Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
4
votes
1answer
75 views

Data deletion requirements

I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it. I never ...
4
votes
1answer
112 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
4
votes
1answer
289 views

Should all gdpr related documents be translated to all official EU languages?

I wrote application localized in Ukrainian language , which is not one of the official European Union languages. Since I reside in the EU territory I need to comply with gdpr. This application is ...
4
votes
1answer
1k views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
4
votes
1answer
530 views

Is email verification for account creation in violation of GDPR?

Is email verification for account creation in violation of GDPR? I am creating a new website, and my account creation is incredibly simple, consisting of username, password (stored as hash), and ...
4
votes
2answers
650 views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
4
votes
1answer
212 views

GDPR email consent - Pre ticked “No” box

We are currently creating an email to gain consent from our customers to email allow us to market to them. We are currently using Mailchimp to put the email together and it is currently not allowing ...
4
votes
1answer
56 views

Extraterritorial Scope of Brazil's LGPD

How can a national legislation, like the recent Brazil's LGPD apply to companies which are not established in Brazil, but may offer services to Brazilian citizens via the Internet? Imagine a website (...
4
votes
1answer
90 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
4
votes
2answers
93 views

Opting out of cookies by emailing a company

Is it legal for a company, which serves customers in the EU as well as elsewhere, to say in its privacy policy that you can opt out of analytical and marketing cookies by emailing them? Rather than ...
4
votes
2answers
540 views

Do default Apache logs violate the GDPR?

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
4
votes
4answers
540 views

Is a Blood sample considered Personal Data under GDPR?

Just that simple question: Is a Blood sample considered Personal Data under GDPR?
4
votes
3answers
5k views

How to handle CVs / resumes with GDPR rules?

As a consultant my resume is personal information which is handed out to prospective clients frequently. How personal should it be? Should some data be anonymized? Should the resume be returned from ...
4
votes
1answer
573 views

GDPR impact on genealogy website / uncontrolled user data

The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is ...
4
votes
1answer
286 views

Do employees have personal liability when working for a company that violates the GDPR?

I work for a company that doesn't take privacy laws very seriously. As far as I can tell, they're woefully unprepared for GDPR and don't seem to care very much. My tasks mainly consist of software ...
4
votes
1answer
742 views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
4
votes
1answer
111 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
4
votes
1answer
145 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
4
votes
1answer
88 views

Does possesing BUT NOT processing a personal data make the organization their controller?

According to Article 4(7) of GDPR: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
4
votes
1answer
114 views

Responding to GDPR Article 15 requests if all data is already accessible via website

So, Article 15 of the GDPR gives the user the right to access all the personal data concerning him or her. Assume we have a website with user accounts. We store some information that is regarded as ...
4
votes
1answer
162 views

With GDPR, can you request 'real life data' be deleted/forgotten?

For example, can you request libraries remove your name from books you have checked out?
4
votes
1answer
213 views

GDPR Right to erasure vs mailing list archive?

Consider a mailing list like mailman or listserv. The archives of these mailing lists, due to quoting, will contain names and email addresses. Now, the GDP Article 17, unless I am mistaken obliges ...
4
votes
1answer
128 views

GDPR for small interest associations

What exactly does a small common interest club with 100 members need to do to comply with GDPR requirements?
4
votes
1answer
267 views

Can I count unique users without a cookie warning?

Is there a way to count (approximate) unique users on a website without having to display that silly cookie warning? The usual way to track unique users is to set a cookie. An alternative (less ...
4
votes
1answer
81 views

What is my responsibility related to GDPR as a Freelance developer

I'm a Software Engineer, and I've just taken my first "side gig" job in hopes of becoming Freelance one day. I'm based in the UK. My Client told me exactly what they want, and i've built it. ...
4
votes
1answer
70 views

Would revealing/storing whether or not an EU customer uses a service violate the GDPR?

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
4
votes
1answer
439 views

Can I file a GDPR “request to be forgotten” on behalf of someone else?

Assuming a person might be interested in requesting to be forgotten by a large number of sites that store personal or behavioral data, sending individual requests to hundreds (or thousands) of sites ...
4
votes
1answer
142 views

As a web and mobile (iOS and Android) developer, how do I discover if GDPR applies to a user?

This is a really basic question about GDPR. If I have products that are intended only for US customers, but can be accessed by European Union residents, does GDPR apply? More specific example: A ...
4
votes
0answers
56 views

Is Google's privacy policy compliant with GDPR for the data processing agreement between a controller and a processor?

If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google ...
4
votes
2answers
394 views

“Right of access by the data subject” if the IP address is the only personal data

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
4
votes
1answer
80 views

Do I have to send one of those emails after updating my privacy policy for GDPR?

We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?...
3
votes
1answer
3k views

Salesman text me from his personal phone

I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me ...
3
votes
4answers
363 views

GDPR - Is consent really necessary for contact form?

I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer. The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
3
votes
2answers
466 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
3
votes
4answers
88 views

Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?

I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
1answer
2k views

Does a user have the right to request their forum posts deleted?

Forum posts and similar stuff: chat messages from chatlogs, etc. According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered ...
3
votes
2answers
166 views

Can the terms of service contain a clause that instructs a user to forfeit their rights under the GDPR?

Suppose an American company wishes to do business with European parties. Could their terms of service say that as a user of their services the user forfeits any rights afforded to them by the GDPR ...
3
votes
4answers
134 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
3
votes
1answer
86 views

As a customer, am i liable for messaging another customer found on a Facebook business page?

I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company. I have received a ...
3
votes
2answers
101 views

What does “structured, commonly used and machine-readable format” look like in practice?

I have made a subject access request, and the result included: Statement that their right to process data is from Article 6(1)(b) A series of images, that appear to be photographs of a computer ...
3
votes
2answers
58 views

Are there any HIPAA like technical requirements in EU for developing health related web software?

It looks like in the USA developers adhere to HIPAA standards when developing and hosting health-related software. But I can't find anything similar to the EU. GDPR is all about being transparent and ...
3
votes
2answers
48 views

Is this privacy statement from a solicitors in line with GDPR?

I'm in the process of buying a house and have paid for a survey to be done on the property. I have received a contract from the solicitor who will be conducting the survey for me and will provide me ...
3
votes
2answers
370 views

GDPR - first party analytics cookies

Does the first-party issued cookie, under control of, and only accessible by the first party requires visitor consent? Given the conditions bellow: Cookie is used to uniquely identify anonymous ...
3
votes
2answers
440 views

Do web applications as hobby projects need to comply with the GDPR?

I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation. 2) This Regulation does ...
3
votes
3answers
151 views

Android Application: Is purchaseToken defined under GDPR as PII?

In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using this API ) and saving purchaseToken on our server to validate his license. ...
3
votes
1answer
1k views

To comply with GDPR, do I need passwords hashed?

I currently have a website that will be going live soon. The passwords are hashed. Is that all I need to do to comply with General Data Protection Regulation's encryption article? Please cite and ...
3
votes
1answer
55 views

Why does Google require consent from users in order to process ads personalization data?

Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was ...
3
votes
2answers
90 views

Site does not provide the option to disallow cookies in a notification

Is this a typical behavior for websites to provide only one option, and doing so, forces the user clicking "accept"? Isn't it so that they must provide both, accept and reject?
3
votes
3answers
245 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
3
votes
3answers
107 views

GDPR: Is giving out customer name and implied existence of customership legal?

I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable. The purpose is to ...

1 2
3
4 5
12