Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
3
votes
2answers
3k views

How to handle CVs / resumes with GDPR rules?

As a consultant my resume is personal information which is handed out to prospective clients frequently. How personal should it be? Should some data be anonymized? Should the resume be returned from ...
6
votes
2answers
1k views

Does vehicle information count as personal data?

Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation? How about the VIN? (Vehicle Identification Number)
2
votes
1answer
177 views

GDPR seeking consent - Subjects not responding to the consent email

We have currently sent out emails to gain consent from subjects to receive our marketing content. For subjects who don't respond, can we send another email chasing the consent? (i feel doing this can ...
4
votes
1answer
507 views

GDPR impact on genealogy website / uncontrolled user data

The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is ...
4
votes
1answer
196 views

GDPR email consent - Pre ticked “No” box

We are currently creating an email to gain consent from our customers to email allow us to market to them. We are currently using Mailchimp to put the email together and it is currently not allowing ...
5
votes
2answers
258 views

GDPR with refusing medical information

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing ...
6
votes
1answer
2k views

Are chat logs against the new european GDPR?

Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation? I know you can't save data which can be linked to a natural person ...
6
votes
1answer
255 views

What did Flybe actually do wrong?

Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc. They sent an email to this ...
8
votes
1answer
234 views

If I’ve no WhatsApp account am I still a node on their social graph? And if so can I request to be deleted?

I have never used WhatsApp so I have never shared my phone’s contacts with them or consented to their terms. Many of my friends and family do use WhatsApp and they will all have me in thier contacts ...
2
votes
1answer
3k views

Under the GDPR, should transaction data be deleted on account deletion or on user request?

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted? Or if the user can buy ...
6
votes
3answers
582 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
4
votes
1answer
239 views

Do employees have personal liability when working for a company that violates the GDPR?

I work for a company that doesn't take privacy laws very seriously. As far as I can tell, they're woefully unprepared for GDPR and don't seem to care very much. My tasks mainly consist of software ...
3
votes
2answers
119 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
2
votes
1answer
95 views

Advice sought regarding GDPR and managing sensitive data

We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server. There are files that are ...
3
votes
1answer
270 views

What does 'Right to Erasure' actually cover?

According to GDPR, any person has 'Right to Erasure (Recital)' and have his/hers sensitive information deleted. Does that mean that an organization can keep all non-sensitive data for a user? For an ...
1
vote
0answers
496 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
6
votes
1answer
493 views

Does GDPR Recital 15 exempt unstructured electronic data?

GDPR Recital 15 states that Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation. I ...
2
votes
2answers
133 views

Does the EU GDPR apply to these types of natural persons?

Does the GDPR apply to a website operator who is a natural person (not a company or non-profit) and uses the website directly for commercial activity uses the website to advertise his/her other ...
4
votes
1answer
128 views

GDPR for small interest associations

What exactly does a small common interest club with 100 members need to do to comply with GDPR requirements?
5
votes
1answer
257 views

Contract necessary for the most basic processing under GPDR?

I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or ...
2
votes
1answer
51 views

GDPR: Applied Security vs Employee Contracts

An Organisation has 10,000 employees. All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation. Only 200 employees require access to the PII data for the ...
0
votes
2answers
110 views

GDPR - Confirm company terms and conditions by button click

This May the General Data Protection Regulation (GDPR) will be applied across the EU. I read somewhere that users have to always 'opt-in' after this law is effective. Since I'm concerned about ...
5
votes
1answer
400 views

Establishing GDPR consent when the person doesn't access a system themself

My company hosts an online database for organisations to manage training data for their people. In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. ...
4
votes
1answer
1k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
0
votes
1answer
229 views

Is an incentivized consent considered freely given in GDPR?

Let's say someone offers you 50 bucks if you opt-in to a consent; would that consent be still considered freely given in the eyes of GDPR (General Data Protection Regulation)? My understanding is ...
33
votes
2answers
5k views

GDPR + git history

Is name, surname and email in the Git commit history a personal information according to the coming GDPR (General Data Protection Regulation) and is there any special treatment required? Git is a ...
4
votes
1answer
102 views

Can I count unique users without a cookie warning?

Is there a way to count (approximate) unique users on a website without having to display that silly cookie warning? The usual way to track unique users is to set a cookie. An alternative (less ...
4
votes
1answer
308 views

GDPR vs. Credit Card Chargebacks

I work for a company where we take credit card payments for the services we provide. As per the Card Scheme rules, the cardholder can request a charge-back up to (in the case of Visa) 13 months after ...
5
votes
2answers
608 views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
3
votes
1answer
605 views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
3
votes
2answers
424 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
1
vote
0answers
70 views

Are data processors allowed to locally store live customer information for testing GDPR

We develop software for another company and use their live data to test our applications locally before they go live. This means we keep live customer information on office computers. Will this be ...
3
votes
3answers
1k views

GDPR: Citizens with Dual Nationality?

Do the GDPR Regulations apply to processing data of a citizen who has dual nationality?
3
votes
1answer
87 views

According to GDPR Article 30, do I maintain a continuous record or just a one-off?

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification. See: https://www.privacy-regulation.eu/en/30.htm It states that a data controller ...shall maintain a record of ...
1
vote
1answer
394 views

GDPR - Offshoring

We work for consulting company in India, call it Z. Z has a partnership with a European cards & transactions processing company Y. So the Indian consulting company Z does offshore production ...
3
votes
1answer
818 views

To comply with GDPR, do I need passwords hashed?

I currently have a website that will be going live soon. The passwords are hashed. Is that all I need to do to comply with General Data Protection Regulation's encryption article? Please cite and ...
1
vote
2answers
2k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
1
vote
3answers
10k views

Will the GDPR apply to small hobby clubs?

When it comes into force, how will the General Data Protection Regulation affect small hobbyist organisations? Will it apply to, for example, student societies that are holding lists of email ...
4
votes
2answers
2k views

Does any host provider currently comply with GDPR?

According to Rec.81; Art.28(1)-(3) of the GDPR regulation, "The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding ...
2
votes
2answers
201 views

Can I force a website/service to delete my private data

I would like to wipe my online data clean and make sure the people deleted my account. Considering that most services only offer to "close" or "suspend" the account and not delete the data like skype ...