Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
3
votes
2answers
123 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
3
votes
1answer
126 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
3
votes
1answer
109 views

Are artificially generated personal data covered by the GDPR?

According to Article 2(1) GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be ...
3
votes
1answer
861 views

Can usage of Google Analytics (without consent) be considered a legitimate interest?

According to another answer here explicit consent is not required for Google Analytics, however I'd like to know why, as I am not a lawyer and my own interpretation is that GA use cannot be a "...
3
votes
2answers
731 views

Does keeping an MD5 hash of user data violate GDPR?

If a user requests to have their data deleted, would we still be permitted to keep hashes of user data for later use, even after the original data has been deleted?
3
votes
1answer
639 views

GDPR: Are Anticheat Logs personal data?

We are running an online game server and use an automated system to detect cheaters. When a cheater gets banned a log will be saved containing the names of the algorithms that detected the cheater. We ...
3
votes
2answers
469 views

Is the GDPR applicable to data stored in human memory?

If data is stored in human memory, is the GDPR applicable? Say, an employee of a company remembers an email address of a client, their date of birth, or even what their face looks like, does the ...
3
votes
1answer
59 views

GDPR - Is having a PDF with fields to fill out classed as data?

I have a website which has a link to a PDF form which users can print out and fill in. I'm wondering if somewhere I need to a statement in my privacy policy which justifies this?
3
votes
1answer
587 views

User consent required under GDPR

I am having an Android app which uses certain Analytics services such as Google Analytics, Firebase etc. These services collect certain information from the user. For this reason I have drafted a ...
3
votes
1answer
702 views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
3
votes
1answer
48 views

Extraterritorial Scope of Brazil's LGPD

How can a national legislation, like the recent Brazil's LGPD apply to companies which are not established in Brazil, but may offer services to Brazilian citizens via the Internet? Imagine a website (...
3
votes
1answer
29 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
3
votes
1answer
51 views

GDPR: Transfer (chapter V)

I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web ...
3
votes
2answers
60 views

GDPR - am I the processor if I don't host the website?

I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase ...
3
votes
1answer
70 views

Do I need user consent to respond to their email sent through my website's contact form?

I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message. I'm not storing any of the data in a database or in cookies. When the user ...
3
votes
1answer
142 views

Is it legal to have a opt-out of marketing emails checkbox under GDPR?

As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-...
3
votes
1answer
57 views

GDPR - How quick to honour unsubscribe?

Does GDPR or any other UK law specify the timeframe for removing someone from a mailing list? In our case the mailing list must be created up to 10 days before an automated email send over the ...
3
votes
1answer
202 views

GDPR and hotlinked images: are they allowed?

By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent: Your ...
3
votes
1answer
81 views

Private Website and copyright/GDPR

Similar questions have been asked before but I still could not find answers that made me understand it. I created a website and would like to know which laws affect me. The website does not have any ...
3
votes
1answer
192 views

Just how different is the legal situation in Germany under GDPR compared to previously with respect to running a website?

A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national ...
3
votes
1answer
91 views

GDPR and forums: “Lawfulness of processing” email addresses used only for providing the service

I run a small hobby message board that is entirely non-commercial. People need to provide an email address to register and use that for logging in. I do not use their email address for anything else (...
3
votes
1answer
238 views

Should email addresses be anonymized/pseudonymized under GDPR?

GDPR states recommendation to pseudonymise or even anonymise Personal Data. A lot — most of — web sites and services require email address on signup. Should, from the Data Controller's point of view, ...
3
votes
2answers
196 views

GDPR liability for Web Designer

I am a web designer that works with a range of clients on a project basis. I complete a project and then offer my services at any hourly rate for any other work required in the future. Do I have a ...
3
votes
1answer
289 views

What does 'Right to Erasure' actually cover?

According to GDPR, any person has 'Right to Erasure (Recital)' and have his/hers sensitive information deleted. Does that mean that an organization can keep all non-sensitive data for a user? For an ...
3
votes
1answer
343 views

GDPR vs. Credit Card Chargebacks

I work for a company where we take credit card payments for the services we provide. As per the Card Scheme rules, the cardholder can request a charge-back up to (in the case of Visa) 13 months after ...
3
votes
1answer
88 views

According to GDPR Article 30, do I maintain a continuous record or just a one-off?

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification. See: https://www.privacy-regulation.eu/en/30.htm It states that a data controller ...shall maintain a record of ...
3
votes
1answer
59 views

Cookie laws: Do I have to show a banner for technical cookies?

I am aware that technical cookies don't need consent, only marketing cookies need consent. However, if my site only uses functional cookies, do I still have to display a cookie banner that says what ...
3
votes
1answer
68 views

GDPR compliance for software that lets users store PII of other people

Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential ...
3
votes
1answer
79 views

How to fulfill the General Data Protection Regulation (GDPR) in science

Suppose, a scientist is planning to publish a paper that is about an algorithm which analyzes Wikipedia articles. I'm wondering, if the European General Data Protection Regulation would be relevant in ...
3
votes
2answers
2k views

What counts as material or non-material damage under the GDPR?

In Art. 82 GDPR: Right to compensation and liability it states: (1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the ...
3
votes
2answers
127 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
3
votes
3answers
1k views

GDPR: Citizens with Dual Nationality?

Do the GDPR Regulations apply to processing data of a citizen who has dual nationality?
3
votes
0answers
37 views

What is my responsibility related to GDPR as a Freelance developer

I'm a Software Engineer, and I've just taken my first "side gig" job in hopes of becoming Freelance one day. I'm based in the UK. My Client told me exactly what they want, and i've built it. ...
3
votes
0answers
60 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
3
votes
2answers
130 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
2
votes
1answer
237 views

Online Proctoring, Exams, and the GDPR?

Due to the coronavirus outbreak, my university has tentatively canceled all live forms of live education, including exams. Instead, they have decided to hold exams through an online proctoring ...
2
votes
1answer
873 views

Will storing hashed phone numbers violate GDPR?

I've read GDPR document from start to end, but I am still not sure about one thing. Let's say I have a system where I store phone numbers in hashed form (let's say bcrypt). Will this violate GDPR if ...
2
votes
3answers
127 views

What an employer can legally ask to monitor about user activity

I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's ...
2
votes
4answers
422 views

Is it possible to refuse offering service to GDPR-protected customers?

Let's say I have a service that asks registration details from the user and for some reason I, as a provider of that service, can't comply to GDPR and therefore want to refuse registration of new ...
2
votes
1answer
45 views

Is revision history (audit/change log) compliant with GDPR's right to rectification?

Assume, there's a model called CustomerDetails, which contains the following properties: ContactEmail - an email address for contacting purposes, ContactAddress - a postal address for contacting ...
2
votes
2answers
222 views

Company retained my card details after payment completed and suffered a breach. What are my options?

A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications. After the breach, when the company was ...
2
votes
2answers
57 views

Is accepting to receive emails as part of user terms legal in GDPR?

If I run a webshop selling DVDs, could I put in my user terms (that you have to accept to register) that I will be sending you emails about other movies on a regular interval. Would this qualify as ...
2
votes
1answer
40 views

GDPR/right of erasure and online marketplaces/payment platforms

I am in the early stages of designing an online marketplace platform for professional services. In the context of specifying what happens when a user hits the "delete account" button, I am considering ...
2
votes
1answer
494 views

Accidentally used “to” instead of using “bcc” while sending out email [GDPR violation]

I, as the admin of a small mailing group, used "to" field instead of "bcc" while sending an email to 10 people. One out of the 10 emails turned out to wrong, and of a lawyer, who pointed out that we ...
2
votes
2answers
87 views

Under GDPR, are service operators allowed to record all clicks of logged in users?

Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either: The user consents to having ...
2
votes
1answer
133 views

A website is refusing or failing to remove personal data I've requested removed: is this against GRPR?

I have been a member of a website for 13 years and would like all of my old posts removed. I have contacted their support team however the experience has been dreadful: it look a lot of back and ...
2
votes
1answer
59 views

Does GDPR affect personal projects with family data?

My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a ...
2
votes
2answers
187 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
2
votes
1answer
151 views

What is “a place where Member State law applies by virtue of public international law”?

Art. 3 (3) GDPR mentions that: This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of ...
2
votes
1answer
56 views

GDPR data portability when no data stored

My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have ...

1 2 3
4
5
11