Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
7 votes
1 answer
189 views

Can I request companies to give me all the data they have on me when I'm visiting a country in the EU?

I'm not a citizen of the EU, nor do I reside in the EU. But as a consumer, I welcome GDPR. It gives me some limited rights even though I'm not in the direct interests of the regulation. Anyway, if I ...
adtac's user avatar
  • 171
7 votes
2 answers
734 views

Does GDPR Recital 15 exempt unstructured electronic data?

GDPR Recital 15 states that Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation. I ...
Adrian Cox's user avatar
7 votes
1 answer
190 views

Is it sufficient to provide a privacy policy only in english language?

Regarding GDPR, is it sufficient for a gaming app available in some commercial app store to provide a privacy policy only in english language? Is a translation necessary for every country of the EU ...
Wipster's user avatar
  • 173
6 votes
2 answers
3k views

Are developers data processors?

This question is inspired by this other question: What are an employed/contracted software developer's responsibilities under the GDPR? I wanted to understand more precisely the concept of a data ...
User8's user avatar
  • 67
6 votes
2 answers
3k views

Can a clause be added to a terms of use that forbids use of the service if the terms of use would be illegal in the user's jurisdiction?

Can one add a clause stating Do not use this application if the terms demanded cannot be provided by law For example, let's say one term of use states that information collected may be retained ...
rightlifesavecompenthusiast's user avatar
6 votes
2 answers
2k views

Emailing a publicly available address posted by the same person

I understand that emailing a person without consent is illegal under GDPR. But is it okay to email someone if the person has made the mail address public? For example if a university professor posted ...
avila's user avatar
  • 61
6 votes
1 answer
909 views

Applicability of Data Protection Laws When Talking to a Lawyer

According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission. Can I tell such details legally to my lawyer when referring to ...
Jane B.'s user avatar
  • 71
6 votes
3 answers
3k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
Gjermund B. Dahl's user avatar
6 votes
1 answer
2k views

Is it okay to store user locations?

I know it might sound quite bad. But here I explain the whole situation. I'm developing a mobile application based on visiting different places. And I would store in some database (surely AWS) all ...
Sergi Mascaró's user avatar
6 votes
4 answers
3k views

GDPR - Is consent really necessary for contact form?

I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer. The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
Alen Šimunic's user avatar
6 votes
2 answers
640 views

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
TylerDurden's user avatar
6 votes
4 answers
279 views

Do internal annotations on user accounts fall under the GDPR?

In a platform such as Stack Exchange or any other moderated forum-type site, in which specific moderators have access to account information that regular users don't, and in which said moderators may ...
deceze's user avatar
  • 160
6 votes
2 answers
1k views

As per GDPR, how are the agree/disagree to cookie buttons to be designed?

I just stumbled over this very... interesting cookie dialogue on the Ansible site: How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
Flying Thunder's user avatar
6 votes
1 answer
130 views

Company makes confidential CV publicly available and searchable. Legal recourse?

A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
GregKos's user avatar
  • 163
6 votes
1 answer
435 views

Can a company charge you to update your address under GDPR?

I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
metaDesign's user avatar
6 votes
1 answer
103 views

The circumvention of terms and conditions

There are sites, for example 'moodys.com', which require an explicit agreement to the terms and conditions on every vist (e.g. https://www.moodys.com/research/Moodys-affirms-Chang-Hwa-Commercial-Banks-...
J. Doe's user avatar
  • 61
6 votes
2 answers
1k views

If photos are PII under GDPR, how are most photos on the web legal?

It has been established that identifiable photos of individuals are Personally identifiable information. They MAY even be Special Category Data. It seems to me that ones photo is the most personal ...
Dave's user avatar
  • 827
6 votes
1 answer
299 views

What did Flybe actually do wrong?

Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc. They sent an email to this ...
Hemm K's user avatar
  • 67
6 votes
1 answer
2k views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
Alexandru Nedelcu's user avatar
6 votes
1 answer
1k views

GDPR - Do I have to log user's IP after consent for a cookie?

Do I really have to log a user's IP address and a timestamp after they consent to a cookie? Log example: 20.05.2018 18:56:32 - 127.0.0.1 - Cookie accepted I don't even need (I'm not using it in any ...
kironet's user avatar
  • 163
6 votes
1 answer
2k views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
beluga.me's user avatar
  • 163
6 votes
3 answers
713 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
user179898's user avatar
6 votes
1 answer
427 views

Under GDPR, why is google not considering the index entries as personal data?

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling. Following this, I make the assumption that this qualifies as personal data under GDPR ...
Thomas's user avatar
  • 523
6 votes
1 answer
156 views

Do marketing emails require consent?

I am getting spammed with marketing emails from Tough Mudder. Their unsubscribe link takes me to a page where I have to either accept the fact they will send me emails or unsubscribe from everything, ...
Diazole's user avatar
  • 61
6 votes
3 answers
409 views

Do I have a "legitimate interest" under GDPR to not delete data my software needs to fulfil its function?

The GDPR gives users the right to have their stored data deleted. How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by ...
spiffytech's user avatar
5 votes
3 answers
3k views

GDPR: Do I have to IP log "every" login for a customer?

IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. ...
cagatay117's user avatar
5 votes
2 answers
5k views

Is displaying the user first name and last name a breach of GDPR?

We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
Ced's user avatar
  • 151
5 votes
3 answers
2k views

Does GDPR restrict handling data that the user has certified is not personal information

If my site ToS has this: By submitting data to the this site, you certify that the data is not of a nature that would cause me to have any special obligations under applicable law. And someone from ...
Someone's user avatar
  • 16.6k
5 votes
1 answer
2k views

I have created an App to help isolated people in Corona Virus lockdown. Do GDPR rules apply

I have created an App at helpathome.me which isolated people can use to fill out a form and request help from others. I innocently thought this would be fine but a friend told me that I must comply ...
Bwizard's user avatar
  • 153
5 votes
1 answer
992 views

Talent consent withdrawal in film in Europe

Consider the following scenario of right to erasure in film-making in Europe. Person A makes amateur live-action films, for example theater performances. Person B is in one of those performances and ...
miguelmorin's user avatar
5 votes
1 answer
2k views

Californian resident travelling in EU - which privacy law applies?

If a Californian resident is travelling within the EU, it seems both European GDPR and Californian CCPA privacy laws will apply. Sometimes businesses have single privacy emails, so if a deleting ...
savegoodlyfnotendorsanswerhere's user avatar
5 votes
1 answer
3k views

In GDPR terms is the hash of a user ID considered personal data?

“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, ...
david_adler's user avatar
5 votes
2 answers
442 views

Are Blizzard breaking GDPR by charging people for changing their usernames?

I have had an account with Blizzard for several years now. I changed my username (referred to as a battletag) only once, over a year ago. I now want to change it again because searching it on Google ...
flexi's user avatar
  • 522
5 votes
1 answer
2k views

Is this a valid approach to ask consent under GDPR?

I'm trying to figure out the best way to gather user consent to use third-party services in a mobile app for users under the GDPR. Let's say that I have an app that uses third party services (...
svprdga's user avatar
  • 293
5 votes
2 answers
1k views

Are server-logs personal data (GDPR-related)?

Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS). Should I state that in our privacy policy?
T.Todua's user avatar
  • 190
5 votes
2 answers
635 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
Per Digre's user avatar
  • 354
5 votes
3 answers
2k views

Do default Apache logs violate the GDPR?

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
WBT's user avatar
  • 4,868
5 votes
5 answers
12k views

GDPR treatment of a list of phone numbers

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to ...
Craig's user avatar
  • 159
5 votes
1 answer
1k views

Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?

Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)? I am following the current issue ...
Paul-Beyond's user avatar
5 votes
1 answer
2k views

Will storing hashed phone numbers violate GDPR?

I've read GDPR document from start to end, but I am still not sure about one thing. Let's say I have a system where I store phone numbers in hashed form (let's say bcrypt). Will this violate GDPR if ...
Sh1d0w's user avatar
  • 161
5 votes
2 answers
2k views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
David's user avatar
  • 205
5 votes
2 answers
880 views

GDPR - first party analytics cookies

Does the first-party issued cookie, under control of, and only accessible by the first party requires visitor consent? Given the conditions bellow: Cookie is used to uniquely identify anonymous ...
Matiss's user avatar
  • 184
5 votes
3 answers
1k views

Is it possible for non-EU companies to avoid GDPR regulatory issues through filters and firewalls?

Background Most internet feeds are unfiltered. Everyone who has ever rented or set up a server knows malicious traffic comes in from all over the world, including the European Union (but mostly from ...
Paul's user avatar
  • 325
5 votes
1 answer
457 views

Do I need to offer a data processing agreement

I recently created a browser extension that allows you to pretty-format a web page and save it in various formats (Word, PDF, etc). I have made it publicly accessible through the browser extension ...
Andre Borges's user avatar
5 votes
1 answer
223 views

Are there temporal limits to data requirements for a GDPR SAR?

Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data? The particular case I am thinking about is SAR made to the 3 credit ...
Dave's user avatar
  • 827
5 votes
2 answers
4k views

GDPR: Is only a birthday personal identifiable information?

I wonder if only a birthday is seen as personal identifiable information according to the GDPR, so no usernames, passwords, emails, phone numbers are present in the system. Literally only a birthdate. ...
user32018's user avatar
5 votes
1 answer
155 views

Under GDPR can I avoid divulging a customer's data to the government?

Scenario: A business has a legal requirement to obtain a license from a government agency relating to its business activities. The business activities have already being undertaken and there is no ...
JBentley's user avatar
  • 7,797
5 votes
1 answer
149 views

Can online business in one country deny access via terms of service to entities in another country?

Can an American company state in their terms of service that if an entity is from a designated country they are not allowed to use the service? In other words would that be a legal and enforceable ...
Ole's user avatar
  • 327
5 votes
2 answers
310 views

GDPR with refusing medical information

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing ...
David's user avatar
  • 328
5 votes
1 answer
352 views

Deletion of personal data

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background. ...
MrUpsidown's user avatar

1 2
3
4 5
20