Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
919
questions
9
votes
2
answers
2k
views
GDPR & EPR regards maintaining email blacklist
Note a user call YIVI had previously stated that you could store a hash of the users email address to avoid the requirements of General Data Protection Regulation (GDRP) and ePrivacy Directive (EPD). ...
user32690
9
votes
1
answer
3k
views
Can a non-profit organization record attendance by name without permission?
I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
- 211
9
votes
3
answers
1k
views
Under GDPR, can I request to be forgotten and re-register for a trial?
Imagine an on-line service which offers 1 month of free trial for new users. Can I perpetually:
register for the trial, use it for a month
request my account deleted and my data forgotten
repeat
?
- 203
9
votes
1
answer
2k
views
Does GDPR cover the collection of data by websites that crawl the web and resell user data
I have found that a lot of my personal info is now available on a bunch of websites that collect data and resell it.
I'm talking about those 'find anything about anyone' websites.
A lot of the data ...
- 473
9
votes
1
answer
751
views
Is Facebook's new cookie banner GDPR compliant?
Today I visited Facebook from a Google search to find the following cookie banner at the top of the page:
To personalize content, tailor and measure ads, and provide a safer experience, we use ...
- 93
9
votes
3
answers
813
views
GDPR - Withdrawn user consent
I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent.
The user gives his consent to use his data and ...
- 193
9
votes
1
answer
693
views
Does gdpr.eu violate GDPR compliancy?
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
- 191
9
votes
2
answers
2k
views
Is it really possible to use Google Analytics without consent, and if so, why exactly?
I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
- 1,818
9
votes
2
answers
816
views
Are GDPR-Walls legal?
Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information.
I see two possible legal problems:
GDPR forbids coupling of ...
- 190
9
votes
2
answers
3k
views
GDPR. Where to store users consent?
A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
- 113
9
votes
1
answer
151
views
Can I provide multiple legal bases for GDPR purposes?
I used Termly's privacy policy generator, and in the policy that they generated there are four Article
6 legal bases:
Consent
Legitimate Interests
Legal Obligations
Vital Interests
I took a ...
- 399
9
votes
2
answers
6k
views
GDPR Compliance - does it extend to database backups and archived records?
How do the rules for GDPR affect database backups or archived data?As a company, you might have backups/archived data going back years. Based on the rules, when an individual invokes "forget me", it ...
- 193
9
votes
1
answer
763
views
GDPR and deleting users from wiki changelogs
According to the GDPR §17, users have a right to request the deletion of personal data. I am wondering how this applies to wikis.
In my case, when users edit a page, that edit is associated with ...
- 193
9
votes
1
answer
286
views
As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?
The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
- 3,833
9
votes
1
answer
960
views
Legal aspects of Firebase Crashlytics SDK
Let's say we have a mobile app, where every user is associated with app-generated unique user id (ex. 57d2ef8b391277001aad7784).
Having the uuid itself that's not possible to identify a user.
...
- 191
8
votes
3
answers
3k
views
On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?
I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in ...
- 183
8
votes
2
answers
2k
views
Does The "Right To Be Forgotten" Include Sent Emails?
Say that you maintain an email service, and person A, sends an email to person B who is also on your email service. If person A deletes their account would that mean that person B no longer can view ...
- 81
8
votes
2
answers
2k
views
Are there ways of storing personal data beyond standard GDPR limitations?
So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data.
...
- 281
8
votes
1
answer
3k
views
Is storing records of chess games a violation of GDPR?
Many amateur chess players store the notations of their games in electronic format (like pgn) so that they can later reference the game for analytical and historical reasons. Information in this file ...
- 193
8
votes
1
answer
3k
views
GDPR Compliance: Do all Cookies require Opt-In?
Given a Web Site which uses cookies for the following:
User Preferences
Bookmarked Articles
Cookie Preferences
what explicit permissions would be required from the user?
Here I anticipate the ...
- 213
8
votes
2
answers
8k
views
Does vehicle information count as personal data?
Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation?
How about the VIN? (Vehicle Identification Number)
- 183
8
votes
2
answers
362
views
Does GDPR Prohibit Reading Unsolicited Emails?
I originally asked this question on Information Security and it was suggested it was a better fit over here.
I'm a member of the management committee of an allotment society in the UK. The committee ...
- 233
8
votes
1
answer
1k
views
Is throw-away-the-key-encryption allowed under GDPR?
Article 15 of the GDPR says:
The data subject shall have the right to obtain [...] personal data [if it is being "processed"]
Article 4 says that "processing" includes storage.
Therefore, all ...
- 183
8
votes
2
answers
3k
views
Are internet forum posts considered personal data under GDPR?
GDPR defines "personal data" as any information relating to an identified or identifiable natural person.
‘personal data’ means any information relating to an identified or identifiable natural ...
- 1,818
8
votes
1
answer
424
views
If I’ve no WhatsApp account am I still a node on their social graph? And if so can I request to be deleted?
I have never used WhatsApp so I have never shared my phone’s contacts with them or consented to their terms. Many of my friends and family do use WhatsApp and they will all have me in thier contacts ...
- 83
8
votes
1
answer
626
views
Under GDPR right of access, do I have the right to receive a copy of scoring sheets / evaluation forms after a structured job interview?
Under the GDPR right of access, what rights do I have to employer assessment of myself in the role of a job applicant after a structured job interview? Presumably, in a structured job interview ...
- 1,379
7
votes
2
answers
1k
views
Are push tokens considered PII under the GDPR or the CCPA?
I'm building a server for an app and I'm trying to get my privacy protections right.
The app allows users to opt in to push notifications. If the user opts in, then I save a push notification token ...
- 173
7
votes
2
answers
1k
views
Do family pictures and videos in public places fall under GDPR?
The Czech Data Protection Authority fined Mr. Rynes for filming
members of the public without their consent. Mr. Rynes appealed,
arguing that he was covered by the personal and household ...
user31127
7
votes
3
answers
274
views
Is it illegal to intentionally design a social network that can't comply with right-to-be-forgotten (and possibly other laws)?
If I intentionally design (and program) a social network that uses a technology (blockchain,...) which does not allow for alteration / erasing of user data, what happens in case of a right-to-be-...
- 171
7
votes
2
answers
580
views
Is a sent email in someone else’s inbox subject to data subject rights of the sender?
Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
- 5,848
7
votes
2
answers
1k
views
Do I still need to check if users are inside of EEA/UK for GDPR consent if my Android app is ONLY released in countries outside of EEA/UK?
Example:
A US user downloads the Android app from the US Google Play Store
The user does not view any consent form and begins using the app and viewing ads
The user then travels to EEA/UK and ...
- 75
7
votes
4
answers
4k
views
GDPR: are faces always considered identifiable information?
Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
- 125
7
votes
2
answers
1k
views
Would a business that has no office in EU still have to worry about GDPR, and if so, why?
This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR.
Although opportunistic lawsuits against US-based businesses on their ...
- 235
7
votes
1
answer
2k
views
Deducing and using an email address under GDPR
I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this.
The work email ...
7
votes
4
answers
1k
views
Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?
The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data:
by a natural person in the course of a ...
- 3,172
7
votes
3
answers
2k
views
Are publicly available password dumps legal under GDPR
When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or ...
- 81
7
votes
1
answer
627
views
GDPR - am I a data controller as an app owner if I do not have access to the data?
Let's assume that I created a mobile app for iPhone that is tracking rides on a bike so that means the app is collecting GPS coordinates of the phone and later this mobile app shows some statistics ...
- 189
7
votes
2
answers
1k
views
GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?
The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
- 171
7
votes
1
answer
233
views
GDPR and personal data that gets crawled and ends up on other websites
Data controllers must delete the users' personal data if they are asked to do so, according to the GDPR, except in some cases that don't really apply here. But what if that personal data has ended up ...
- 1,818
7
votes
1
answer
4k
views
Are chat logs against the new european GDPR?
Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation?
I know you can't save data which can be linked to a natural person ...
- 173
7
votes
1
answer
185
views
Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?
I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation.
Anyway, if I ...
- 171
7
votes
1
answer
154
views
Is it sufficient to provide a privacy policy only in english language?
Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language?
Is a translation necessary for every country of the EU ...
- 173
6
votes
3
answers
2k
views
GDPR: Do I have to IP log "every" login for a customer?
IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. ...
- 63
6
votes
2
answers
3k
views
Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user's jurisdiction?
Can one add a clause stating
Do not use this application if the terms demanded cannot be provided by law
For example, let's say one term of use states that information collected may be retained ...
6
votes
2
answers
2k
views
Emailing a publicly available address posted by the same person
I understand that emailing a person without consent is illegal under GDPR.
But is it okay to email someone if the person has made the mail address public? For example if a university professor posted ...
- 61
6
votes
1
answer
901
views
Applicability of Data Protection Laws When Talking to a Lawyer
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission.
Can I tell such details legally to my lawyer when referring to ...
- 71
6
votes
1
answer
2k
views
Californian resident travelling in EU - which privacy law applies?
If a Californian resident is travelling within the EU, it seems both European GDPR and Californian CCPA privacy laws will apply.
Sometimes businesses have single privacy emails, so if a deleting ...
6
votes
3
answers
2k
views
What counts as personal data under GDPR?
As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679).
There is a ...
- 163
6
votes
1
answer
978
views
Talent consent withdrawal in film in Europe
Consider the following scenario of right to erasure in film-making in Europe. Person A makes amateur live-action films, for example theater performances. Person B is in one of those performances and ...
- 279
6
votes
1
answer
2k
views
Is it okay to store user locations?
I know it might sound quite bad. But here I explain the whole situation.
I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
- 163