Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
-3
votes
1answer
102 views

Can the POPI act land the CEO of a tech giant in a South African jail?

How likely is it that a breach of POPI act will lead to a CEO of a tech giant being subject to jail?Will it really be the CEO or other officials? The South African POPI Act could impose imprisonment ...
2
votes
1answer
200 views

Privacy Policy if App's internal data, probably containing private data in terms of GDPR, is automatically backed up in Google Cloud

If I develop an Android App, the per-default setting is that the App's internal data, probably containing private data in terms of GDPR, is automatically backed up in Google Cloud (unless the phone ...
7
votes
2answers
719 views

As per GDPR, how are the agree/disagree to cookie buttons to be designed?

I just stumbled over this very... interesting cookie dialogue on the Ansible site: How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
3
votes
1answer
57 views

GDPR: Can I make a subject access request for information that I obviously already know?

The GDPR guidance states that subject access requests can only be refused if they are manifestly unfounded or excessive. The detailed guidance on what constitutes manifestly unfounded or excessive can ...
0
votes
0answers
44 views

Mandatory languages for privacy policies in Japan (APPI)

I work on Apps, currently Android, which are distributed via Google Play. As the EU has GDPR, in Japan they have APPI (Act on the Protection of Personal Information) which is something like the ...
0
votes
2answers
105 views

Isn't it impossible to respond to certain data access requests?

There is an european named A. He goes to a website and tells the website "under my GDPR right to access (given by this one) I hereby ask for my ip address which you logged on september 4, 2018.&...
0
votes
2answers
152 views

Can data processors charge a fee?

Under GDPR can data processors charge a fee over their normal charge just because they have to perform GDPR requests on request of data controller? One scenario-> Data subject asks controller to ...
2
votes
1answer
51 views

What subject access rights exist when only some of the data relates to you?

If some data record exists where some of the data relates to person A (eg. telephone number) while other data does not (eg. name), what right of access does person A have to that record under the GDPR?...
0
votes
0answers
63 views

Very simple static website with Google Analytics. How to make it GDPR compliant?

There is a very simple static website for a commerce. That website only shows information. It has Google Analytics to count visits with the default GA script placed in : <head> <script>...
-1
votes
2answers
145 views

EU refunds law for Play Store

According to EU refund law, if a person releases an app on the Google Play Store, does the person need to even give the payment he received back? Can one specify no refunds by putting it after the app ...
0
votes
0answers
29 views

GDPR legitimate interest and Contact Picker API

There is a draft web standard Contact Picker API see here and here. An explicit use case is "bootstrapping a user’s social graph for social networks". I'm interested in what ways this can ...
-1
votes
1answer
61 views

Does Excessive consents clause hold up against consent requests in GDPR

GDPR states that one must record consent https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/how-should-we-obtain-record-and-...
0
votes
1answer
60 views

Does EU geoblocking apply to businesses outside EU?

This : https://support.stripe.com/questions/eu-geo-blocking-regulation-changes states that EU has passed a law preventing geoblocking .Does this apply to businesses outside EU. It is favourable to ...
-1
votes
1answer
69 views

How can I implement GDPR in a simple program?

I would like to get some analytics from a simple program that I wrote to manage a game server. The data I want are (collected every 15 min): operative system (windows/linux 32/64bit) machine id (...
-5
votes
1answer
71 views

How is S.E. a processor of data according to GDPR? [closed]

This states that S.E. is a data processor and customers are the data controller . However after we enter data it is S.E. which determines how it is shown and/or delivered (i) to their servers . So ...
0
votes
2answers
235 views

GDPR compliance cookie-less Google Analytics and consent banner

I've been reading about GDPR a lot, and I have a bit of a confusion. I know I have to show a consent banner with an opt-in for enabling cookies related to Google Analytics. Frankly I would like to ...
-1
votes
1answer
93 views

GDPR and HTTP requests

A person A makes an app and publishes it to play store. The app requests a page from a server not under his control as a part of the app . The users ip address is transmitted and logged in the servers ...
-1
votes
2answers
103 views

Blocking certain countries

Due to some laws one wants to block certain countries from accessing his app which he uploaded on play console.One turns off those countries in GOOGLE play console so it cannot be downloaded in those ...
7
votes
1answer
124 views

As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?

The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
6
votes
2answers
3k views

Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user's jurisdiction?

Can one add a clause stating Do not use this application if the terms demanded cannot be provided by law For example, let's say one term of use states that information collected may be retained ...
0
votes
2answers
67 views

Are search keywords seen as non-personal information?

For example someone is browsing a popular shop like Amazon, what does GDPR say about this?
-2
votes
1answer
150 views

GDPR liability for data that is no longer under the developer's control

Let's say AdMob is used in a mobile app. AdMob collects data and transfers it to Google. There is no longer any access possible to the data by the developer. Is the app creator liable for Google's ...
0
votes
2answers
77 views

Does information related to client IP address is been allowed as per GDPR policies. Without asking user's location

We need implement user's nearby store locator. Where we have code to get user's ISP location from where the client request is been triggered. But getting lat-long & city details by checking client ...
-1
votes
1answer
47 views

Do I need GDPR contracts/agreements?

We use a service (Meetup.com) to post our events publicly. We do not store/collect/process any information about any attendants except for the number of sandwiches to order. Everything is kept in ...
0
votes
0answers
63 views

GDPR - Who Called Me type of situation

I would like to ask how does it work with GDPR and a service like "who called me". Basically there are no publicly listed phone numbers as these kind of websites are using pretty much every ...
3
votes
1answer
364 views

Is a cookie notice required for analytics?

Note: I've been directed here from Meta.SE I'm using GoSquared for my website analytics. I've visited quite a few sites using Google Analytics but they don't have a cookie policy or a cookie banner/...
2
votes
2answers
82 views

Can a German employer force employees to submit personal data to a contractor?

A German higher-education institution recently introduced a new measure to facilitate Covid-19 contact tracing: next to each door (i.e. entrances to the building, the lecture rooms, the labs and some ...
21
votes
1answer
5k views

Am I obligated to decrypt lots of data for GDPR requests?

I am providing a B2B service where customer data of businesses are stored in an SQL table. As I never need to query for this personal data, the data at rest there is asymmetrically encrypted with the ...
0
votes
0answers
65 views

How to describe your experience in your CV/Resume without breaking copyright / GDPR rules?

Are there rules (EU & US) defining how far one can go in decribing his professional experience as a software developer, and telling about the projects he worked on? For example, if I do not ...
-1
votes
1answer
70 views

Why is my GDPR (a.17) request not fulfilled?

For over a year, I'm trying to get "wordpress.org" to delete my personal data from their bugtracker (the pseudonym is linked to my full personal address). According to https://wordpress.org/...
0
votes
2answers
182 views

Inactive account deleted under GDPR (data retention) laws. Should the credit on it have been refunded to the account holder?

I have a situation where a UK utility (mobile phone) account has been inactive for more than 7 years. The account was deleted under data retention laws (GDPR) but had a positive credit balance at the ...
-1
votes
1answer
69 views

GDPR account verification

I am having trouble in deciding what information I should be recording in order to verify an account user in the event that a) the user is locked out of their account for some reason b) they make an ...
0
votes
0answers
93 views

Is it illegal to refuse to fix a hacked website?

Suppose there's a website or a server that has been hacked. There is no personal data stored anywhere, so there hasn't been a real data breach, because basically there's no valuable data to steal at ...
1
vote
2answers
414 views

GDPR, PII, and UUIDs

GDPR states that An individual is ‘identified’ or ‘identifiable’ if you can distinguish them from other individuals. and also that The GDPR provides a non-exhaustive list of identifiers, including: ...
1
vote
0answers
59 views

What is the penalty for not respecting GDPR outside EU? [duplicate]

What happens when a newspaper website in USA or in Australia or in Japan does not comply with GDPR? Can EU punish them in any way?
0
votes
1answer
71 views

What's the rationale for "joint controller" instead of keeping every entity doing stricly separate?

After reading Case C-40/17 and Case C-210/16 I still cannot figure out why GDPR would require "joint controller" decision. Wouldn't it be much simpler to decide that e.g. in "Fashion ID&...
0
votes
1answer
622 views

Who needs to implement Cookie Consent for embedded content?

Given a page X that doesn't use cookies or only uses necessary cookies per GDRP and as such, doesn't need explicit Cookie Consent. The X is then modified to include a Youtube video using <iframe>...
2
votes
1answer
97 views

Right to personal data on youtube : what if account is banned

Since GDPR at least we have the right to access and get the data we generated on websites like Facebook or Google (our history, likes, almost everything). My question is : what happens if Facebook or ...
1
vote
1answer
56 views

How does GDPR affect game data and how it is processed?

A real-time strategy game's data involving player points is available publicly (the point data is paired with their username). A player gains points through actions such as 'attacking' and 'building'. ...
0
votes
1answer
145 views

Online player nicks: personal data under GDPR?

We run a server for an old, open-source FPS game. The game collects match events that get logged, where the only information stored is player nicknames (changeable at will at any time by the players). ...
2
votes
1answer
153 views

Does sharing personal data publicly imply consent for collection and processing?

Suppose an EU citizen publishes their personal information, such as name and contact details online, for instance, on social media. If I wanted to contact them in my professional capacity over email, ...
3
votes
2answers
122 views

What does "structured, commonly used and machine-readable format" look like in practice?

I have made a subject access request, and the result included: Statement that their right to process data is from Article 6(1)(b) A series of images, that appear to be photographs of a computer ...
2
votes
3answers
483 views

Does GDPR consent notification apply to access points intended purely for maintenance?

Suppose I have a publicly available interface, intended to be used exclusively by me or my employees for the purposes of maintenance, e.g. an SSH server. Since I am processing user's IP address when ...
1
vote
1answer
110 views

Cookie consent compliance: disabling JavaScript and keyboard accessibility

I've noticed that most cookie consent solutions are JavaScript based, and when you have JS disabled, the cookie consent settings may not be accessible. Speaking of accessibility, some cookie consent ...
1
vote
1answer
91 views

Do users who are given another user's email address have obligations under GDPR?

I have an app/website which connects people into groups and then the group performs work in the real world. That work in the real world will occasionally require that group members talk to each other. ...
1
vote
1answer
158 views

GDPR and global load balancing

Given the recent ruling in regards to the EU-US Privacy Shield and GDPR [1] would it still be possible to implement a global system with regional data sources? Specifically can you request a user ...
0
votes
1answer
39 views

Can internet providers use navigation data for advertising / profiling?

My internet provider knows which sites I am connecting to (even if only the server names, when using https). Can they legally use that information for profiling / advertising? For instance, if they ...
0
votes
1answer
44 views

International Transfers to a Data Subject

A membership organisation based in the EEA receives membership applications from people based outside of the EEA, in countries which do not have an adequacy decision. During the course of the ...
0
votes
0answers
84 views

Private messages on social media - GDPR [duplicate]

As the title suggests, if you delete your account on social media/dating websites and there are personal/private chat messages there. Under GDPR, would these have to be deleted by the controller? So ...
0
votes
3answers
1k views

Is the user agent string considered personal data?

I have a website. I would like to store the user agent string, current time and opened url (not the IP address or something else) in a database for each page visit to be able to build some statistical ...

1 2 3
4
5
15