Skip to main content

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
10 votes
2 answers
3k views

Can a company actually become GDPR compliant? Is there such a thing?

(This question could be expanded to other auditing procedures too) How do huge multinational companies that want to become GDPR compliant start off this? I mean, I guess one has to read the regulation,...
4d4143's user avatar
  • 103
10 votes
5 answers
4k views

Is scraping an iCal link legal?

TL;DR: my university says my app is illegal Since our university doesn't have a mobile app to check our schedules, I created one that does the following: Opens an embedded web browser (in app) and ...
Tom Vk's user avatar
  • 117
10 votes
2 answers
3k views

Can I store the names of arbitrary business associates in my CRM system?

I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships. For example, "Gina works on reception." Is this allowed ...
Jordan Regan's user avatar
10 votes
2 answers
2k views

GDPR - Are technical identifiers personal data?

I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
kol's user avatar
  • 203
10 votes
1 answer
2k views

GDPR Compliance - notification of data breach

In Art. 33, the GDPR specifies that a controller must notify a personal data breach to the supervisory authority after having become aware of it. Case 1: A database dump with personal data is hosted ...
Simon's user avatar
  • 201
10 votes
1 answer
833 views

What actions to take when a Data Processor doesn't respect GDPR?

We've recently exchanged emails with one of our Data Processors, because they don't grant the ability to permanently delete hosted documents (pdf, png, etc.) on their platform. Such documents might ...
Vadorequest's user avatar
10 votes
1 answer
450 views

As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?

The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this ...
JonathanReez's user avatar
  • 4,563
9 votes
6 answers
4k views

GDPR and right to provide meter readings

My energy company have estimated the opening meter readings for my move in date for a property. I have the correct readings in photos taken on that date, but the energy company won't allow me to ...
F Chopin's user avatar
  • 305
9 votes
1 answer
4k views

GDPR, online shopping and phone numbers for shipping - Is it legal?

Many webshops expect the phone number to be entered for shipping. My understanding of the GDPR is that you are not even allowed to ask information which is not absolutely needed for the given task. ...
armset's user avatar
  • 101
9 votes
2 answers
2k views

GDPR & EPR regards maintaining email blacklist

Note a user call YIVI had previously stated that you could store a hash of the users email address to avoid the requirements of General Data Protection Regulation (GDRP) and ePrivacy Directive (EPD). ...
user avatar
9 votes
3 answers
1k views

Under GDPR, can I request to be forgotten and re-register for a trial?

Imagine an on-line service which offers 1 month of free trial for new users. Can I perpetually: register for the trial, use it for a month request my account deleted and my data forgotten repeat ?
Grzegorz Oledzki's user avatar
9 votes
1 answer
2k views

Does GDPR cover the collection of data by websites that crawl the web and resell user data

I have found that a lot of my personal info is now available on a bunch of websites that collect data and resell it. I'm talking about those 'find anything about anyone' websites. A lot of the data ...
Thomas's user avatar
  • 523
9 votes
1 answer
783 views

Is Facebook's new cookie banner GDPR compliant?

Today I visited Facebook from a Google search to find the following cookie banner at the top of the page: To personalize content, tailor and measure ads, and provide a safer experience, we use ...
LeoTietz's user avatar
9 votes
3 answers
852 views

GDPR - Withdrawn user consent

I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent. The user gives his consent to use his data and ...
jvecsei's user avatar
  • 193
9 votes
2 answers
867 views

Are GDPR-Walls legal?

Quite a few websites started showing european visitors "You cannot use this site because of GDPR", probably based on GeoIP information. I see two possible legal problems: GDPR forbids coupling of ...
allo's user avatar
  • 220
9 votes
2 answers
4k views

Are internet forum posts considered personal data under GDPR?

GDPR defines "personal data" as any information relating to an identified or identifiable natural person. ‘personal data’ means any information relating to an identified or identifiable natural ...
reed's user avatar
  • 1,838
9 votes
2 answers
6k views

GDPR Compliance - does it extend to database backups and archived records?

How do the rules for GDPR affect database backups or archived data?As a company, you might have backups/archived data going back years. Based on the rules, when an individual invokes "forget me", it ...
sharadov's user avatar
  • 193
9 votes
1 answer
901 views

GDPR and deleting users from wiki changelogs

According to the GDPR §17, users have a right to request the deletion of personal data. I am wondering how this applies to wikis. In my case, when users edit a page, that edit is associated with ...
Andreas Gohr's user avatar
9 votes
1 answer
1k views

Legal aspects of Firebase Crashlytics SDK

Let's say we have a mobile app, where every user is associated with app-generated unique user id (ex. 57d2ef8b391277001aad7784). Having the uuid itself that's not possible to identify a user. ...
AlexKorovyansky's user avatar
8 votes
2 answers
2k views

Are there ways of storing personal data beyond standard GDPR limitations?

So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data. ...
MrVocabulary's user avatar
8 votes
1 answer
3k views

Does GDPR apply when PII is already publicly available?

Pretend there is a website, it might be free to access, or be a paid per search service, where the users get access to summarised information on the people that they search for. All of the information ...
user5623335's user avatar
  • 1,180
8 votes
1 answer
3k views

Can a non-profit organization record attendance by name without permission?

I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
Tripartio's user avatar
  • 201
8 votes
1 answer
4k views

Is storing records of chess games a violation of GDPR?

Many amateur chess players store the notations of their games in electronic format (like pgn) so that they can later reference the game for analytical and historical reasons. Information in this file ...
firtydank's user avatar
  • 213
8 votes
1 answer
3k views

GDPR Compliance: Do all Cookies require Opt-In?

Given a Web Site which uses cookies for the following: User Preferences Bookmarked Articles Cookie Preferences what explicit permissions would be required from the user? Here I anticipate the ...
Manngo's user avatar
  • 213
8 votes
2 answers
8k views

Does vehicle information count as personal data?

Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation? How about the VIN? (Vehicle Identification Number)
Carl Winbäck's user avatar
8 votes
2 answers
3k views

Is it really possible to use Google Analytics without consent, and if so, why exactly?

I'm asking about the GDPR and the European Union. Lots of websites claim that it is possible to use Google Analytics without asking for the user's consent. Even some answers here suggest that it is ...
reed's user avatar
  • 1,838
8 votes
2 answers
1k views

Would a business that has no office in EU still have to worry about GDPR, and if so, why?

This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR. Although opportunistic lawsuits against US-based businesses on their ...
Dee's user avatar
  • 245
8 votes
1 answer
737 views

Does gdpr.eu violate GDPR compliancy?

As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
panda-byte's user avatar
8 votes
1 answer
425 views

Is it GDPR-compliant to require *public* publishing of personal info as condition for access to a service?

Background: For roughly 2 decades I've run my own private email infrastructure for myself, open source projects, and a few other individuals over business internet service intended for such usage. I'...
R.. GitHub STOP HELPING ICE's user avatar
8 votes
1 answer
7k views

GDPR: cookie for login management

I use cookie in my site for login management. I user logs in the cookie dies with the session, if user flags "Keep me logged in" when logging in a long time cookie persists. In the long time cookie I ...
Golber's user avatar
  • 93
8 votes
1 answer
2k views

Deducing and using an email address under GDPR

I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this. The work email ...
George Harris's user avatar
8 votes
1 answer
362 views

Can I provide multiple legal bases for GDPR purposes?

I used Termly's privacy policy generator, and in the policy that they generated there are four Article 6 legal bases: Consent Legitimate Interests Legal Obligations Vital Interests I took a ...
Paul Razvan Berg's user avatar
8 votes
2 answers
404 views

Does GDPR Prohibit Reading Unsolicited Emails?

I originally asked this question on Information Security and it was suggested it was a better fit over here. I'm a member of the management committee of an allotment society in the UK. The committee ...
BWFC's user avatar
  • 289
8 votes
1 answer
1k views

Is throw-away-the-key-encryption allowed under GDPR?

Article 15 of the GDPR says: The data subject shall have the right to obtain [...] personal data [if it is being "processed"] Article 4 says that "processing" includes storage. Therefore, all ...
Matt Thomas's user avatar
8 votes
1 answer
437 views

If I’ve no WhatsApp account am I still a node on their social graph? And if so can I request to be deleted?

I have never used WhatsApp so I have never shared my phone’s contacts with them or consented to their terms. Many of my friends and family do use WhatsApp and they will all have me in thier contacts ...
Tom's user avatar
  • 83
8 votes
1 answer
873 views

Under GDPR right of access, do I have the right to receive a copy of scoring sheets / evaluation forms after a structured job interview?

Under the GDPR right of access, what rights do I have to employer assessment of myself in the role of a job applicant after a structured job interview? Presumably, in a structured job interview ...
gerrit's user avatar
  • 1,386
7 votes
3 answers
4k views

On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?

I have a question about the GDPR law. I am creating a mobile application where I will need to store some personal data in order for the app to work. I would also like to include personalized ads in ...
Nik's user avatar
  • 173
7 votes
2 answers
2k views

Does The "Right To Be Forgotten" Include Sent Emails?

Say that you maintain an email service, and person A, sends an email to person B who is also on your email service. If person A deletes their account would that mean that person B no longer can view ...
Felix's user avatar
  • 71
7 votes
2 answers
2k views

Are push tokens considered PII under the GDPR or the CCPA?

I'm building a server for an app and I'm trying to get my privacy protections right. The app allows users to opt in to push notifications. If the user opts in, then I save a push notification token ...
Patrick Kenny's user avatar
7 votes
2 answers
2k views

Do family pictures and videos in public places fall under GDPR?

The Czech Data Protection Authority fined Mr. Rynes for filming members of the public without their consent. Mr. Rynes appealed, arguing that he was covered by the personal and household ...
user avatar
7 votes
3 answers
3k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
Gjermund B. Dahl's user avatar
7 votes
3 answers
298 views

Is it illegal to intentionally design a social network that can't comply with right-to-be-forgotten (and possibly other laws)?

If I intentionally design (and program) a social network that uses a technology (blockchain,...) which does not allow for alteration / erasing of user data, what happens in case of a right-to-be-...
user2486570's user avatar
7 votes
2 answers
2k views

Do I still need to check if users are inside of EEA/UK for GDPR consent if my Android app is ONLY released in countries outside of EEA/UK?

Example: A US user downloads the Android app from the US Google Play Store The user does not view any consent form and begins using the app and viewing ads The user then travels to EEA/UK and ...
roguedev's user avatar
7 votes
4 answers
5k views

GDPR: are faces always considered identifiable information?

Machine learning research into facial recognition and processing (e.g. emotion detection) often makes use of datasets containing large numbers of facial images. These are usually anonymised, so that ...
4Oh4's user avatar
  • 125
7 votes
2 answers
5k views

Is the UUID considered personal data?

I am planning to build a mobile platform which I would use the UUID as the username, and a password of user’s choice. So that users would just need to type a chosen password to use my services. ...
user3240549's user avatar
7 votes
4 answers
1k views

Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?

The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data: by a natural person in the course of a ...
Free Radical's user avatar
  • 3,222
7 votes
1 answer
3k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
Joey's user avatar
  • 173
7 votes
1 answer
859 views

GDPR - am I a data controller as an app owner if I do not have access to the data?

Let's assume that I created a mobile app for iPhone that is tracking rides on a bike so that means the app is collecting GPS coordinates of the phone and later this mobile app shows some statistics ...
Leszek Szary's user avatar
7 votes
2 answers
1k views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
basgys's user avatar
  • 171
7 votes
1 answer
272 views

GDPR and personal data that gets crawled and ends up on other websites

Data controllers must delete the users' personal data if they are asked to do so, according to the GDPR, except in some cases that don't really apply here. But what if that personal data has ended up ...
reed's user avatar
  • 1,838

1
2
3 4 5
21