Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
896
questions
0
votes
1
answer
103
views
Do I need to worry about GDPR, CCPA, CalOPPA, if collecting anonymous usage for a non-commercial, no-ads app?
I am developing a free, non-commercial Android App that does not use Ads or in anyway attempt to share their information with a third-party. However, I would like to include both Google Analytics and ...
- 103
0
votes
2
answers
109
views
Any obligation to disclose one's name and address to private parties for service of civil claims after a street altercation?
Suppose A is walking down the street and B punches A in the nose, thus committing assault. Legally, A is entitled to claim civil damages against B, and can practically do so if they know A's name and ...
2
votes
3
answers
250
views
Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?
(Apologies in advance for the lengthy epistle)
Background:
A colleague is planning to launch a social media and forum website which will appeal to a relatively narrow audience. For the sake of ...
- 205
15
votes
3
answers
3k
views
GDPR & Blocking EU Visitors?
I recently chatted with a colleague who is preparing to launch a social networking and forum website which targets a relatively narrow audience (for discussion, let's say it is a dating site that ...
- 205
0
votes
1
answer
39
views
Under GDPR, do organisations have to tell the ICO (or similar) the email address they use for GDPR deletion requests?
As is well known, websites (illegally) use deliberately misleading and frustrating web design to slow down users who want to tell them not to collect information for marketing purposes.
If they ...
- 241
13
votes
5
answers
2k
views
Are auto-generated identifiers PII if they cannot be linked to an identity?
The reason for this post is to express a contradiction that seems to be widespread in some places on the internet.
I'm not a lawyer, I'm a software developer doing my best to comply with the GDPR and ...
- 313
2
votes
3
answers
142
views
Is storing on EU-based servers sufficient to be GDPR-compliant with regard to the Schrems II arrest if they're controlled by a U.S. company?
After the Schrems II decision, data transfers to US data processors are increasingly risky at best, for example to public cloud providers such as GCP, Azure, and AWS.
A very common suggestion is to ...
- 123
2
votes
1
answer
485
views
Do pastebin sites have to delete content on request?
A pastebin site, hosted in the US, allows users to post data anonymously. However, its intended purpose is for sharing information about one's computer, including the username (which is sometimes PII)....
- 11.3k
1
vote
1
answer
129
views
Does the ePrivacy directive apply to general JavaScript code?
Sweden have a "cookie law" that requires constent for non-necessary cookies. But the law seems way more general.
Information may be stored in or accessed from a subscriber's or user's ...
- 13
2
votes
2
answers
103
views
GDPR and personal data reselling
The situation is following:
I had an account in company A which then was sold to company B, both conduct online services.
I wasn't aware of this because I didn't log in to my account for several years,...
- 145
13
votes
2
answers
3k
views
Why does the GDPR matter to me, a US citizen with no property in Europe?
I run a Web site. I am a natural-born US citizen. I own no property outside the US. Why does my Web site have to be GDPR compliant? Even if a European court convicts me of a crime, does it really ...
- 11.3k
0
votes
1
answer
52
views
Do you need to remove a customer's data for GDPR or the like, if that data has been anonymized and used as part of an aggregate?
Say I have a SaaS which collects users financial information, or location information, or other random information, and aggregates it in an anonymous way. Say for example I present to my users "...
- 101
0
votes
1
answer
61
views
GDPR - When does data become personal data, and what exactly comprises personal data?
As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following:
...
- 103
2
votes
1
answer
125
views
Data backups, data loss, the GDPR right to be forgotten, and timing
This question concerns the timing of GDPR demands in regard to the "right to be forgotten", and data loss.
I am considering creating a web app that allows users to play a game against one ...
- 135
-2
votes
1
answer
147
views
GDPR Compliance for Application That Guesses Email Addresses
I live in the U.S. and am developing a browser extension that grabs a person's first name, last name, and company name from their LinkedIn profile and then attempts to guess their email address based ...
- 13
4
votes
1
answer
323
views
What is the most comparable American law to GDPR right to subject access? Privacy Act?
HIPAA seems comparable but only applies to medical data, but is there anything more general than that?
How does privacy act compare to data subject access rights under gdpr? Is it that it only applies ...
1
vote
1
answer
88
views
Are terms of use considered a contract from GDPR point of view?
If service terms of use doesn’t talk about setting up a contract between the company and the user, can you use «execution of contract» as the lawfulness for GDPR processing ?
If signup data is ...
- 137
1
vote
1
answer
38
views
What’s the internal DPO access level?
Since the internal Data Protection Officer (DPO) should be independent, he needs to have access to all company files. But should he have access to everything at all time, or can the company only allow ...
- 137
0
votes
1
answer
120
views
How does Facebook justify non-compliance with GDPR subject access requests?
At first when Max Schrems started doing it they complied in good faith completely.
Now they don't. Do they have some legal theory or workaround as to why they were required to back then but no longer ...
2
votes
1
answer
80
views
Legality of Credit Bureaus selling information without consent
I recently had a hard pull for a mortgage done (USA based). Since then, my personal phone number has been bombarded with calls and texts related to "better offers", despite being registered ...
- 450
1
vote
1
answer
127
views
Google CCPA Request
In Google's CCPA report, it claims that users can request data deletion via this link. However, the link provides no way to submit a request, and Google claims that there is no Google-wide support ...
- 139
0
votes
1
answer
269
views
Why does Clearview AI get multimillion dollar fines while Pimeyes is allowed to operate freely?
Yesterday the UK has fined Clearview AI 7.5 million pounds for a string of breaches of local privacy laws. The main reason for the fine is that Clearview has never asked individuals whether it can use ...
- 135
2
votes
1
answer
133
views
GDPR - asking for consent indefinitely if respondent says no, until respondent say yes by exhaustion. Confirming choices allegedly forcing behaviour?
Under EU regulation, GDPR concerns dealing of personal data and describes the different parties that are responsible for handling those data.
While navigating on the internet, a pop-up is prompted ...
- 121
2
votes
1
answer
56
views
GDPR on 3 attributes of scraped data
I have scraped horse rating data with the intent of hosting an API users can subscribe to and query the dataset in various different forms e.g. Excel, JSON etc... with added analytics applied as well.
...
- 123
2
votes
1
answer
136
views
Essential cookies - legal responsibilities
I'm using Stripe to process payments on my site
The only cookies the site uses are set and processed entirely by Stripe
The cookies would only apply to users who have 1) created an account, and 2) ...
- 121
0
votes
1
answer
139
views
Are javascript keyloggers on websites legal?
I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
- 3,338
1
vote
4
answers
160
views
Can an EU company set the salary of their employees based on the employees' needs?
Is it legally permissible, according to GDPR and Norwegian/European law, for an employer to ask their employees to:
List their yearly monetary needs
Present them to management for approval
Set their ...
- 119
2
votes
2
answers
54
views
Limits of automated decision making WRT workplace surveys
As part of the GDPR, if personal data is used for automated decision making a number of rules apply, particularly regarding consent and access to data.
A number of companies offer workplace surveys, ...
- 3,338
3
votes
1
answer
59
views
UK - Privacy Policy requirements for website with no tracking
Essentially I run a website which is a microblog for anyone to use. The user who creates the content does so on one domain which requires login, stores a cookie etc..
The reader (user) of the blog ...
- 171
0
votes
1
answer
68
views
My previous employer had a data breach
It seems my bank account details. Passport information. Address etc have been leaked. I left the company 3 years and 4 months ago.
It’s a private law firm. They have offered me a 12 month credit ...
10
votes
2
answers
3k
views
Can I store the names of arbitrary business associates in my CRM system?
I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships.
For example, "Gina works on reception."
Is this allowed ...
- 111
1
vote
1
answer
70
views
Collecting statistics from online gaming and GDPR obligations
I am looking to to build an interface within a sandbox pc game environment that will allow for the collection of tabletop wargaming game stats in addition to player online ID(steam name).
This data ...
- 13
1
vote
1
answer
79
views
Is it possible to send an additional email to people who didn't confirm their subscription?
We are wondering if we can send another email to people who subscribed to our newsletter but never clicked on the confirmation link sent afterwards. Is it ok GDPR-wise?
- 113
0
votes
1
answer
41
views
should a website show cookies popup in following context?
I am a part of developers team in a software as service project hosted and HQ-ed in United States.
Why I asking my question
I personally tasked to improve our analytics and one of tasks is to find an ...
- 103
0
votes
3
answers
248
views
Is there any restriction in the GDPR on creating a Whatsapp group?
I work with an assistance entity that helps people in situations of social vulnerability (poverty).
Surprisingly everyone has a cell phone and uses Whatsapp. Taking this facility into account, I ...
- 101
0
votes
2
answers
266
views
Is it possible to receive copy of deleted facebook messenger messages under GDPR?
Is it possible to receive copy of deleted private facebook messenger messages under GDPR if two recipients deleted them?
-1
votes
1
answer
108
views
Where is it stated in the GDPR that the GDPR only applies to EU citizens?
I recently came to the shocking realization that the GDPR does not apply to natural persons who are not EU citizens. I looked up the GDPR to find the Article or GDPR item that mentions this but could ...
- 109
1
vote
1
answer
51
views
Does an email hop in the US count as an international data transfer?
Alice is a data subject, Bob Inc. is a data controller processing her PII, both located in the UK. In responding to a subject access request, Bob Inc. sends some PII in plain text in an email. ...
- 3,338
0
votes
2
answers
75
views
Is Browser-Fingerprinting legal when I transfer/ store only the hash of user related attributes?
Is the following pseudo code, being executed within the browser, compatible with GDPR?
sha256(fonts + useragent + plugins + ..)
Notice: It doesnt store the actual attributes on the server, only the ...
1
vote
1
answer
94
views
Does the GDPR apply to reference managers?
Reference managers are software products that record the details of scientific papers that one interacts with. All academics and many others use them as a crucial tool of their work. Common examples ...
- 3,338
1
vote
1
answer
90
views
Is my name and email address being sent to another customer a GDPR violation?
An agency, to which I provided my personal email address (contains my full name), has emailed me and another of their customers (both emails in "TO" field).
The other customer and I have ...
- 163
1
vote
2
answers
47
views
Under The EU General Data Protection Regulation (GDPR,) do I need a legal obligation in order to divulge information to law enforcement?
Suppose I get a request from a law enforcement agency, for data that I'm already processing legally. Can I just give the information to the agency, or do I need to verify that I am under a legal ...
- 2,756
22
votes
2
answers
3k
views
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
- 231
3
votes
1
answer
88
views
Trans-Atlantic Data Privacy Framework - defined national security objectives
According to this release from the White House they state:
the United States is to put in place new safeguards to ensure that
signals surveillance activities are necessary and proportionate in the
...
- 133
3
votes
1
answer
115
views
Does the GDPR cover reference to court proceedings?
On this site many good answers are referenced by real court cases, usually in the form Surname vs. Surname [date] <link to further details>. There also exist documents (example is US so as not ...
- 3,338
5
votes
1
answer
195
views
Do sites need to explicitly ask for cookie consent as of 2022?
I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the ...
- 231
13
votes
2
answers
2k
views
Does the Companies Act 2006 trump an individual's right to be forgotten?
I once was a contractor and ran a limited company.
At the time all my details and my secretary's were published on the Companies House website.
edit: This information includes full names and addresses....
- 241
1
vote
2
answers
82
views
Penalties for requesting GDPR data you are not entitled to
Looking at Accessing public CCTV footage about you I could see a scenario where a stalker might request GDPR data & footage on a person they are stalking who has passed the camera.
So, imagine ...
- 121
1
vote
2
answers
2k
views
How does the personal/household activity exemption not apply to domestic CCTV pointed to the street?
I am surprised to learn that, in the UK, private/domestic CCTV cameras pointed to the public street make the owner GDPR controller — with all the consequences like having to respond to data requests ...
- 23.3k
30
votes
2
answers
5k
views
Accessing public CCTV footage about you
Near me there is a private property which has CCTV aimed away from their property and towards public walkways. I walk past these cameras on a daily basis and they're literally inches away from my face....
- 439