Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
4
votes
1answer
130 views

As a web and mobile (iOS and Android) developer, how do I discover if GDPR applies to a user?

This is a really basic question about GDPR. If I have products that are intended only for US customers, but can be accessed by European Union residents, does GDPR apply? More specific example: A ...
4
votes
0answers
47 views

Is Google's privacy policy compliant with GDPR for the data processing agreement between a controller and a processor?

If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google ...
4
votes
2answers
261 views

“Right of access by the data subject” if the IP address is the only personal data

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
4
votes
0answers
61 views

Do I have to send one of those emails after updating my privacy policy for GDPR?

We’re all getting them: “We’ve updated our privacy policy” emails from companies left, right, and centre. But are organisations required to send them? Or are they sending them because everyone else is?...
3
votes
1answer
3k views

Salesman text me from his personal phone

I recently went to a garage to ask about different cars and offers, the salesman took some details; phone and email, when leaving I said to him I would be in touch if I wanted to proceed. He called me ...
3
votes
2answers
422 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
3
votes
4answers
69 views

Is encrypted health data still considered personal data and subject to GDPR Art. 9 (1)?

I need to exchange data from a patient providing its own health data to a healthcare provider over my server. The data is encrypted on the patient's device by the public key of the healthcare provider ...
3
votes
4answers
116 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
3
votes
1answer
77 views

As a customer, am i liable for messaging another customer found on a Facebook business page?

I am a customer for a Wedding dress shop, and I messaged another customer with a warning about the shops impending closure because of issues with lack of contact from the company. I have received a ...
3
votes
2answers
147 views

Can the terms of service contain a clause that instructs a user to forfeit their rights under the GDPR?

Suppose an American company wishes to do business with European parties. Could their terms of service say that as a user of their services the user forfeits any rights afforded to them by the GDPR ...
3
votes
2answers
45 views

Is this privacy statement from a solicitors in line with GDPR?

I'm in the process of buying a house and have paid for a survey to be done on the property. I have received a contract from the solicitor who will be conducting the survey for me and will provide me ...
3
votes
1answer
403 views

Does a user have the right to request their forum posts deleted?

Forum posts and similar stuff: chat messages from chatlogs, etc. According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered ...
3
votes
2answers
298 views

Do web applications as hobby projects need to comply with the GDPR?

I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation. 2) This Regulation does ...
3
votes
3answers
125 views

Android Application: Is purchaseToken defined under GDPR as PII?

In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using this API ) and saving purchaseToken on our server to validate his license. ...
3
votes
1answer
803 views

To comply with GDPR, do I need passwords hashed?

I currently have a website that will be going live soon. The passwords are hashed. Is that all I need to do to comply with General Data Protection Regulation's encryption article? Please cite and ...
3
votes
2answers
65 views

Site does not provide the option to disallow cookies in a notification

Is this a typical behavior for websites to provide only one option, and doing so, forces the user clicking "accept"? Isn't it so that they must provide both, accept and reject?
3
votes
3answers
155 views

Is a public IP address classified as “personal data” for a third party under EU law?

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in ...
3
votes
3answers
91 views

GDPR: Is giving out customer name and implied existence of customership legal?

I'm an employee (software developer) for a company that acts a data processor, and the company that is a client and data controller has requested a feature that I find questionable. The purpose is to ...
3
votes
2answers
109 views

anonymisation/redaction of public website content as response to 'right to erasure'

An organisation runs some public email lists. These are archived, and the archives are also publically available from its website. A user of the mailing list asserts their "right to be forgotten" and ...
3
votes
1answer
172 views

Was my GDPR request not complied with?

On the 12th of December I made a GDPR request to a major online retailer in the UK. While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested ...
3
votes
1answer
67 views

Does GDPR apply to location data collected by apps?

I've just been reading this article in the New York Times which expounds on the business practices of mobile apps which collect your location data and use it/sell it. The article gives examples of ...
3
votes
1answer
146 views

GDPR vs ICANN WHOIS

Let’s start with some basic information: While a bit vague, for years you’ve been required to submit registrant, admin, and technical contact details. https://whois.icann.org/en/domain-name-...
3
votes
3answers
156 views

According to GDPR, do I need a contract for processing on behalf with my e-mail provider?

It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster. Now, I am wondering whether the same is true for the e-...
3
votes
2answers
2k views

How to handle CVs / resumes with GDPR rules?

As a consultant my resume is personal information which is handed out to prospective clients frequently. How personal should it be? Should some data be anonymized? Should the resume be returned from ...
3
votes
1answer
173 views

Is it legal for Blizzard to demand a copy of my government id before deleting my account?

I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so. I've seen a somewhat related question about Twitter at How can I get Twitter to delete my ...
3
votes
1answer
85 views

A user has supplied personal information in an anonymous form. What is this information's status under GDPR?

I am implementing a user feedback function in an application for my employer. The feedback is anonymous, but users can enter any text in the form. If a user includes personal information (e.g. their ...
3
votes
2answers
132 views

Do default Apache logs violate the GDPR?

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP ...
3
votes
2answers
71 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
3
votes
1answer
83 views

Are artificially generated personal data covered by the GDPR?

According to Article 2(1) GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be ...
3
votes
1answer
418 views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
3
votes
1answer
181 views

Is email verification for account creation in violation of GDPR?

Is email verification for account creation in violation of GDPR? I am creating a new website, and my account creation is incredibly simple, consisting of username, password (stored as hash), and ...
3
votes
2answers
514 views

Does keeping an MD5 hash of user data violate GDPR?

If a user requests to have their data deleted, would we still be permitted to keep hashes of user data for later use, even after the original data has been deleted?
3
votes
1answer
494 views

GDPR: Are Anticheat Logs personal data?

We are running an online game server and use an automated system to detect cheaters. When a cheater gets banned a log will be saved containing the names of the algorithms that detected the cheater. We ...
3
votes
1answer
58 views

GDPR - Is having a PDF with fields to fill out classed as data?

I have a website which has a link to a PDF form which users can print out and fill in. I'm wondering if somewhere I need to a statement in my privacy policy which justifies this?
3
votes
1answer
535 views

User consent required under GDPR

I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user. For this reason I have drafted a ...
3
votes
1answer
597 views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
3
votes
1answer
26 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
3
votes
1answer
49 views

Data deletion requirements

I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it. I never ...
3
votes
1answer
51 views

GDPR: Transfer (chapter V)

I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web ...
3
votes
2answers
43 views

GDPR - am I the processor if I don't host the website?

I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase ...
3
votes
1answer
56 views

Do I need user consent to respond to their email sent through my website's contact form?

I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message. I'm not storing any of the data in a database or in cookies. When the user ...
3
votes
1answer
74 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
3
votes
1answer
92 views

Is it legal to have a opt-out of marketing emails checkbox under GDPR?

As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-...
3
votes
1answer
49 views

GDPR - How quick to honour unsubscribe?

Does GDPR or any other UK law specify the timeframe for removing someone from a mailing list? In our case the mailing list must be created up to 10 days before an automated email send over the ...
3
votes
1answer
145 views

GDPR and hotlinked images: are they allowed?

By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent: Your ...
3
votes
1answer
69 views

Private Website and copyright/GDPR

Similar questions have been asked before but I still could not find answers that made me understand it. I created a website and would like to know which laws affect me. The website does not have any ...
3
votes
1answer
166 views

Just how different is the legal situation in Germany under GDPR compared to previously with respect to running a website?

A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national ...
3
votes
1answer
78 views

GDPR and forums: “Lawfulness of processing” email addresses used only for providing the service

I run a small hobby message board that is entirely non-commercial. People need to provide an email address to register and use that for logging in. I do not use their email address for anything else (...
3
votes
1answer
174 views

Should email addresses be anonymized/pseudonymized under GDPR?

GDPR states recommendation to pseudonymise or even anonymise Personal Data. A lot — most of — web sites and services require email address on signup. Should, from the Data Controller's point of view, ...
3
votes
2answers
147 views

GDPR liability for Web Designer

I am a web designer that works with a range of clients on a project basis. I complete a project and then offer my services at any hourly rate for any other work required in the future. Do I have a ...