Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
919
questions
6
votes
4
answers
3k
views
GDPR - Is consent really necessary for contact form?
I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer.
The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
- 163
6
votes
1
answer
2k
views
Is this a valid approach to ask consent under GDPR?
I'm trying to figure out the best way to gather user consent to use third-party services in a mobile app for users under the GDPR. Let's say that I have an app that uses third party services (...
- 313
6
votes
4
answers
267
views
Do internal annotations on user accounts fall under the GDPR?
In a platform such as Stack Exchange or any other moderated forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may ...
- 160
6
votes
2
answers
964
views
As per GDPR, how are the agree/disagree to cookie buttons to be designed?
I just stumbled over this very... interesting cookie dialogue on the Ansible site:
How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
- 183
6
votes
1
answer
126
views
Company makes confidential CV publicly available and searchable. Legal recourse?
A friend of mine was looking for a job last August. She sent CVs for various positions.
Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
- 163
6
votes
1
answer
314
views
Can a company charge you to update your address under GDPR?
I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
- 163
6
votes
1
answer
318
views
Is it GDPR-compliant to require *public* publishing of personal info as condition for access to a service?
Background: For roughly 2 decades I've run my own private email infrastructure for myself, open source projects, and a few other individuals over business internet service intended for such usage. I'...
6
votes
2
answers
3k
views
Is the UUID considered personal data?
I am planning to build a mobile platform which I would use the UUID as the username, and a password of user’s choice. So that users would just need to type a chosen password to use my services.
...
- 63
6
votes
2
answers
1k
views
If photos are PII under GDPR, how are most photos on the web legal?
It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal ...
- 867
6
votes
1
answer
293
views
What did Flybe actually do wrong?
Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc.
They sent an email to this ...
- 67
6
votes
1
answer
6k
views
GDPR: cookie for login management
I use cookie in my site for login management.
I user logs in the cookie dies with the session, if user flags "Keep me logged in" when logging in a long time cookie persists.
In the long time cookie I ...
- 73
6
votes
1
answer
2k
views
Can usage of Google Analytics (without consent) be considered a legitimate interest?
According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
6
votes
1
answer
2k
views
How does the GDPR apply to software developed by one company and used by another?
Question
I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year.
A lot of it makes sense, however I'm really ...
- 163
6
votes
1
answer
1k
views
GDPR - Do I have to log user's IP after consent for a cookie?
Do I really have to log a user's IP address and a timestamp after they consent to a cookie?
Log example: 20.05.2018 18:56:32 - 127.0.0.1 - Cookie accepted
I don't even need (I'm not using it in any ...
- 163
6
votes
1
answer
2k
views
Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?
github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
- 163
6
votes
3
answers
705
views
Does the GDPR allow me to access data from public sources, store it and anaylize it?
I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer.
Does the GDPR allow me (my software/server) to derive data, store it and ...
- 63
6
votes
1
answer
336
views
Under GDPR, why is google not considering the index entries as personal data?
I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling.
Following this, I make the assumption that this qualifies as personal data under GDPR ...
- 473
6
votes
1
answer
147
views
Do marketing emails require consent?
I am getting spammed with marketing emails from Tough Mudder. Their unsubscribe link takes me to a page where I have to either accept the fact they will send me emails or unsubscribe from everything, ...
- 61
6
votes
2
answers
713
views
Does GDPR Recital 15 exempt unstructured electronic data?
GDPR Recital 15 states that
Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation.
I ...
- 161
6
votes
3
answers
375
views
Do I have a "legitimate interest" under GDPR to not delete data my software needs to fulfil its function?
The GDPR gives users the right to have their stored data deleted.
How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by ...
- 161
6
votes
2
answers
292
views
Can I request to delete an account with a government?
This concerns my student loans repayment account which is managed by the gov.uk website.
I have paid my loan back in full and have had a confirmatory letter stating this as well, as I wanted to ensure ...
- 168
5
votes
2
answers
4k
views
Is displaying the user first name and last name a breach of GDPR?
We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
- 151
5
votes
3
answers
2k
views
Does GDPR restrict handling data that the user has certified is not personal information
If my site ToS has this:
By submitting data to the this site, you certify that the data is not of a nature that would cause me to have any special obligations under applicable law.
And someone from ...
- 12k
5
votes
1
answer
2k
views
I have created an App to help isolated people in Corona Virus lockdown. Do GDPR rules apply
I have created an App at helpathome.me which isolated people can use to fill out a form and request help from others.
I innocently thought this would be fine but a friend told me that I must comply ...
- 153
5
votes
2
answers
1k
views
Under GDPR, does blurhash of a profile picture count as personal data
Suppose I have a web service where users can have a profile page with name and picture. Blurhash is a technology that allows me to create a significantly blurred representation of an image, as a ...
- 161
5
votes
2
answers
384
views
Are Blizzard breaking GDPR by charging people for changing their usernames?
I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago.
I now want to change it again because searching it on Google ...
- 502
5
votes
3
answers
180
views
Can the GDPR be used to obtain US voting information
This grows out of a comment in the question Who Has the Right to Access State Voter Records and How May That Right be Expediently Exercised?
If a US citizen is currently resident in the EU, can that ...
- 112k
5
votes
3
answers
2k
views
Do default Apache logs violate the GDPR?
Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
- 4,686
5
votes
5
answers
10k
views
GDPR treatment of a list of phone numbers
How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
- 159
5
votes
1
answer
1k
views
Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?
Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)?
I am following the current issue ...
- 119
5
votes
2
answers
2k
views
GitHub pages and GDPR - controller, processor and DPA
I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain.
The only potentially personal data that the site will ...
- 205
5
votes
2
answers
759
views
GDPR - first party analytics cookies
Does the first-party issued cookie, under control of, and only accessible by the first party requires visitor consent? Given the conditions bellow:
Cookie is used to uniquely identify anonymous ...
- 184
5
votes
2
answers
905
views
Are server-logs reckoned as storing of personal data by website (GDPR)?
Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS). Should I state that in our privacy policy?
- 190
5
votes
3
answers
1k
views
Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?
Background
Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
- 315
5
votes
1
answer
379
views
Is it a breach of GDPR and DPA to say a colleague is sick and off work?
This is a hypothetical question. Suppose a customer calls asking for a colleague, call her Alice, and Bob answers the phone and tells the customer that Alice is off sick with the flu. The customer ...
- 783
5
votes
1
answer
307
views
GDPR - Consent to the use of personal data on mobile app - stored per device or signed up user?
For my mobile app, I need to get users' consent to process their personal data (and separately to use anonymized data for Google Analytics). I am unsure, however, how exactly I have to implement this.
...
- 53
5
votes
1
answer
437
views
Do I need to offer a data processing agreement
I recently created a browser extension that allows you to pretty-format a web page and save it in various formats (Word, PDF, etc). I have made it publicly accessible through the browser extension ...
- 153
5
votes
1
answer
204
views
Are there temporal limits to data requirements for a GDPR SAR?
Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data?
The particular case I am thinking about is SAR made to the 3 credit ...
- 867
5
votes
1
answer
146
views
Under GDPR can I avoid divulging a customer's data to the government?
Scenario:
A business has a legal requirement to obtain a license from a government agency relating to its business activities.
The business activities have already being undertaken and there is no ...
- 6,395
5
votes
1
answer
90
views
The circumvention of terms and conditions
There are sites, for example 'moodys.com', which require an explicit agreement to the terms and conditions on every vist (e.g. https://www.moodys.com/research/Moodys-affirms-Chang-Hwa-Commercial-Banks-...
- 51
5
votes
1
answer
295
views
GDPR vs ICANN WHOIS
Let’s start with some basic information:
While a bit vague, for years you’ve been required to submit registrant, admin, and technical contact details.
https://whois.icann.org/en/domain-name-...
- 403
5
votes
1
answer
138
views
Can online business in one country deny access via terms of service to entities in another country?
Can an American company state in their terms of service that if an entity is from a designated country they are not allowed to use the service?
In other words would that be a legal and enforceable ...
- 327
5
votes
2
answers
305
views
GDPR with refusing medical information
How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing ...
- 328
5
votes
1
answer
240
views
Choosing DPA to submit data breach complaint (EU-specific)
Context
The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
The offenders ...
- 153
5
votes
1
answer
327
views
Deletion of personal data
I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background.
...
- 153
5
votes
1
answer
3k
views
Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?
I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
- 145
5
votes
1
answer
73
views
How does GDPR's right to erasure apply to deduplicated storage?
I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case:
Company A offers a online data storage service that is intended to be used by the users ...
- 53
5
votes
2
answers
4k
views
GDPR and CDN (content delivery networks)
I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content.
A CDN is, basically, a distributed network of servers. ...
- 205
5
votes
2
answers
831
views
Is "By clicking Continue you accept T&C" an unambiguous consent in context of GDPR
I just read about explicit/unambiguous consent in context of GDPR. And I just saw in some mobile app a payment form where you enter some data and to pay you click a "Continue" button. Just next to ...
- 161
5
votes
2
answers
985
views
How does GDPR affect sports statistics?
I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
- 151