying ...
- 9,001
-1
votes
2
answers
124
views
Can data protection rights of a subject be voluntarily waived?
Presumably not on protrusion by a service provider as a condition of their service. But what if someone writes to someone super busy whom they admire and says “look I really respect you and don’t want ...
- 9,001
2
votes
2
answers
94
views
Is training an AI on the internet processing personal information?
There is an article on El Reg where the author asks ChatGPT about themselves, and they get back some information. If this data acquisition and dissemination process was being performed specifically ...
- 5,878
0
votes
1
answer
52
views
EU and CLOUD Act [closed]
I can't find anything what's on this in 2023 - is EU anyhow working towards and agreement with US to allow not to give away private data? - As I see on Wikipedia, so far only UK has got this agreement ...
- 457
0
votes
1
answer
115
views
Is just embedding YouTube thumbs GDPR conform?
Is it GDPR compliant if you just embed YouTube thumbnails via URL in a content blocker preview situation. Are user data already being collected in this situation?
0
votes
3
answers
107
views
What does "necessary" mean with regards GDPR and cookie consent
The GDPR makes use of the word "necessary". For example article 6. Lawfulness of processing 1. (f) says "processing is necessary for the purposes of the legitimate interests pursued by ...
- 5,878
0
votes
1
answer
54
views
If I have concurrent user consents then can I combine these consents?
I have an app that supports concurrent user consents.
Assume that I have:
Consent A that gives access to https://example.com/resources/a
Consent B that gives access to https://example.com/resources/b....
- 115
14
votes
1
answer
2k
views
How can consent-banner as a service be GDPR compliant?
A couple of months ago I've read that hosting google fonts on your own server is a better but maybe slower solution as loading content from google servers is already something that the users must be ...
- 243
2
votes
2
answers
155
views
Is a bank account history of transactions considered personal data in the sense of GDPR?
For archival purposes, I'm trying to get the full history of transactions on my bank account since I opened it in 2019. I know my bank still has it since it's visible in the mobile app (I can scroll ...
- 121
1
vote
1
answer
38
views
GDPR When using an external CV formatting company
As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
- 11
0
votes
1
answer
142
views
Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?
ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
- 9,001
3
votes
1
answer
255
views
What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?
What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?
The social network Mastodon https://en.wikipedia.org/wiki/Mastodon_(social_network) ...
- 151
5
votes
3
answers
3k
views
GDPR: Do I have to IP log "every" login for a customer?
IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. ...
- 53
0
votes
1
answer
51
views
GDPR @ ePrivacy & Data Controller & Local processing PII & Mobile App
I'm developing an open source client mobile app that allows user to use third-party social media. So the app logs in directly to the interface with the credentials entered by the user and makes direct ...
10
votes
2
answers
2k
views
GDPR - Are technical identifiers personal data?
I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
- 203
1
vote
1
answer
86
views
What are GDPR Laws concerning requirement to back up data
I want to create an application where I want to act as a data controller & data processor.
The only data I want to record myself is basic user data like username, address , etc.
But I want to run ...
0
votes
1
answer
37
views
Can a Data Controller refuse a second SAR from the same person?
Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
- 113k
3
votes
2
answers
1k
views
What is the U.K. GDPR?
I understand that the DPA implemented the GDPR in British law as an act of Parliament. Then there was Brexit, and the U.K. GDPR was introduced to stand in for the no longer binding EU GDPR, with only ...
- 9,001
2
votes
0
answers
77
views
Is there anything to stop a subject access requester from being barred by a business?
A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
- 9,001
4
votes
1
answer
749
views
Is it a breach of GDPR and DPA to say a colleague is sick and off work?
This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer ...
- 617
-2
votes
1
answer
68
views
How shall I handle user consent "remember" option [closed]
I get consent from user for some operation. While consenting user can check "remember consent" option and this is handled as below:
Consent is saved to db
Some action is done and consent is ...
- 115
0
votes
1
answer
76
views
Practical implications of failing to follow GDPR for online businesses
Suppose a person based in UK has started a one-man business online, for example, a web blog where people can read articles and post comments. Now, the business owner is focused on testing out the ...
- 35
-1
votes
1
answer
54
views
SAR before claim: tactical and legal considerations [closed]
A claimant C intends to sue a business B, which is also a data controller. Independently of the prospect of any civil action, C is entitled to make a SAR (Subject Access Request) to B under the Data ...
- 9,001
3
votes
1
answer
94
views
Processing screenshots of people's browser windows on a web server
Suppose that a software developer (April) living in the UK,has created a simple browser plug-in that takes screenshots of a user's browser windows and allows the user to enhance and "prettify&...
- 35