Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1
vote
2answers
178 views

Handling a GDPR subject access request when using google analytics?

When using Google Analytics and receiving a GDPR subject access request does the party receiving the request also have to send all data collected by Google Analytics?
1
vote
1answer
260 views

Do data privacy requirements apply to watch lists and sanctions lists?

There are different sanctions lists and watch lists all over the world maintained by governments & ministries, like well-known ones: OFAC lists, EU Consolidated Sanctions, CIA & FBI watch ...
1
vote
2answers
120 views

Can anonymized data be collected under GDPR without consent?

I am having an Android App in which I want to track the usage of the app. But the usage will not have anyone identity for eg. I would collect one user used my app for around 10 minutes but who is that ...
1
vote
1answer
404 views

GDPR - What's classed as an opt in for Google Analytics cookie and do I need to do it?

I'm wondering if anyone can shed any light on this for me please. I've been doing alot of research about GDPR lately and how it is going to effect my websites using Google Analytics. From what I can ...
1
vote
2answers
43 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
1
vote
1answer
72 views

Can the GDPR be used to ask free race photographs?

A lot of time pictures of participants are taken during a sports event. These are often sold afterwards for e.g. 10 euro each. Some people just share the watermarked image on social media. But my ...
1
vote
1answer
76 views

How can I get Twitter to delete my account?

I want to delete my old (7 years unused, never logged in) Twitter account. I lost the email to it, but it has my name so I would like to delete it. I wrote Twitter support twice and told them "This is ...
1
vote
2answers
75 views

Does creating an account or making a purchase apply consent for all marketing communications?

Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent. For example, I created an account using my email and hired a bike from ...
1
vote
1answer
137 views

What can i do if my GDPR requests are being ignored?

I have requested my personal data removal from one shady company that has gotten to my email somehow. They said they've complied, but i am still getting newsletters from them. What can i do as a ...
1
vote
1answer
62 views

Do I violate GDRP if install WhatsApp as a private user?

As far as I can understand, if I install WhatsApp, the app sends my contact list to the server. Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
1
vote
1answer
50 views

Can GDPR be used to reset an account?

I have an issue with AirBnb: My account is something like 7-8 years old and I didn't use it for 6+ year. I don't have the password anymore so I did a password reset, but it wants me to confirm my ...
1
vote
2answers
101 views

Does GDPR's physical address rule apply to my real world hobby art group?

I run an art group (in the UK) that meets up every other month to give feedback on each others' work. To share the meeting dates and to share the work we're giving feedback on that month, I have an ...
1
vote
1answer
76 views

Is it illegal to state in your website that an employee of a company emailed you?

I have an open source project regarding software used in banking and I have received emails about it from employees working in top banks/consultancies. I am considering to mention this in the website,...
1
vote
1answer
34 views

Copy of ID card: blacken / hide fields that are not relevant (Switzerland)

In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht. In article there is written that ...
1
vote
1answer
38 views

GDPR and collecting politician's social media posts

I am interested in collecting tweets and social media posts from politicians in the USA. Specifically from their political social media accounts. After reading this finextra article, I believe this ...
1
vote
2answers
124 views

If we anonymize Google Analytics IPs do we still need to ask for Cookie consent? [duplicate]

Trying to figure out the most light weight way to have Google Analytics on a site without having to ask for cookie consent. If we turn on IP Anonymization do we still need to ask for consent? If so ...
1
vote
1answer
26 views

Handling medical data received from outside the EU

If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU? In particular, does ...
1
vote
1answer
18 views

GDPR and date of fields creation / update

Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields : client_id name first_name and that I want to be GPDR Complient does I ...
1
vote
1answer
62 views

Does allowing users to see user tracking on my analytics software violate GDPR?

I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard: However, you can click on a user ID (right) like abaer and see ...
1
vote
1answer
49 views

Do you have to provide the name and email address of your data protection officer?

Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them: You can contact Valve's data protection officer at the address below. While we ...
1
vote
1answer
30 views

GDPR collecting vs storing

I have a website that stores no personal data, however it does use ($_SERVER['REMOTE_ADDR']), a code that scans the IP address of visitors, but the IP address isn't stored anywhere. It's only scanned ...
1
vote
1answer
51 views

The case of creating personal data by combining non-personal data

In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
1
vote
1answer
19 views

Is information only about financial transactions personally identifiable in terms of GDPR?

I am creating application where you can manage your incomes/expenses e.g. on eBay. Main functionality is: create new item and specify price you've payed to get it set price that you've All other ...
1
vote
1answer
115 views

In the EU, with GDPR in force, can a company refuse service if a customer doesn't want marketing emails?

I am having an argument with a local discount airline in the EU: They have been sending 3 up-sell emails for a single flight. Under GDPR, it is my right to revoke any consent to receive marketing ...
1
vote
1answer
65 views

Does a website owner (data controller) have to disclose its data processors in its privacy policy?

A website owner is data controller. Most website owners are using web hosting companies, i.e. data processors. Each website owner must have a GDPR compliant privacy policy. Must each website owner ...
1
vote
1answer
133 views

GDPR: Do I have to mention MailChimp in the privacy policy of a website if the registration form is only linked?

If I use MailChimp to send out newsletters and on my website I link to the registration form hosted on the MailChimp server, but don't embed it, do I need a MailChimp section in the privacy policy of ...
1
vote
1answer
329 views

What is “disclosure by transmission”?

Article 4(2) GDPR states: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as ...
1
vote
1answer
63 views

GDPR Article 13.4 - how do you know that the data subject already has the information?

Article 13.1 states: Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject ...
1
vote
1answer
75 views

Can background screening companies be forced to remove stored personal data under GDPR?

I understand that a background screening company requires a certain set of personal data to deliver a service. One typically consents for this data to be processed when completing associated paperwork....
1
vote
1answer
128 views

Facebook blocked my account until I consent to their new privacy policy under GDPR. If I consent now, will I be able to withdraw my consent later?

I am going to delete my Facebook account in a month, I can't do it now because I still use it for work. I live in the EU and Facebook has blocked access to my account unless I accept their privacy ...
1
vote
2answers
63 views

Description of 3rd party cookies in the privacy policy for GDPR compliance?

In order to comply with GDPR's right to be informed section, some sites try to describe what specific cookies that 3rd parties supply do. Is it OK to just list what cookies these parties set, and ...
1
vote
1answer
359 views

What's the difference between “GDPR” “Privacy Shield” and “Safe Harbor”?

I'm getting confused on the differences between "GDPR", "Privacy Shield", and "Safe Harbor". Can someone please elaborate? I think Privacy Shield replaces "Safe Harbor" but I still don't understand ...
1
vote
1answer
118 views

In GDPR, who exactly are the processors and what do they have to do?

I thought the processor was just someone who processes all personal data on behalf of the controller, basically a simple substitute for some matters. But from what I read online it seems that a ...
1
vote
1answer
62 views

European nexus into U.S. through Google product?

I'm in the U.S. with my websites. I'm not under European Union jurisdiction unless my use of one or another Google product puts me under EU jurisdiction. I need to find out if any Google product gives ...
1
vote
1answer
116 views

Does GDPR apply to announcement/technical emails?

I work on a SaaS website offering both free, and paid subscriptions to B2C customers. On it, I collect statistics, and emails(subscribed and double-opt-in users only) As far as newsletters and ...
1
vote
2answers
125 views

GDPR: what can I record about website visitors?

My use case is very simple. I have a website, on which I have articles that I wrote. It behooves me to learn about the people who visit my site so that I know what articles are popular and why, mainly....
1
vote
2answers
79 views

Can my user agreement require end users to indemnify me for misuse of their data by third-party services embedded in my app?

I have an Android App which is already in the Play Store. Now due to GDPR I am planning to improve my Privacy Policy and a Terms of service. I am planning to add certain terms in my Terms of service ...
1
vote
3answers
10k views

Will the GDPR apply to small hobby clubs?

When it comes into force, how will the General Data Protection Regulation affect small hobbyist organisations? Will it apply to, for example, student societies that are holding lists of email ...
1
vote
1answer
32 views

Can someone enlighten me about the main task of the independent supervision of data protection law

So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
1
vote
1answer
51 views

GDPR in a scientific, transborder scenario

Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole ...
1
vote
1answer
61 views

User-solicited personal information beyond consent

What does the GDPR say about personal information provided by a user about themselves, in the case that the service sign-up process and ToS have always asked of the users not to provide personal ...
1
vote
1answer
44 views

Is sending log data + customer name + location compatible with data privacy and GDPR?

I've written an updater program. Our customer downloads it to update our software with database. It would be helpful if we would know who has already updated our software. For this purpose I've added ...
1
vote
1answer
85 views

Cookie expiration time per GDPR guidelines

I am working on a task that requires to set cookie expiry date to Jan 2038. This cookie is used for showing personalized content to end user e.g. If user is on Home page and he clicks on Business ...
1
vote
1answer
32 views

Am I responsible of the personal data of a second degree user according to GDPR

Suppose we have an flight ticket booking system. As with many of these systems the account booking the ticket doesn't have to be the one using the ticket (i.e. you can book for someone else the ticket)...
1
vote
1answer
100 views

Can I use GDPR to read an Airbnb review about me before I post mine?

I just had a bad experience with Airbnb. The circumstances would be too long to describe and not relevant to my question. The fact is that I just have had an email that the host (I am the guest) let ...
1
vote
1answer
42 views

Google Analytics on mobile: possible to use without consent?

I saw this thread where it's possible to use Google Analytics without consent on websites: Is it really possible to use Google Analytics without consent, and if so, why exactly? My question is: does ...
1
vote
1answer
74 views

Store browser width / screen size and browser type without user consent?

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design ...
1
vote
1answer
44 views

Does the GDPR mandate that web sites provide access to cookie settings?

Cross referenced this question with SO just to get more technical perspective In this article it says with respect to: Google Analytics and GDPR consent to cookies and tracking: Based on a true ...
1
vote
1answer
59 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
1
vote
1answer
50 views

Users counting and GDPR

Do I need a GDPR "coockie" banner if I implement not a unique identifier but only a naive counter? My web app check a key presence in local storage. Key is the same for all. If it's not found - call /...