Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
896
questions
2
votes
1
answer
83
views
If one requests bodycam footage of a police encounter involving another person, would they be notified of the request?
If party A calls the police on party B and they attend, then party B is entitled to request the bodycam footage of the encounter under the GDPR. If party B performs such a request, and party A appears ...
- 797
1
vote
2
answers
85
views
Do EU GDPR demands on a web hosting service extend to its clients?
If a web hosting service like GoDaddy or Wordpress.com is subject to GDPR, does it require they impose GDPR requirements on their clients?
Does it matter whether the client is subject to the GDPR or ...
- 444
1
vote
1
answer
181
views
Is it ok to use slack in EU without data residency option?
Since you can only setup Slack data residency in EU on the most expensive plans, is it ok to use their service still under GDPR rules without that option?
Would signing a DPA stating they are ...
- 137
1
vote
1
answer
112
views
GDPR: Storing consent for non-personal data cookie
According to GDPR you need to store information about consent given to using cookies. We don't process any personal data, but we place an analytic cookie (to recognize returning visitors) so we need ...
- 111
3
votes
1
answer
140
views
Is posting another persons PI on social media a GDPR violation?
If Alice posts Bobinators private information like full name and address on a Facebook group, in an attempt to warn others of bad experience with him, is it a GDPR violation?
Does it matter if a group ...
- 177
0
votes
1
answer
89
views
What are the limits of ID requirements for a subject access request?
When one makes a subject access request it is required that the data controller is required to ensure the identity of the requestor, to prevent unauthorised individuals accessing personal data of ...
- 3,338
3
votes
1
answer
1k
views
Does the IP logging + user data apply to GDPR?
I read a lot about logging IP addresses, and it applies to GDPR:
Do default Apache logs violate the GDPR?
How to satisfy GDPR's consent requirement for IP logging?
My question is slightly ...
- 141
2
votes
1
answer
620
views
Is MailChimp compliant with GDPR?
In light of recent news of Facebook not being compliant with GDPR because it processes data in USA and not in europe, would a website using MailChimp for newsletter be GDPR compliant since it is based ...
- 177
1
vote
3
answers
106
views
How to avoid having problem with data protection regulations (GDPR)?
I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by ...
- 113
1
vote
1
answer
76
views
What global big tech does to comply with data protection laws all over the world?
Give this scenario...
A user in Germany, a user in US.
Each one decides to create an account on Facebook and facebook is located in US...
According with GDPR, US cannot store data from EU Citizens. So,...
- 121
0
votes
1
answer
101
views
What is the correct responce of a data processor to a SAR if they have multiple controllers?
In the case where a subjects data handled both by a data controller and a data processor, and the subject makes a data subject access request (SAR) of the processor the usual procedure if for the data ...
- 3,338
1
vote
1
answer
36
views
What references are available for the GDPR legitimate interests balancing test?
A basis for the processing of personally identifiable data (PII) is legitimate interest. According to the UK ICO data controllers who rely on this basis should conduct a legitimate interests ...
- 867
0
votes
1
answer
96
views
How does GDPR Art. 14 apply to large scale B2B data transfer
Article 14 of the GDPR appears to require any data controller to inform the data subject when a business to business transfer of personal data occurs. Business to business transfer of personal data ...
- 3,338
4
votes
1
answer
154
views
Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever
I have a small static personal website, where I publish some technical articles and my personal CV.
Do I need to include a privacy-policy if:
There are no (third- or first party) tracking services ...
- 43
1
vote
1
answer
73
views
Under GDPR can a company give out the demographics of employees e.g. ethnic background without anonymising it?
If a client asks for the demographics of a company's employees e.g. female to male ratio or ethnicity. Does this have to be anonymised so it is compliant with the GDPR or can the names be revealed?
- 231
2
votes
1
answer
114
views
Can I use forum posts related to user to analyze them?
I would like to create an app, which would make analyses based on user behaviors, posts, comments.
I can gather those data from sites, forums because e.g twitter and so are public websites, they are ...
- 123
3
votes
1
answer
108
views
Does failure to provide photo of face count as breach of GDPR in UK?
I have requested that an aesthetic clinic send me the 'before' images taken of my face before a procedure two times via email. They have ignored my requests while responding to other questions in the ...
- 373
3
votes
1
answer
51
views
"Destiny" of issued certificates after account deletion
Lets say I have a online-training platform where I issue "completion certificates" to users who complete the course (like Udemy, Coursera, etc.).
One day a user wants to delete their account....
- 133
0
votes
1
answer
70
views
Is GDPR consent as part of Terms & Conditions valid?
In the terms and conditions of the kite festival consent for use of footage of the audience is written into the Terms & Conditions:
5.c: Ticket Holders consent to being photographed, filmed and ...
- 3,338
1
vote
1
answer
212
views
Is it obligatory to make my name and address known publicly in compliance with Art 13 GDPR?
I'm a private individual. I live in EU. I'd like to create a personal blog on blogger.com and put there Google AdSense advertisements. Do I have to state there also publicly my given name, surname, ...
- 13
3
votes
1
answer
94
views
A scholarship organization is publishing my personal information on their website
In February 2018, I received a one-time scholarship (1000 €) from a private association in the EU. A few months ago, I noticed the organization published on their website private information of the ...
- 131
1
vote
1
answer
58
views
GDPR (and data protection laws in general) in regard to non-commercial, personal database
(this is the closest StackExchange site I could find, even so, I'm sorry if the Q is still a bit out of place).
So, I've just finished building an application for better handling some of my needs and ...
user43325
2
votes
2
answers
180
views
Is blocking third-party phone numbers GDPR-compliant?
To be compliant with GDPR you have to process phone numbers as personal data.
Suppose there is a service which users can subscribe to in order to block calls from numbers which the users nominate. The ...
- 31
12
votes
5
answers
4k
views
How can I get more than 10 years of transaction history from my bank?
I will shamefully admit that it was only in the year 2021 that I finally built my own bookkeeping system. Yes, I should have done it 10-20 years ago, but I didn't. So now I'm in this situation:
First ...
- 147
0
votes
3
answers
80
views
GDPR - access to transaction data
Is it within my rights as a user of a payment service like Paypal or Western Union, to ask for the full details of a transaction that I did (namely the card number of the recipient) ?
edited : bank ...
0
votes
1
answer
89
views
GDPR and Personal Data Encryption
Suppose we have some user's personal data, that we have to encrypt and store in a database.
I've read this would technically not be a breach of personal data, since the attacker would only have ...
4
votes
2
answers
148
views
Can a company force you to create an account on their system to comply with a GDPR request?
This is an EU question.
I did a request Equifax to send me a copy of all my personal data (not my credit report, but all personal data), under GDPR.
In reply, they are asking me to create an account ...
- 463
15
votes
2
answers
5k
views
Does GDPR apply if my web app stores personal data on the user's phone only?
My web app stores personal data about the user, but on the user's phone only (HTML5 Local Storage). The data is never touched by any server or database. I can't see the data. My server can't see the ...
- 253
2
votes
1
answer
50
views
Can I used leaked datasets as entries in my Application?
currently writing a Booking clone application. I wanna fill it with users,I currently have 553m users from Facebook leak. The project will not be sold or anything,its just for show. Can I do it? ...
- 23
1
vote
1
answer
269
views
Storing EU PIIs in US located servers
I have a business based in Romania and I am about to launch an iOS mobile application that will be available all over the world. The application will communicate with a backend server, which is used ...
- 113
10
votes
2
answers
3k
views
Can a company actually become GDPR compliant? Is there such a thing?
(This question could be expanded to other auditing procedures too)
How do huge multinational companies that want to become GDPR compliant start off this? I mean, I guess one has to read the regulation,...
- 103
-1
votes
1
answer
46
views
Arbitration and GDPR
Arbitration allow a both parties to settle the dispute outside the court where the arbitrator would decide the law to b e applied to the dispute?.
However, arbitration will not exempt their ...
- 85
0
votes
1
answer
58
views
GDPR and Website Accept Cookies window
Do I really need this window popup on my website if I am not explicitly setting any of the cookies?
I have a website that uses maybe 2 outside scripts and they do set few cookies but on their domain ...
1
vote
1
answer
48
views
GDPR and Certification Check
Based in UK.
I manage a certification website that allows users to register an account and complete a course, before doing so they explicitly agree to the website's privacy policy and GDPR. The ...
- 111
0
votes
2
answers
89
views
Email and Name Data Pseudonymize
As per GDPR, we need to pseudonymize the name and email address. How can we pseudonymize name and email address? For example, is the below is correct way to pseudonymize?
Steve Anderson
Stxxx ...
1
vote
2
answers
704
views
A salt hashed with user password is anonymous data for GDPR?
I want to use a scheme to track the user in a anonymous way. My idea is to use the user password to hash a salt to create a identify hash and track the user through this. Theoretically, the only way ...
- 11
2
votes
1
answer
468
views
Do I need to ask an Android user to opt-into push notifications as per GDPR?
On Android, we do not need to explicitly ask a user to opt into push notifications. They are presumed to be opted in and can manually opt out. This is different from iOS where users must explicitly ...
- 23
0
votes
1
answer
354
views
Can you legally use eye tracking on your website?
If user visits your website, can you legally use their camera to track where they are looking at and then transform this data to heatmaps? If yes, under what circumstances?
Our company created a web ...
8
votes
1
answer
3k
views
Is storing records of chess games a violation of GDPR?
Many amateur chess players store the notations of their games in electronic format (like pgn) so that they can later reference the game for analytical and historical reasons. Information in this file ...
- 193
0
votes
2
answers
106
views
How to handle account deletion of user with financial information and/or otherwise liability related information
So, I read a post on reddit the other day about a user unhappy with Binance (crypto currency exchange company) for only being able to "disable" his account but not "delete" it.
...
- 347
-1
votes
2
answers
110
views
Under GDPR's strict consent requirement rules, could a criminal/hacker/troll remain anonymous in all his activities?
Since GDPR strictly requires consent to Personal Identifiable Information (PII), could a criminal exploit online services by remaining anonymous in all his criminal activities?
Providers are not ...
- 1,471
12
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 1,471
1
vote
1
answer
80
views
Can you opt out of use of your personal information by your country's registry?
I was changing my address a week ago and I noticed that it said in tiny letters that the information I provide may be used for direct advertising, marketting, scientific research, data collection and &...
- 11
2
votes
1
answer
94
views
Count visitor per day with GDPR & Cookies in EU
My question is: how is it possible calculate visitors per day without gathering some information about the users in order to be able to identify them as revisits?
We have a cookie consent banner in ...
- 133
2
votes
1
answer
275
views
Can you preemptively check local storage before user agrees under Cookie Law?
I am pretty new to the idea of asking for consent for storage for a website because I'm American. I understand that if I want to store anything, I need to ask users for consent.
However, I'm confused ...
- 23
-2
votes
1
answer
117
views
Is this Cookie scenario GDPR compliant?
I noticed that many websites, including StackExchange websites just have a banner while full functionality is provided by the website, which is probably not GDPR compliant. Is this true?
As far as I ...
- 109
2
votes
1
answer
290
views
Date Privacy and Twitch; Do I have the right to access my chat logs?
Under Data Privacy laws, the user has a right to access their data, erasure, etc. Yet under Twitch the users have no way to access their own logs, only the streamer and a team of mods.
This has always ...
- 23
0
votes
1
answer
87
views
GDPR Compliance - Password Protected Documents in AutoRecovery
I'm working with personnel data in my job, including lots of details which I know to be sensitive and most certainly covered by GDPR.
In order to maintain compliance with the regulations while ...
- 1
3
votes
1
answer
69
views
Site user posts data under licnese, can user demand erasure?
Suppose that a site, run as a free service, allows communication between users (a chat site). Suppose that the site also permits users to optionally upload text documents or images, which will be ...
- 112k
-1
votes
2
answers
309
views
Is Apple scanning user content for child abuse a violation of GDPR?
According to this article Apple is scanning all the photos users have on their devices to detect possible child abuse. The article explains that a NeuralHash of each image will be uploaded to Apple ...
- 480