Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
896
questions
0
votes
1
answer
83
views
May I publish source code of my project without notifications about use of personal data and cookies and not break laws during it?
I have created the demo software project (frontend and backend modules) for manage staff. I want to publish source code of the project on GitHub. I know that according to GPDR page must have ...
- 33
0
votes
2
answers
93
views
The Right to be Forgotten: can it be used to hide past public (news) information?
In the EU there is a "Right to be forgotten" This was created by Directive 95/46/EC in 2012 as a right to insist that search engines not link to personal data, and subsumed into tech "...
- 112k
1
vote
1
answer
100
views
Are firm's vendors liable in case the firm deliberately and openly shuns GDPR compliance?
This is hypothetical and it's only meant to ask about the extent of the law, not ask for a particular legal advice.
Let's say a US merchant's website uses exclusively regional US banks. Because they ...
- 2,469
12
votes
1
answer
1k
views
Is an email enumeration vulnerability a breach of GDPR?
I'm a software engineer and I'm often asked to implement version of a user signup flow or login that can be summarised as follows:
User inputs their email
If the email belongs to an existing user, ...
- 163
6
votes
1
answer
2k
views
Is this a valid approach to ask consent under GDPR?
I'm trying to figure out the best way to gather user consent to use third-party services in a mobile app for users under the GDPR. Let's say that I have an app that uses third party services (...
- 313
0
votes
1
answer
177
views
Can you track those who denied tracking on a website?
I'm coordinating a website project where we are implementing Analytics and a GDPR compliant Cookie Banner. I was asked if we had a way to track how many users have declined analytics in case we needed ...
- 103
1
vote
1
answer
53
views
DSGVO: Saving adress data
According to GDPR (DSGVO in germany), would it be allowed to save an adress without a name of the person?
Would it also be allowed to do the same with a hash of the persons name? The name of the ...
- 113
8
votes
2
answers
2k
views
Are there ways of storing personal data beyond standard GDPR limitations?
So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data.
...
- 281
0
votes
2
answers
429
views
Is Google's Consent Management Platform not GDPR compliant since it does not show a consent form when 'personalised ads' are disabled?
This question borders the line between technical and legal but I am posting here because it is not a coding problem in itself. Apologies if this is the wrong forum.
I have set up my mobile app to use ...
- 75
2
votes
2
answers
354
views
Would a VPN user still be under GDPR protection?
I got a client that wants to remove the 'GDPR please accept our cookies' banner when the user is NOT in the EU. (Its an NA based company)
So the way we could do it, with PHP, would be to check the IP ...
- 121
7
votes
2
answers
1k
views
Do I still need to check if users are inside of EEA/UK for GDPR consent if my Android app is ONLY released in countries outside of EEA/UK?
Example:
A US user downloads the Android app from the US Google Play Store
The user does not view any consent form and begins using the app and viewing ads
The user then travels to EEA/UK and ...
- 75
4
votes
1
answer
577
views
Should registered users accept cookie consent in GDPR?
I want to use cookie consent for saving user language, currency and affiliate marketing purpose.
Can I store data without consent of the registered users? They are registered so do I need to take ...
- 43
1
vote
1
answer
50
views
Responsibilities and GDPR reporting in case of hacked email marketing platforms
Company A allows subscription to its newlsletter via email, and their email list and newsletter is taken care of by company X. So A is hosting the page where one can subscribe, X handles list and list ...
- 1,392
4
votes
2
answers
144
views
Is it legal to process PII in EU of customers which are not in EU?
So I have an app that processes the PII of users and their interests, the app is south Asia based. The app doesn't support EU customers and is geo-blocked by default.
I would like to process and store ...
- 41
1
vote
1
answer
120
views
How long can a company take to answer my GDPR request to download my data?
In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be ...
- 13
1
vote
1
answer
73
views
Is email verification required before asking users to enter personal details? GDPR-related
Is email verification step required before asking users to enter personal details?
A bit lost in GDPR documents.
Should contract between user and the app be signed (via phone number + sms or email + ...
1
vote
0
answers
43
views
Data representatives in EU, UK, Switzerland - are there more countries requiring this?
The EU's GDPR requires a data representative (person or company with an address) located in the EU for everyone outside of the EU who deals with personal data of people in the EU. Practically, a non-...
- 1,392
4
votes
1
answer
160
views
Are there privacy laws other than GDPR which consider IP addresses as personal data?
In EU's GDPR the IP address is considered personal data (lots of discussions about it, but this seems to be the correct interpretation at the moment). Several countries have now privacy laws which are ...
- 1,392
2
votes
1
answer
109
views
Is the Vilnius-Lublin portal a violation of GDPR?
Don’t get me wrong, I love it!
But is it GDPR compliant given that people walk up to a camera that will broadcast their image outside of their country?
See also this news story and this one
- 3,869
0
votes
1
answer
115
views
The Data ownership for an automated server running for years prior to GDPR Regulations
Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various ...
- 105
2
votes
2
answers
231
views
The scope of GDPR and the right to be forgotten
I have three doubts about GDPR compliance in modern systems, specifically about the "Right to be forgotten" section in the GDPR.
What I would really like to understand is whether the right ...
- 123
0
votes
1
answer
88
views
Can a pre-ticked checkbox be used to RECALL/REVOKE consent under GDPR and/or ePrivacy/cookie law?
I wonder, can a pre-ticked checkbox be used to recall/revoke consent, or does revoking/recalling consent need to be a separate, explicit action?
I have made a specific consent function like this:
When ...
8
votes
2
answers
2k
views
Does The "Right To Be Forgotten" Include Sent Emails?
Say that you maintain an email service, and person A, sends an email to person B who is also on your email service. If person A deletes their account would that mean that person B no longer can view ...
- 81
0
votes
1
answer
173
views
Is there any chance of getting a penalty for cookies with no notification for a private person with small site?
I am planning a small demo application using DRF and when using the DRF web interface csrftoken cookies are saved by default. After reading tons of material about GDPR and cookies I completely disable ...
- 33
2
votes
1
answer
712
views
Impact of GDPR on remote work outside of the EU (as LLC)?
I do remote work for clients in the EU. The legal foundation is a B2B contract between two EU legal entities, one of which is the client's limited company, the other my limited company. Since both ...
- 23
1
vote
1
answer
300
views
GDPR - Are the typical lists of examples for personal data misleading?
Article 4 of the EU GDPR states
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);
The explanation for the term ‘personal data’ as
...
- 113
1
vote
1
answer
136
views
Identifying attackers and GDPR. In which cases is it legal?
Various techniques can be used to identify stalkers, malicious hackers et al. that are either gathering data for their target or use the target's digital items without consent.
Canary files
They are '...
- 13
6
votes
1
answer
973
views
Talent consent withdrawal in film in Europe
Consider the following scenario of right to erasure in film-making in Europe. Person A makes amateur live-action films, for example theater performances. Person B is in one of those performances and ...
- 279
1
vote
1
answer
60
views
What laws should I be aware of if I were to start a business scraping profile content from a website and using this content to build another website? [closed]
The idea is to build websites for people (in the UK (at least to start with)) using content that they have uploaded to another website. I will cold-call them, ask them if they would like a website and ...
- 19
0
votes
1
answer
91
views
Legal obligations of a company in case of GDPR-related vulnerability
First of all I would like to state that my question occurs in a context of EU laws and EU citizen.
I found a vulnerability in a product distributed in a few companies of EU countries. This ...
- 150
1
vote
2
answers
152
views
Privacy and GDPR on Facebook
I have a doubt regarding the privacy on Facebook and the law application.
Also lawyers That I have spoken with, seem not very sure about the matter.
In particular I would like to know if it is my ...
- 11
4
votes
2
answers
853
views
If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?
I used to work for a company, where they have a team of moderators, who actively monitor which accounts are scammers etc. To monitor this they can find links between user accounts via a users password,...
- 43
2
votes
1
answer
54
views
What are the limits of service provision/PII consent for compliance with GDPR?
Most of the internet business model can be described as providing data in exchange for seeing adverts. These adverts are worth a lot more if they can be targeted. The GDPR applies to this, such that ...
- 867
1
vote
1
answer
75
views
Is it GDPR compliant to hide a competition entry behind a requirement to sign up to a newsletter
I'm looking to run a giveaway competition on my website. The main aim of the competition is to get signups to our email newsletter. I'm therefore proposing that 1. a user signs up to my newsletter (...
- 11
1
vote
3
answers
256
views
GDPR Disclaimer On Cold Call Emails
I live in the United States. I am helping someone who just started an online store selling tee shirts. In my research to come up with a plan regarding cold call email marketing, I came across GDPR. ...
10
votes
1
answer
739
views
What actions to take when a Data Processor doesn't respect GDPR?
We've recently exchanged emails with one of our Data Processors, because they don't grant the ability to permanently delete hosted documents (pdf, png, etc.) on their platform. Such documents might ...
- 201
5
votes
1
answer
435
views
Do I need to offer a data processing agreement
I recently created a browser extension that allows you to pretty-format a web page and save it in various formats (Word, PDF, etc). I have made it publicly accessible through the browser extension ...
- 153
0
votes
1
answer
50
views
Can you request response to SAR by web form?
When one makes a GDPR Subject Access Request (SAR), one can specify a particular form of response, for example by email. Also the data can be requested in a structured, commonly used and machine-...
- 867
1
vote
1
answer
82
views
Does the Data Protection Act 2018 in UK require users of a website to explicitly
Now that Brexit has happened, GDPR no longer takes effect in UK.
However, the Data Protection Act 2018 will continue to apply.
With GDPR's Article 6, a website is required to request explicit consent ...
- 993
5
votes
1
answer
314
views
GDPR unbelievable legitimate interest. What action to take?
If a website is claiming legitimate interest in data collection in a way that is unbelievable is there any action that a web site visitor can take?
For example, if one was to visit The Daily Mail you ...
- 867
4
votes
2
answers
263
views
Creative commons attribution and GDPR
When using content released under an open licence such as creative commons, it might be required to provide attribution to the author.
For instance, if I were to use this image from Wikimedia Commons ...
- 43
1
vote
1
answer
96
views
How far up the chain of internet provision does my GDPR responsibility go?
Say I host a web page on my computer, and you visit that site from somewhere in Europe. The web server on my computer will know your IP address, and I can choose to "forget" it as soon as ...
- 867
1
vote
1
answer
182
views
Is client-side encrypted data really personal data
Scenario: My service that is storing customer files is hosted on my own personal physical server, “on-prem”. It is then using one of the popular cloud storage services (Azure blob storage, AWS S3) to ...
- 11
1
vote
1
answer
56
views
Can I sell the GDPR data I requested?
If I request to download my personal data under GDPR, from sites like Google or Facebook, is it legal for me to sell that data?
- 11
0
votes
3
answers
94
views
GDPR, personal and political activity
The GDPR does not apply to the processing of personal data that is "by a natural person in the course of a purely personal or household activity". I cannot find a description of "...
- 867
1
vote
1
answer
113
views
Data deleted prior to GDPR access request
A company recieves a request to access personal data. They realize that they got the request two weeks after data collection; by this time all data is deleted. What would a company reply if such ...
2
votes
1
answer
100
views
GDPR and Telecom law broken, mobile network operator refuses to disclose user of a phone number
I got today a very unnerving phone call. It was a telemarketing, but unlike any other I had before, this was automated system and it suggested it knew much more about me than my number. I'm talking ...
- 161
4
votes
2
answers
2k
views
Repercussions of defying the Cookie Law
I was wondering what case law is out there on the subject, or, if there is not much, what real repercussions can website owners who defy the Cookie Law expect?
Say Bob is not only pissed off by the ...
- 23.3k
1
vote
2
answers
89
views
The UK GDPA article 17 right to erasure. Can I retain the person's ID number if it no longer identifies them?
I manage a small relational database for members of a club with about 600 members. The 'member' table has records holding the memberID , their name, address phone etc. The memberID is then used as a ...
- 113
-1
votes
1
answer
67
views
Who is data controller for automatic communications under GDPR? [closed]
This is how automatic communications infastructure works :
an automatic communications creator registers with an automatic communications service . Users registered with this automatic communication ...
