Questions tagged [gdpr]
Questions about the European Union General Data Protection Regulation (GDPR)
922
questions
5
votes
1
answer
363
views
Do employees have personal liability when working for a company that violates the GDPR?
I work for a company that doesn't take privacy laws very seriously. As far as I can tell, they're woefully unprepared for GDPR and don't seem to care very much.
My tasks mainly consist of software ...
5
votes
1
answer
545
views
Establishing GDPR consent when the person doesn't access a system themself
My company hosts an online database for organisations to manage training data for their people.
In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. ...
- 151
5
votes
1
answer
228
views
Specificity of GDPR's right of erasure
Article 17 of the GDPR states that:
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her [...] where one of the following ...
- 177
5
votes
1
answer
195
views
With GDPR, can you request 'real life data' be deleted/forgotten?
For example, can you request libraries remove your name from books you have checked out?
- 151
5
votes
1
answer
171
views
Does GDPR affect individual contributor license agreements for opensource projects?
I am wondering, if GDPR affects OSS projects that have an Individual Contributor's Licensing Agreement / (a.k.a. ICLA, or just CLA), such as for example Apache 2.0. The gathered information when ...
- 171
5
votes
1
answer
794
views
GDPR impact on genealogy website / uncontrolled user data
The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is ...
- 151
5
votes
1
answer
126
views
Does a US company moving its PII and web servers to the EU solve the Meta fine problem?
As discussed in this question about the Meta fine it is a problem for companies that host websites with access to EU user registration data in US datacenters. This is based on the 'Schrems II' ...
- 4,135
5
votes
1
answer
216
views
Do sites need to explicitly ask for cookie consent as of 2022?
I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the ...
- 231
5
votes
1
answer
317
views
GDPR unbelievable legitimate interest. What action to take?
If a website is claiming legitimate interest in data collection in a way that is unbelievable is there any action that a web site visitor can take?
For example, if one was to visit The Daily Mail you ...
- 867
5
votes
1
answer
114
views
GDPR rights of person who moves into the EU
Suppose that a person not resident (nor present) in the EU, say in Mexico, obtains services from a provider located in the US, and provides personal information in connection with those services, ...
- 112k
5
votes
3
answers
518
views
GDPR and hotlinked images: are they allowed?
By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent:
Your ...
- 1,818
5
votes
1
answer
229
views
Responding to GDPR Article 15 requests if all data is already accessible via website
So, Article 15 of the GDPR gives the user the right to access all the personal data concerning him or her.
Assume we have a website with user accounts. We store some information that is regarded as ...
- 155
5
votes
2
answers
746
views
"Right of access by the data subject" if the IP address is the only personal data
IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article ...
- 1,136
5
votes
1
answer
252
views
Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?
How does GDPR apply to companies getting someone else's personal data from a legitimate source?
For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a ...
- 328
5
votes
1
answer
333
views
Contract necessary for the most basic processing under GPDR?
I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or ...
- 151
5
votes
1
answer
229
views
In which jurisdictions outside the EU can the GDPR be enforced?
The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens.
Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
- 1,682
5
votes
1
answer
150
views
How to fulfill the General Data Protection Regulation (GDPR) when citing
I have a question about the European General Data Protection Regulation.
According to Article 13, one has to inform anyone whose personal data is collected:
Where personal data relating to a ...
- 111
5
votes
2
answers
284
views
Excluding all people from the EU from my blog - is this allowed?
There's a new law from the European Union I simply cannot comply with (GDPR).
Its way to complex, not even big companies can comply with it. I also don't know what google does with the data from my ...
user9886
4
votes
2
answers
854
views
If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?
I used to work for a company, where they have a team of moderators, who actively monitor which accounts are scammers etc. To monitor this they can find links between user accounts via a users password,...
- 43
4
votes
2
answers
2k
views
Repercussions of defying the Cookie Law
I was wondering what case law is out there on the subject, or, if there is not much, what real repercussions can website owners who defy the Cookie Law expect?
Say Bob is not only pissed off by the ...
- 23.7k
4
votes
2
answers
1k
views
What is the U.K. GDPR?
I understand that the DPA implemented the GDPR in British law as an act of Parliament. Then there was Brexit, and the U.K. GDPR was introduced to stand in for the no longer binding EU GDPR, with only ...
- 5,858
4
votes
1
answer
1k
views
In GDPR terms is the hash of a user ID considered personal data?
“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, ...
- 143
4
votes
2
answers
234
views
Can the terms of service contain a clause that instructs a user to forfeit their rights under the GDPR?
Suppose an American company wishes to do business with European parties. Could their terms of service say that as a user of their services the user forfeits any rights afforded to them by the GDPR ...
- 327
4
votes
2
answers
699
views
Will GDPR (EU law) make bad practices in security illegal?
The way I understand it, the purpose of GDPR (General Data Protection Regulation, EU law) is to make sure that personal data is treated transparently and securely. So half of it is about giving the ...
- 1,818
4
votes
2
answers
606
views
GDPR - Right to erasure - Conflicting laws
I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
- 344
4
votes
3
answers
211
views
Is storing on EU-based servers sufficient to be GDPR-compliant with regard to the Schrems II arrest if they're controlled by a U.S. company?
After the Schrems II decision, data transfers to US data processors are increasingly risky at best, for example to public cloud providers such as GCP, Azure, and AWS.
A very common suggestion is to ...
- 143
4
votes
1
answer
324
views
What is the most comparable American law to GDPR right to subject access? Privacy Act?
HIPAA seems comparable but only applies to medical data, but is there anything more general than that?
How does privacy act compare to data subject access rights under gdpr? Is it that it only applies ...
4
votes
1
answer
2k
views
Will storing hashed phone numbers violate GDPR?
I've read GDPR document from start to end, but I am still not sure about one thing.
Let's say I have a system where I store phone numbers in hashed form (let's say bcrypt).
Will this violate GDPR if ...
- 151
4
votes
2
answers
182
views
"no logs" website in eu - is it illegal?
As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my ...
- 141
4
votes
1
answer
6k
views
Does a user have the right to request their forum posts deleted?
Forum posts and similar stuff: chat messages from chatlogs, etc.
According to https://eugdprcompliant.com/personal-data/ , a person's social media accounts and their posts there are considered ...
- 337
4
votes
2
answers
2k
views
Does any host provider currently comply with GDPR?
According to Rec.81; Art.28(1)-(3) of the GDPR regulation,
"The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding ...
- 103
4
votes
2
answers
2k
views
Storing IP's and GDPR Compliance
Suppose a web designer plans to store hashed IP's in a database for analytical purposes of tracking unique clicks, and for security purposes to prevent botting unique clicks. Suppose the site only ...
- 53
4
votes
1
answer
423
views
Is a cookie notice required for analytics?
Note: I've been directed here from Meta.SE
I'm using GoSquared for my website analytics.
I've visited quite a few sites using Google Analytics but they don't have a cookie policy or a cookie banner/...
- 143
4
votes
2
answers
1k
views
Does GDPR apply to internal employees data?
Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has ...
- 234
4
votes
1
answer
95
views
Any GDPR implications when displaying publicly accessible info on a website?
There's a simple static website written by a couple of university students that provides useful information about it, containing among other things contact information of faculty members (email, ...
4
votes
1
answer
596
views
Should registered users accept cookie consent in GDPR?
I want to use cookie consent for saving user language, currency and affiliate marketing purpose.
Can I store data without consent of the registered users? They are registered so do I need to take ...
- 43
4
votes
2
answers
286
views
Creative commons attribution and GDPR
When using content released under an open licence such as creative commons, it might be required to provide attribution to the author.
For instance, if I were to use this image from Wikimedia Commons ...
- 43
4
votes
2
answers
3k
views
GDPR: Is only a birthday personal identifiable information?
I wonder if only a birthday is seen as personal identifiable information according to the GDPR, so no usernames, passwords, emails, phone numbers are present in the system. Literally only a birthdate. ...
- 41
4
votes
2
answers
281
views
Do I have to provide proof of citizenship - GDPR
Recently, I've been going through some old accounts of mine (on online websites) and I started deleting them. Thanks to GDPR, this is now much easier.
Most companies' customer services have no ...
- 143
4
votes
1
answer
990
views
Are hobby projects exempt from GDPR?
Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database.
GDPR ...
- 41
4
votes
1
answer
143
views
What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?
What are the possible copyright and other legal issues faced by an individual in the US running a Mastodon server?
The social network Mastodon https://en.wikipedia.org/wiki/Mastodon_(social_network) ...
- 161
4
votes
1
answer
176
views
Are there privacy laws other than GDPR which consider IP addresses as personal data?
In EU's GDPR the IP address is considered personal data (lots of discussions about it, but this seems to be the correct interpretation at the moment). Several countries have now privacy laws which are ...
- 1,402
4
votes
2
answers
368
views
If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?
I’m considering buying the assets of an insolvent company that has gone into administration / receivership.
Included in the assets is a customer database.
How does GDPR apply?
is the purchasing ...
- 143
4
votes
1
answer
1k
views
Is email verification for account creation in violation of GDPR?
Is email verification for account creation in violation of GDPR?
I am creating a new website, and my account creation is incredibly simple, consisting of username, password (stored as hash), and ...
- 43
4
votes
1
answer
164
views
Can a data controller change their privacy policy without explicit consent?
While I read one of the updated privacy policies (PP) this week, the following section of a privacy policy seemed… off:
We may change this Privacy Policy from time to time, and all changes will be ...
- 143
4
votes
3
answers
200
views
Android Application: Is purchaseToken defined under GDPR as PII?
In our Android application user is allowed to buy subscription. From code we are retrieving his purchaseToken (using this API ) and saving purchaseToken on our server to validate his license.
...
- 41
4
votes
1
answer
173
views
Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever
I have a small static personal website, where I publish some technical articles and my personal CV.
Do I need to include a privacy-policy if:
There are no (third- or first party) tracking services ...
- 43
4
votes
1
answer
162
views
GDPR Representatives of controllers or processors not established in the Union - Is this basically a simple mail-forwarding activity?
Art. 27 of GDPR says that whoever processes data of people located inside the EU (includes storing and deleting in the GDPR definition, with a few exceptions) needs a Representative located inside the ...
- 1,402
4
votes
1
answer
898
views
Is it legal for Blizzard to demand a copy of my government id before deleting my account?
I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so.
I've seen a somewhat related question about Twitter at How can I get Twitter to delete my ...
4
votes
1
answer
90
views
Data deletion requirements
I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it.
I never ...
- 142