Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
3
votes
2answers
147 views

GDPR liability for Web Designer

I am a web designer that works with a range of clients on a project basis. I complete a project and then offer my services at any hourly rate for any other work required in the future. Do I have a ...
3
votes
1answer
269 views

What does 'Right to Erasure' actually cover?

According to GDPR, any person has 'Right to Erasure (Recital)' and have his/hers sensitive information deleted. Does that mean that an organization can keep all non-sensitive data for a user? For an ...
3
votes
1answer
87 views

According to GDPR Article 30, do I maintain a continuous record or just a one-off?

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification. See: https://www.privacy-regulation.eu/en/30.htm It states that a data controller ...shall maintain a record of ...
3
votes
1answer
107 views

Under GDPR, why is google not considering the index entries as personal data?

I have a fairly unique name and never came across, online or otherwise, anyone with the same name and spelling. Following this, I make the assumption that this qualifies as personal data under GDPR ...
3
votes
1answer
62 views

GDPR compliance for software that lets users store PII of other people

Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential ...
3
votes
1answer
71 views

How to fulfill the General Data Protection Regulation (GDPR) in science

Suppose, a scientist is planning to publish a paper that is about an algorithm which analyzes Wikipedia articles. I'm wondering, if the European General Data Protection Regulation would be relevant in ...
3
votes
2answers
1k views

What counts as material or non-material damage under the GDPR?

In Art. 82 GDPR: Right to compensation and liability it states: (1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the ...
3
votes
2answers
119 views

What provisions should I make regarding GDPR consent when users do not sign themselves up?

In my business, users are signed up by staff, according to user lists (name, email address only) provided by our clients. We track user interactions with our site in order to monitor usage and ...
3
votes
3answers
1k views

GDPR: Citizens with Dual Nationality?

Do the GDPR Regulations apply to processing data of a citizen who has dual nationality?
3
votes
2answers
94 views

In which jurisdictions outside the EU can the GDPR be enforced?

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens. Now of course, the EU's jurisdiction is not global, but the EU does have treaties ...
3
votes
2answers
104 views

Whats the consumer's rights when an online account has been breached?

I have an online account with the Company "A". On that account my PayPal account is linked. A few days ago I received a text from my Bank that my bank account has been charged ( The amount was not ...
2
votes
3answers
114 views

What an employer can legally ask to monitor about user activity

I work for a Belgian company as systems engineer, and I'm asked by the HR department to give them logs of a specific user's activity. This is about a concern they have when it comes to this user's ...
2
votes
4answers
342 views

Is it possible to refuse offering service to GDPR-protected customers?

Let's say I have a service that asks registration details from the user and for some reason I, as a provider of that service, can't comply to GDPR and therefore want to refuse registration of new ...
2
votes
4answers
186 views

GDPR - Is consent really necessary for contact form?

I am looking for an answer that is supported by the GDPR, so please try to quote GDPR parts as you answer. The internet is on fire (developers especially) now that the GDPR is on strength. There are ...
2
votes
2answers
218 views

Company retained my card details after payment completed and suffered a breach. What are my options?

A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications. After the breach, when the company was ...
2
votes
2answers
55 views

Is accepting to receive emails as part of user terms legal in GDPR?

If I run a webshop selling DVDs, could I put in my user terms (that you have to accept to register) that I will be sending you emails about other movies on a regular interval. Would this qualify as ...
2
votes
2answers
61 views

Under GDPR, are service operators allowed to record all clicks of logged in users?

Under GDPR, service operators (e.g. people who run websites or web apps where users login in a browser) are not allowed to collect information about users unless either: The user consents to having ...
2
votes
2answers
121 views

GitHub pages and GDPR - controller, processor and DPA

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain. The only potentially personal data that the site will ...
2
votes
1answer
37 views

Does GDPR affect personal projects with family data?

My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a ...
2
votes
2answers
111 views

Proof of Consent under GDPR, HOW TO?

One of GDPR Lawful Bases for Processing Personal Data (and that means Collect; Access; Store; Process and Share) is Consent. Companies must have documented proof of Consent as per defined under GDPR ...
2
votes
1answer
65 views

What is “a place where Member State law applies by virtue of public international law”?

Art. 3 (3) GDPR mentions that: This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of ...
2
votes
1answer
51 views

GDPR data portability when no data stored

My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have ...
2
votes
1answer
72 views

Is it a violation of GDPR law to email personnel gathered from hunter.io?

I'm a web developer working on a project for a client. The project is a directory of sustainable companies (enviromental-friendly companies). The project is only launching now. The companies listed ...
2
votes
1answer
60 views

GDPR Requiring consent to give up privacy

A website that I visited posted the following: “YOUR PRIVACY IS IMPORTANT TO US. New regulations in your country require you to agree to our terms of use agreement and privacy policy before you can ...
2
votes
2answers
569 views

Do I have the right to ask Github to hide my Contribution activity according to General Data Protection Regulation (GDPR)

Do I have the right to ask Github to hide my "Contribution activity" on my public profile page?
2
votes
2answers
358 views

GDPR privacy policy - Data controller vs Data processor

I'm wondering if someone can shed some light on this for me please and help distinguish the differences between what I need to mention In my privacy policy for a data controller and data processor. ...
2
votes
1answer
3k views

Under the GDPR, should transaction data be deleted on account deletion or on user request?

Given the EU GDPR "right to be forgotten" when the user of an eCommerce website deletes their account, or requests, should the data related to their purchases be deleted? Or if the user can buy ...
2
votes
2answers
68 views

When is pseudonymization insufficient in terms of GDPR compliance when storing and processing data for research purposes?

I am working on a project where data needs to be stored and kept for further processing. It's primarily for research purposes. I know that in order to be GDPR compliant, this data has to be anonymized....
2
votes
1answer
100 views

Under GDPR EU law, can I sue big tech companies (Facebook, Google, Apple) for acquiring and storing my personal data without my consent?

Many of my friends have social media accounts (Instagram, Facebook, etc.) where they regularly post photos of them and where occasionally I appear in them. Many of my friends have their personal ...
2
votes
1answer
71 views

Can liability for data disclosure be waived by T&Cs under GDPR?

I live in Ireland, an EU county subject to the GDPR. I see in a service T&Cs the line: "Despite our use of commercially reasonable efforts to protect your Personal Information from ...
2
votes
2answers
59 views

Is it allowed to collect additional personal data to comply with the information obligation (Article 14 GDPR)?

True story. A bank erroneously sends its clients' data to a company: name, surname, national identification number. The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and ...
2
votes
1answer
84 views

Can DPO do an internal audit of information security according to ISO 27001?

In one company, due to GDPR, a DPO was designated, who was later given additional role and a new task: to conduct an internal audit of information security according to ISO 27001. Is there a conflict ...
2
votes
1answer
110 views

Can't GDPR compliance be trivially bypassed?

For large tech firms such as Facebook, at least, wouldn't it be a trivial matter for these companies to avoid EU GDPR compliance altogether? Many big companies don't actually "sell" any tangible ...
2
votes
1answer
103 views

Does my Personal Web App need to comply to GDPR?

I am building an app where I have some concerns about GDPR and user data. First of all this is a personal app, no company behind. What the app does: Allows a user to authenticate via e.g. ...
2
votes
1answer
62 views

Can a user request the deletion of their IP address that is stored for moderation purposes?

An Internet forum logs their users' IP addresses for moderation purposes (fighting abusive sockpuppetry, temporary banning a dynamic IP address range in case of a spam attack, permanently banning ...
2
votes
1answer
320 views

Cookie compliance with GDPR when cookies don't collect the PII?

We are using Google Analytics and Facebook Login button (Which comes with preset Facebook Analytics). So here is the question with Google Analytics we are not assigning users with GA UserID and IP ...
2
votes
1answer
86 views

GDPR, email lists, a few email subscribers in the EU

Situation: Say you are an organization that regularly sends out e-newsletter updates to an email list that has been curated over the years by people signing up at events and/or through online sign-up ...
2
votes
1answer
76 views

Using Personal data before consent

I am having an Android App which is going to use some services such as Google Analytics, Firebase etc. I have a thought of having two different consent screens for different region user such as EU ...
2
votes
1answer
69 views

GDPR and online forms: how to prove that the data owner opted in?

How can the data processor who collect personal information using an online form prove that the person who entered her data gave active consent, for instance by clicking a checkmark? Imagine a a ...
2
votes
1answer
44 views

Data processing locations post-Brexit

I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients. I have several UK-based clients, all ...
2
votes
1answer
43 views

Can you request your personal data from a government agency under GDPR?

Can you address a request to a government agency (let's say for example the French "Ministry of education") to access the data they store about you under GDPR ? Does GDPR requirements apply to states ...
2
votes
1answer
54 views

Legal sending personal information to a third party if the user supplied incorrect contact information?

To clarify the title, here is an example: Alice wants to sign up to online store Nile.com Alice enters the email bob@mailprovider.com by accident Nile.com does not send a verification that Alice has ...
2
votes
1answer
56 views

GDPR Requirements for restricted use corporate webapp [closed]

The GDPR is very complicated, and while its requirements may be crystal clear to those who are intimately familiar with it, it is not at all clear to most as to what the exact requirements are in all ...
2
votes
1answer
72 views

Do Bitcoin nodes need consent to store EU citizen's personal data?

The Bitcoin blockchain stores data about bitcoin users. This includes: There bitcoin address, which is linkable to their identity via blockchain analysis Transactions they have made This would seem ...
2
votes
1answer
103 views

My email has been shared with other parties

I am in the process of searching for a new job and I have applied for a few. Today I received an email from HR representative of one of the companies saying that I was not called for an interview ...
2
votes
1answer
48 views

GDPR and Storing Non-EU Citizen Data as an EU-based company

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
2
votes
1answer
130 views

GDPR - What exactly should I do to prevent revenue loss?

I've seen many sites blocking cookies right away and expecting users to click the "Accept cookies" button to activate them. But then I came to stack exchange to ask this question and there's a note on ...
2
votes
2answers
51 views

GDPR and two-party communications

If a chat or email provider wishes to analyze the contents of what their customers are writing, does GDPR require it to obtain the consent of everyone involved in the chat/email? Or would the consent ...
2
votes
1answer
95 views

Advice sought regarding GDPR and managing sensitive data

We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server. There are files that are ...
2
votes
1answer
51 views

GDPR: Applied Security vs Employee Contracts

An Organisation has 10,000 employees. All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation. Only 200 employees require access to the PII data for the ...