Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
3
votes
1answer
51 views

GDPR: Transfer (chapter V)

I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web ...
3
votes
2answers
48 views

GDPR - am I the processor if I don't host the website?

I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase ...
3
votes
1answer
67 views

Do I need user consent to respond to their email sent through my website's contact form?

I have a contact form on my website which collects the follow four fields: Full name, email address, subject, message. I'm not storing any of the data in a database or in cookies. When the user ...
3
votes
1answer
128 views

Is it legal to have a opt-out of marketing emails checkbox under GDPR?

As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-...
3
votes
1answer
54 views

GDPR - How quick to honour unsubscribe?

Does GDPR or any other UK law specify the timeframe for removing someone from a mailing list? In our case the mailing list must be created up to 10 days before an automated email send over the ...
3
votes
1answer
186 views

GDPR and hotlinked images: are they allowed?

By opening this question, you have automatically sent some data to some random website on the internet, the website hosting the above picture. What data? This is the data that is usually sent: Your ...
3
votes
1answer
75 views

Private Website and copyright/GDPR

Similar questions have been asked before but I still could not find answers that made me understand it. I created a website and would like to know which laws affect me. The website does not have any ...
3
votes
1answer
177 views

Just how different is the legal situation in Germany under GDPR compared to previously with respect to running a website?

A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national ...
3
votes
1answer
83 views

GDPR and forums: “Lawfulness of processing” email addresses used only for providing the service

I run a small hobby message board that is entirely non-commercial. People need to provide an email address to register and use that for logging in. I do not use their email address for anything else (...
3
votes
1answer
218 views

Should email addresses be anonymized/pseudonymized under GDPR?

GDPR states recommendation to pseudonymise or even anonymise Personal Data. A lot — most of — web sites and services require email address on signup. Should, from the Data Controller's point of view, ...
3
votes
2answers
178 views

GDPR liability for Web Designer

I am a web designer that works with a range of clients on a project basis. I complete a project and then offer my services at any hourly rate for any other work required in the future. Do I have a ...
3
votes
1answer
286 views

What does 'Right to Erasure' actually cover?

According to GDPR, any person has 'Right to Erasure (Recital)' and have his/hers sensitive information deleted. Does that mean that an organization can keep all non-sensitive data for a user? For an ...
3
votes
1answer
332 views

GDPR vs. Credit Card Chargebacks

I work for a company where we take credit card payments for the services we provide. As per the Card Scheme rules, the cardholder can request a charge-back up to (in the case of Visa) 13 months after ...
3
votes
1answer
88 views

According to GDPR Article 30, do I maintain a continuous record or just a one-off?

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification. See: https://www.privacy-regulation.eu/en/30.htm It states that a data controller ...shall maintain a record of ...
3
votes
1answer
62 views

GDPR compliance for software that lets users store PII of other people

Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential ...
3
votes
1answer
78 views

How to fulfill the General Data Protection Regulation (GDPR) in science

Suppose, a scientist is planning to publish a paper that is about an algorithm which analyzes Wikipedia articles. I'm wondering, if the European General Data Protection Regulation would be relevant in ...
3
votes
2answers
1k views

What counts as material or non-material damage under the GDPR?

In Art. 82 GDPR: Right to compensation and liability it states: (1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the ...
3
votes
2answers
126 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
3
votes
3answers
1k views

GDPR: Citizens with Dual Nationality?

Do the GDPR Regulations apply to processing data of a citizen who has dual nationality?
3
votes
0answers
59 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
3
votes
2answers
119 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
2
votes
1answer
80 views

Online Proctoring, Exams, and the GDPR?

Due to the coronavirus outbreak, my university has tentatively canceled all live forms of live education, including exams. Instead, they have decided to hold exams through an online proctoring ...
2
votes
1answer
792 views

Will storing hashed phone numbers violate GDPR?

I've read GDPR document from start to end, but I am still not sure about one thing. Let's say I have a system where I store phone numbers in hashed form (let's say bcrypt). Will this violate GDPR if ...
2
votes
3answers
123 views

What an employer can legally ask to monitor about user activity

I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's ...
2
votes
4answers
393 views

Is it possible to refuse offering service to GDPR-protected customers?

Let's say I have a service that asks registration details from the user and for some reason I, as a provider of that service, can't comply to GDPR and therefore want to refuse registration of new ...
2
votes
2answers
222 views

Company retained my card details after payment completed and suffered a breach. What are my options?

A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications. After the breach, when the company was ...
2
votes
2answers
57 views

Is accepting to receive emails as part of user terms legal in GDPR?

If I run a webshop selling DVDs, could I put in my user terms (that you have to accept to register) that I will be sending you emails about other movies on a regular interval. Would this qualify as ...
2
votes
1answer
182 views

Accidentally used “to” instead of using “bcc” while sending out email [GDPR violation]

I, as the admin of a small mailing group, used "to" field instead of "bcc" while sending an email to 10 people. One out of the 10 emails turned out to wrong, and of a lawyer, who pointed out that we ...
2
votes
2answers
84 views

Under GDPR, are service operators allowed to record all clicks of logged in users?

Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either: The user consents to having ...
2
votes
2answers
197 views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
2
votes
1answer
133 views

A website is refusing or failing to remove personal data I've requested removed: is this against GRPR?

I have been a member of a website for 13 years and would like all of my old posts removed. I have contacted their support team however the experience has been dreadful: it look a lot of back and ...
2
votes
1answer
51 views

Does GDPR affect personal projects with family data?

My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a ...
2
votes
2answers
154 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
2
votes
1answer
128 views

What is “a place where Member State law applies by virtue of public international law”?

Art. 3 (3) GDPR mentions that: This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of ...
2
votes
1answer
55 views

GDPR data portability when no data stored

My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have ...
2
votes
1answer
111 views

Is it a violation of GDPR law to email personnel gathered from hunter.io?

I'm a web developer working on a project for a client. The project is a directory of sustainable companies (enviromental-friendly companies). The project is only launching now. The companies listed ...
2
votes
1answer
64 views

GDPR Requiring consent to give up privacy

A website that I visited posted the following: “YOUR PRIVACY IS IMPORTANT TO US. New regulations in your country require you to agree to our terms of use agreement and privacy policy before you can ...
2
votes
2answers
900 views

Do I have the right to ask Github to hide my Contribution activity according to General Data Protection Regulation (GDPR)

Do I have the right to ask Github to hide my "Contribution activity" on my public profile page?
2
votes
2answers
436 views

GDPR privacy policy - Data controller vs Data processor

I'm wondering if someone can shed some light on this for me please and help distinguish the differences between what I need to mention In my privacy policy for a data controller and data processor. ...
2
votes
1answer
4k views

Under the GDPR, should transaction data be deleted on account deletion or on user request?

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted? Or if the user can buy ...
2
votes
2answers
174 views

Is the UUID considered personal data?

I am planning to build a mobile platform which I would use the UUID as the username, and a password of user’s choice. So that users would just need to type a chosen password to use my services. ...
2
votes
2answers
93 views

When is pseudonymization insufficient in terms of GDPR compliance when storing and processing data for research purposes?

I am working on a project where data needs to be stored and kept for further processing. It's primarily for research purposes. I know that in order to be GDPR compliant, this data has to be anonymized....
2
votes
1answer
108 views

Under GDPR EU law, can I sue big tech companies (Facebook, Google, Apple) for acquiring and storing my personal data without my consent?

Many of my friends have social media accounts (Instagram, Facebook, etc.) where they regularly post photos of them and where occasionally I appear in them. Many of my friends have their personal ...
2
votes
1answer
74 views

Can liability for data disclosure be waived by T&Cs under GDPR?

I live in Ireland, an EU county subject to the GDPR. I see in a service T&Cs the line: "Despite our use of commercially reasonable efforts to protect your Personal Information from ...
2
votes
2answers
242 views

If we anonymize Google Analytics IPs do we still need to ask for Cookie consent? [duplicate]

Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent? If so ...
2
votes
2answers
64 views

Is it allowed to collect additional personal data to comply with the information obligation (Article 14 GDPR)?

True story. A bank erroneously sends its clients' data to a company: name, surname, national identification number. The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and ...
2
votes
1answer
116 views

Can DPO do an internal audit of information security according to ISO 27001?

In one company, due to GDPR, a DPO was designated, who was later given additional role and a new task: to conduct an internal audit of information security according to ISO 27001. Is there a conflict ...
2
votes
1answer
114 views

Can't GDPR compliance be trivially bypassed?

For large tech firms such as Facebook, at least, wouldn't it be a trivial matter for these companies to avoid EU GDPR compliance altogether? Many big companies don't actually "sell" any tangible ...
2
votes
1answer
197 views

Does my Personal Web App need to comply to GDPR?

I am building an app where I have some concerns about GDPR and user data. First of all this is a personal app, no company behind. What the app does: Allows a user to authenticate via e.g. ...
2
votes
1answer
75 views

Can a user request the deletion of their IP address that is stored for moderation purposes?

An Internet forum logs their users' IP addresses for moderation purposes (fighting abusive sockpuppetry, temporary banning a dynamic IP address range in case of a spam attack, permanently banning ...

1 2 3
4
5
10