Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
5
votes
1answer
826 views

GDPR Compliance: Do all Cookies require Opt-In?

Given a Web Site which uses cookies for the following: User Preferences Bookmarked Articles Cookie Preferences what explicit permissions would be required from the user? Here I anticipate the ...
5
votes
5answers
364 views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
5
votes
1answer
105 views

Company makes confidential CV publicly available and searchable. Legal recourse?

A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
5
votes
1answer
49 views

The circumvention of terms and conditions

There are sites, for example 'moodys.com', which require an explicit agreement to the terms and conditions on every vist (e.g. https://www.moodys.com/research/Moodys-affirms-Chang-Hwa-Commercial-Banks-...
5
votes
2answers
257 views

GDPR with refusing medical information

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing ...
5
votes
3answers
730 views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
5
votes
1answer
400 views

Establishing GDPR consent when the person doesn't access a system themself

My company hosts an online database for organisations to manage training data for their people. In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. ...
5
votes
1answer
104 views

Does GDPR affect individual contributor license agreements for opensource projects?

I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example Apache 2.0. The gathered information when ...
5
votes
2answers
599 views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
5
votes
1answer
256 views

Contract necessary for the most basic processing under GPDR?

I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or ...
5
votes
1answer
97 views

How to fulfill the General Data Protection Regulation (GDPR) when citing

I have a question about the European General Data Protection Regulation. According to Article 13, one has to inform anyone whose personal data is collected: Where personal data relating to a ...
5
votes
2answers
189 views

Excluding all people from the EU from my blog - is this allowed?

There's a new law from the European Union I simply cannot comply with (GDPR). Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my ...
5
votes
1answer
96 views

Do marketing emails require consent?

I am getting spammed with marketing emails from Tough Mudder. Their unsubscribe link takes me to a page where I have to either accept the fact they will send me emails or unsubscribe from everything, ...
4
votes
2answers
228 views

Are Blizzard breaking GDPR by charging people for changing their usernames?

I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago. I now want to change it again because searching it on Google ...
4
votes
2answers
2k views

Does any host provider currently comply with GDPR?

According to Rec.81; Art.28(1)-(3) of the GDPR regulation, "The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding ...
4
votes
2answers
545 views

Will GDPR (EU law) make bad practices in security illegal?

The way I understand it, the purpose of GDPR (General Data Protection Regulation, EU law) is to make sure that personal data is treated transparently and securely. So half of it is about giving the ...
4
votes
2answers
137 views

“no logs” website in eu - is it illegal?

As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
4
votes
2answers
391 views

Does GDPR apply to internal employees data?

Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has ...
4
votes
2answers
152 views

Do I have to provide proof of citizenship - GDPR

Recently, I've been going through some old accounts of mine (on online websites) and I started deleting them. Thanks to GDPR, this is now much easier. Most companies' customer services have no ...
4
votes
1answer
588 views

Are hobby projects exempt from GDPR?

Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database. GDPR ...
4
votes
1answer
104 views

Under GDPR can I avoid divulging a customer's data to the government?

Scenario: A business has a legal requirement to obtain a license from a government agency relating to its business activities. The business activities have already being undertaken and there is no ...
4
votes
2answers
3k views

Do the GDPR and Cookie-Law regulations apply to localStorage?

We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is ...
4
votes
1answer
67 views

Can online business in one country deny access via terms of service to entities in another country?

Can an American company state in their terms of service that if an entity is from a designated country they are not allowed to use the service? In other words would that be a legal and enforceable ...
4
votes
1answer
119 views

Can a data controller change their privacy policy without explicit consent?

While I read one of the updated privacy policies (PP) this week, the following section of a privacy policy seemed… off: We may change this Privacy Policy from time to time, and all changes will be ...
4
votes
1answer
1k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
4
votes
1answer
85 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
4
votes
1answer
96 views

Requesting to see holiday rota and GDPR

my partner has asked if she can see the holiday rota and was told she couldn't because of GDPR. Is that correct? I know anything that identifies you needs to be secure but the rota of when people are ...
4
votes
1answer
65 views

Should all gdpr related documents be translated to all official EU languages?

I wrote application localized in Ukrainian language , which is not one of the official European Union languages. Since I reside in the EU territory I need to comply with gdpr. This application is ...
4
votes
1answer
975 views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
4
votes
2answers
518 views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
4
votes
1answer
195 views

GDPR email consent - Pre ticked “No” box

We are currently creating an email to gain consent from our customers to email allow us to market to them. We are currently using Mailchimp to put the email together and it is currently not allowing ...
4
votes
2answers
89 views

Opting out of cookies by emailing a company

Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than ...
4
votes
4answers
170 views

Is a Blood sample considered Personal Data under GDPR?

Just that simple question: Is a Blood sample considered Personal Data under GDPR?
4
votes
1answer
694 views

Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?

I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
4
votes
1answer
155 views

Specificity of GDPR's right of erasure

Article 17 of the GDPR states that: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her [...] where one of the following ...
4
votes
2answers
262 views

Is “By clicking Continue you accept T&C” an unambiguous consent in context of GDPR

I just read about explicit/unambiguous consent in context of GDPR. And I just saw in some mobile app a payment form where you enter some data and to pay you click a "Continue" button. Just next to ...
4
votes
1answer
166 views

Would a business that has no office in EU still have to worry about GDPR, and if so, why?

This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR. Although opportunistic lawsuits against US-based businesses on their ...
4
votes
2answers
1k views

GDPR Compliance - does it extend to database backups and archived records?

How do the rules for GDPR affect database backups or archived data?As a company, you might have backups/archived data going back years. Based on the rules, when an individual invokes "forget me", it ...
4
votes
1answer
494 views

GDPR impact on genealogy website / uncontrolled user data

The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is ...
4
votes
1answer
236 views

Do employees have personal liability when working for a company that violates the GDPR?

I work for a company that doesn't take privacy laws very seriously. As far as I can tell, they're woefully unprepared for GDPR and don't seem to care very much. My tasks mainly consist of software ...
4
votes
1answer
84 views

Responding to GDPR Article 15 requests if all data is already accessible via website

So, Article 15 of the GDPR gives the user the right to access all the personal data concerning him or her. Assume we have a website with user accounts. We store some information that is regarded as ...
4
votes
1answer
158 views

With GDPR, can you request 'real life data' be deleted/forgotten?

For example, can you request libraries remove your name from books you have checked out?
4
votes
1answer
170 views

GDPR Right to erasure vs mailing list archive?

Consider a mailing list like mailman or listserv. The archives of these mailing lists, due to quoting, will contain names and email addresses. Now, the GDP Article 17, unless I am mistaken obliges ...
4
votes
1answer
116 views

Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?

How does GDPR apply to companies getting someone else's personal data from a legitimate source? For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a ...
4
votes
1answer
128 views

GDPR for small interest associations

What exactly does a small common interest club with 100 members need to do to comply with GDPR requirements?
4
votes
1answer
101 views

Can I count unique users without a cookie warning?

Is there a way to count (approximate) unique users on a website without having to display that silly cookie warning? The usual way to track unique users is to set a cookie. An alternative (less ...
4
votes
1answer
302 views

GDPR vs. Credit Card Chargebacks

I work for a company where we take credit card payments for the services we provide. As per the Card Scheme rules, the cardholder can request a charge-back up to (in the case of Visa) 13 months after ...
4
votes
1answer
54 views

Would revealing/storing whether or not an EU customer uses a service violate the GDPR?

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
4
votes
1answer
74 views

Does possesing BUT NOT processing a personal data make the organization their controller?

According to Article 4(7) of GDPR: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
4
votes
1answer
358 views

Can I file a GDPR “request to be forgotten” on behalf of someone else?

Assuming a person might be interested in requesting to be forgotten by a large number of sites that store personal or behavioral data, sending individual requests to hundreds (or thousands) of sites ...