Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
-1
votes
1answer
66 views

Do I have to include a GDPR in my app even tho I don't collect data from users? [closed]

I have written an android app The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user? Is is ...
0
votes
2answers
51 views

GDPR Information and consent

I am building a game that stores score/level on the local device and uses non-personalized AdMob. Do I need to inform the user about storing the score locally? Do I need consent for using non-...
0
votes
0answers
28 views

Application of the GDPR to emails one has sent [duplicate]

Reading https://gdpr-info.eu/issues/personal-data/, it seems you could use the GDPR for, well, unexpected request. For example, if I ask Google to remove any email from me I have send, not only from ...
1
vote
1answer
141 views

Can I use GDPR to read an Airbnb review about me before I post mine?

I just had a bad experience with Airbnb. The circumstances would be too long to describe and not relevant to my question. The fact is that I just have had an email that the host (I am the guest) let ...
10
votes
1answer
2k views

GDPR Compliance - notification of data breach

In Art. 33, the GDPR specifies that a controller must notify a personal data breach to the supervisory authority after having become aware of it. Case 1: A database dump with personal data is hosted ...
0
votes
1answer
56 views

Allowing access to data before employment

If a company wishes to allow access to their system (e.g a new manager to view HR records, salary etc) before their employment start date, does this break any privacy, GDPR laws etc? Lets say they ...
0
votes
2answers
50 views

GDPR - Service storing other people's clients' emails

I am working on a service that allows people to import data regarding their sales within a particular platform. This data is imported in an excel format (CSV) and contains all sales informations for a ...
1
vote
1answer
68 views

Google Analytics on mobile: possible to use without consent?

I saw this thread where it's possible to use Google Analytics without consent on websites: Is it really possible to use Google Analytics without consent, and if so, why exactly? My question is: does ...
1
vote
2answers
118 views

Does GDPR's physical address rule apply to my real world hobby art group?

I run an art group (in the UK) that meets up every other month to give feedback on each others' work. To share the meeting dates and to share the work we're giving feedback on that month, I have an ...
1
vote
1answer
79 views

Is it illegal to state in your website that an employee of a company emailed you?

I have an open source project regarding software used in banking and I have received emails about it from employees working in top banks/consultancies. I am considering to mention this in the website,...
3
votes
1answer
51 views

GDPR: Transfer (chapter V)

I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web ...
1
vote
1answer
109 views

GDPR: Can I collect non-personally identifiable information?

I'm creating a game that collects data in two ways: Unity Analytics for usage stats, and bug reports that sends me a report of an issue along with several files to help me diagnose the issue. However, ...
3
votes
2answers
63 views

GDPR - am I the processor if I don't host the website?

I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase ...
17
votes
1answer
3k views

GDPR rights when subject dies; does family inherit subject rights?

Under the GDPR, anyone can make a subject access request or ask for their personal data to be erased (within limits etc.). What if the subject is deceased? Does the widow/widower or do the children ...
0
votes
1answer
128 views

Is deterministic anonymization of test data ok?

Deterministic anonymization of test data? When anonymizing multiple data sources and preserving data consistency we usually end up with a mapping table for "real to anonymized" values. Typically ...
-1
votes
1answer
73 views

Is identification of an employee by another employee restricted by GDPR? [closed]

Does GDPR require anonymization of user idents when used in testing and development? User idents will identify an employee by other employees because it's linked to login system. Outside of the ...
5
votes
1answer
138 views

Under GDPR, why is google not considering the index entries as personal data?

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling. Following this, I make the assumption that this qualifies as personal data under GDPR ...
3
votes
1answer
70 views

Do I need user consent to respond to their email sent through my website's contact form?

I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message. I'm not storing any of the data in a database or in cookies. When the user ...
2
votes
2answers
87 views

Under GDPR, are service operators allowed to record all clicks of logged in users?

Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either: The user consents to having ...
-2
votes
2answers
157 views

GDPR no opt out option [closed]

Is it legal if we do not offer an explicit opt-out option in our app for non-persnonal data collection? We planned to explain to the user what data we collect and at the bottom of the screen there ...
3
votes
2answers
387 views

Do default Apache logs violate the GDPR?

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
6
votes
4answers
215 views

Do internal annotations on user accounts fall under the GDPR?

In a platform such as Stack Exchange or any other moderated forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may ...
0
votes
2answers
55 views

GDPR - Company employee [closed]

I believe to know that an employee at a company that I'm customer at, I believe has accessed my customer profile and gotten personal information, such as my full name, ID number and address. I know ...
0
votes
1answer
78 views

GDPR: legal to combine (clickstreams) tracking and survey?

I am working on a website that collects clickstream data using Google Analytics. There is also a opti-layer. In the near future a survey to ask in which industry a visitor works shall be integrated, ...
2
votes
1answer
68 views

Legal sending personal information to a third party if the user supplied incorrect contact information?

To clarify the title, here is an example: Alice wants to sign up to online store Nile.com Alice enters the email bob@mailprovider.com by accident Nile.com does not send a verification that Alice has ...
4
votes
1answer
110 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
0
votes
2answers
51 views

GDPR question about processing personal data for research purposes that yield aggregated results

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...
1
vote
1answer
78 views

Store browser width / screen size and browser type without user consent?

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design ...
3
votes
2answers
123 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
4
votes
2answers
148 views

“no logs” website in eu - is it illegal?

As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
0
votes
2answers
104 views

Do I need permission to publish a FOI response in a blog post or open letter?

I recently submitted a FOI request to my local council, and had a response. Part of the response stated the following: You are free to use this information for your own use, including for non-...
2
votes
2answers
188 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
30
votes
4answers
8k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
1
vote
1answer
76 views

Copy of ID card: blacken / hide fields that are not relevant (Switzerland)

In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht. In article there is written that ...
0
votes
2answers
445 views

Are Steam account IDs (and telemetry data associated with Steam IDs) deemed personal data?

A few friends and were having an argument on the following situation: People can sign up for Steam accounts for free, letting them purchase games and play games over their network. Users are able to ...
2
votes
1answer
75 views

Can liability for data disclosure be waived by T&Cs under GDPR?

I live in Ireland, an EU county subject to the GDPR. I see in a service T&Cs the line: "Despite our use of commercially reasonable efforts to protect your Personal Information from ...
2
votes
4answers
686 views

How often does a website have to ask for cookie consent?

I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or ...
0
votes
1answer
158 views

Locate me data obtained from european register

There is an entry on locatefamily.com that I know because it has certain details that were used on a European domain register in 2014. I an EU citizen living in the states. Does the GDPR apply to them ...
0
votes
1answer
87 views

Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
0
votes
1answer
98 views

How do you obtain evidence for GDPR violations?

What happens when say company EvilkorP sends untrue information and/or information that it is not entitled to share to company Y, and EvilkorP asks company Y to mention some fact about the victim (you)...
0
votes
0answers
45 views

Single sign on via cookies and GDPR compliance?

Going to call my two sites "identity provider" and "WordPress site". Flow is: User logs in on identity provider User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token ...
4
votes
4answers
426 views

Is a Blood sample considered Personal Data under GDPR?

Just that simple question: Is a Blood sample considered Personal Data under GDPR?
0
votes
2answers
52 views

GDPR: can we ask the building owner to share and/or destroy data about one's RFID activity?

this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways It seems most buildings store the activity of one's RFID key activity. ...
3
votes
3answers
210 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
0
votes
1answer
77 views

GDPR: Can I do anything that touches a system with live customer data if I have no instructions at all

I have just become aware of this particular Article 29, which has one good side: it is short. The processor and any person acting under the authority of the controller or of the processor, who has ...
1
vote
4answers
155 views

Is it okay for letting agency to deny me viewing for not telling them my employer name and how long I had been in a profession?

Is it okay for a letting agency to ask me these questions ? What is the name of company I work for ? The property I am renting at the present is through agency or a landlord? How long I have been ...
1
vote
1answer
40 views

GDPR and collecting politician's social media posts

I am interested in collecting tweets and social media posts from politicians in the USA. Specifically from their political social media accounts. After reading this finextra article, I believe this ...
2
votes
2answers
165 views

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)?

Do user-generated content and votes count as personal data under the General Data Protection Regulation (GDPR)? For example, on Stack Exchange, do the questions, answers, comments, messages and ...
3
votes
4answers
82 views

Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?

I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
3answers
100 views

GDPR: Is giving out customer name and implied existence of customership legal?

I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable. The purpose is to ...

1 2 3
4
5
11