Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1
vote
1answer
60 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
1
vote
1answer
50 views

Users counting and GDPR

Do I need a GDPR "coockie" banner if I implement not a unique identifier but only a naive counter? My web app check a key presence in local storage. Key is the same for all. If it's not found - call /...
1
vote
2answers
131 views

Is it legal to ignore “Do Not Track” for data subjects who fall under the GDPR?

The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different ...
1
vote
1answer
60 views

Do I need an active consent according to GDPR? [duplicate]

If I have a form on a website where people fill in their personal details and credit card information to subscribe to a monthly delivery of apples, do I need an active consent (e.g. checkbox) from the ...
1
vote
1answer
28 views

Responsible GDPR data protection authority (DPA) responsible for non-EU companies?

Article 15 EU GDPR is often cited as basis of what needs to be included in privacy policy. The data subject shall have the right to obtain from the controller confirmation as to whether or not ...
1
vote
1answer
28 views

Can a data subject be asked to share a limited part of their data if it would be in their interest to do so?

I am an adviser for a UK agency that provides free advice to the public. I have two employment cases that differ in detail, but are fundamentally the same issues and involve the same company. It could ...
1
vote
1answer
89 views

GDPR: How to respond to clinicians who ask for subject access requests for results to be made in writing

During a hospital stay, when requesting a copy of blood test results from doctors or nurses, unfortunately patients are often met with the response "Your request must be made in writing and must be ...
1
vote
1answer
63 views

Can GDPR violations lead to piercing of the corporate veil?

Does GDPR have any clauses that hint at piercing of the corporate veil? Can GDPR violations lead to piercing of the corporate veil?
1
vote
1answer
49 views

Fee for Subject Access Request to GCHQ, Data Protection Act 2018

When making a Subject Access Request to GCHQ I was told that I would have to pay a fee for this Request. The GDPR does not allow for such a fee, while the UK Data Protection Act does(Part 4 – Chapter ...
1
vote
1answer
119 views

Does the process of anonymizing web server logs count as 'Processing' under GDPR?

As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. I am looking to implement a log anonymization ...
1
vote
2answers
88 views

Deliberately inaccurate data

The GDPR seem to assume that the client would want us to maintain accurate data. Article 5(1)(d) makes it clear we have to correct inaccurate data. But I deliver pizzas for a big chain, and I ...
1
vote
1answer
112 views

Does the GDPR law apply to my hobby-site?

I'm the owner of a website that maintains statistics about crew-members of an other site. The statistics about the crew-members are as follows: Username (on that other website) User ID (on that other ...
1
vote
2answers
204 views

GDPR: if a user doesn't agree cookies on my banner, what must I do?

if a guest of my site click on "Not agree" on cookie banner, what must I do? Have I to disable all the cookies? Have I to disable all the cookies except technical cookies (eg. login session cookies)? ...
1
vote
1answer
50 views

Crawling a web forum and presenting the posts in a search

Is what this site is doing with steam community legal? https://www.steamtrades.com/ I assume that is a grey area, no? So what are the factors that would make it legal or not? I assume one should not ...
1
vote
1answer
143 views

Is it reasonable to ask me to change my email address after it was leaked?

My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later ...
1
vote
1answer
234 views

What is exactly a joint controller in GDPR? Examples

I am not sure I really understand the concept of "joint controllers" in GDPR, and I'd like to have some concrete examples, especially examples of joint controllers relating to the internet (websites, ...
1
vote
1answer
38 views

Who is the Controller and who is the Processor if Company X hosts/embeds content of Company Y

Let's say we have two companies "WeServe" and "OurContent" and the following relationships, who is the Controller and who is the Processor or are they Joint Controllers (Art. 26 GDPR) or is there ...
1
vote
1answer
83 views

How to fulfill the General Data Protection Regulation (GDPR) when receiving emails

Suppose, a scientist is planning to publish a paper, and his email address will be printed on it. I'm wondering, if the European General Data Protection Regulation would be relevant in that case. ...
1
vote
1answer
196 views

Is it legal for me to use publicly accessible user data about a person on my website?

I run a wiki service and I was wondering if someone doxes an anonymous person in the from of a dump (pastebin, screenshots, recordings etc), can we keep that data or perhaps cite it? For instance if ...
1
vote
1answer
360 views

google analytics cookie consent with anonymized ip on

I am not even sure how is this possible, so here I am. I have google analytics with anonymized IP on, my users can activate and deactivate google analytics cookies at any time. BUT, on top of that, ...
1
vote
2answers
518 views

What does “monitor the behavior of individuals in the EU” mean?

https://www.truevault.com/blog/do-i-need-to-be-gdpr-compliant.html GDPR was created by the European Union to protect its citizens, and so it only affects organizations with some kind of ...
1
vote
1answer
96 views

Allow people to communicate on an international religious non-commercial website without getting into trouble with GDPR

This question seems related to this one. The new European "GDPR" ("General Data Protection Regulation") laws are confusing to me. One can read everywhere that these will apply everywhere, not only ...
1
vote
2answers
660 views

Are Phone Number lists with no other personal data allowed under GDPR?

Given a phone number list stored in a format such as this: 02321 203201, 203120 023102, etc. Would this be classed as personally identifiable information under the new GDPR regulations or as there ...
1
vote
2answers
75 views

Is it possible, under the GDPR, to request publicly available information to be taken down from an aggregator?

In Sweden, there are many services available that collect publicly available personal information (such as telephone numbers, addresses, social security numbers, income, mortgages, registered cars) ...
1
vote
1answer
53 views

GDPR - If am am allowing user to post on twitter and Facebook from my IOS app?

If am allowing user to post on twitter and Facebook from my IOS app, Do I have to get user consent ? If yes what do I have to mention in user consent ?
1
vote
1answer
394 views

GDPR - Offshoring

We work for consulting company in India, call it Z. Z has a partnership with a European cards & transactions processing company Y. So the Indian consulting company Z does offshore production ...
1
vote
0answers
33 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
1
vote
1answer
75 views

does the GDPR apply to publicly available data?

There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little ...
1
vote
0answers
46 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
1
vote
0answers
58 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
1
vote
0answers
55 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
1
vote
0answers
45 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
1
vote
0answers
64 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
1
vote
1answer
54 views

GDPR article 20, portability of future data

Article 20.2 of the GDPR states: "In exercising his or her right to data portability [...], the data subject shall have the right to have the personal data transmitted directly from one controller to ...
1
vote
0answers
201 views

GDPR: How does Airbnb get away with their signup form?

We're looking at making our signup form GDPR friendly along with sending users more timely, personalised marketing and account update emails. Asking if a user wants to receive all these different ...
1
vote
1answer
71 views

Processing of genetic data: which are the required “technical and organisational measures”?

Several articles of the Regulation require to apply the “appropriate technical and organisational measures” or “appropriate safeguards” in order to ensure the security of data. While GDPR ...
1
vote
1answer
127 views

GDPR - Recording simple page views

We are currently using google analytics to track our site. The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the ...
1
vote
0answers
51 views

Derogation for small companies in GDPR

Question What does Recital 13 in GDPR make exempt? refers to Article 30 on the technical definition on record keeping. But I am interested in another aspect of this sentence: To take account of ...
1
vote
1answer
179 views

GDPR Compliance - Tell EU users not to sign up

I have a client that wants to approach GDPR compliance by simply putting a notice on his subscription forms along the lines of "Don't sign up, Europeans" From what I gather about GDPR compliance, I'm ...
1
vote
1answer
362 views

GDPR and Query String Variables

I have a project where a customised email is sent out to clients and there is a link that takes them to a landing page, with a form, that currently gets populated by way of query string variables e.g. ...
1
vote
0answers
62 views

Russian bank calling Russian citizen who is tourist in EU - GDPR issues

Let's say I'm Russian citizen (no dual citizenship) and on a tourist visa in the EU. I got a call on my roaming Russian mobile phone number from a Russian bank who tries to offer me a new product. I'm ...
1
vote
0answers
311 views

Offering GDPR privacy policy for voice mail?

Voice mail recordings can be "personal data" according to the GDPR (i.e., if the caller’s telephone number belongs to a natural person, and/or if the message contains personal data), so a privacy ...
1
vote
0answers
172 views

Under GDPR Data Processing Officer's email address bounces - what to do?

In 2007 (>11 years ago) I registered for an (otherwise legitimate) business SMS newsletter. Now, when GDPR is live I wanted to use my rights to finally stop them sending me these texts. So I had sent ...
1
vote
1answer
209 views

Is it still legal to include an invitation based service in a program after GDPR?

I just started a cross-platform mobile application within users could invite other people to join as new users. The invitation would require the existing user to enter the new user's name (not ...
1
vote
1answer
369 views

Parent company GDPR compliance

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
1
vote
0answers
177 views

Can a developer have access to live data within GDPR?

Segregation of Duties in IT I remember the Sarbanes Oxley (SOX) compliance rush for 10 years ago with the Segregation of Duties. I am looking for the equivalent regulation in GDPR. I find article 25 "...
1
vote
0answers
495 views

Is disclosure of subprocessors absolutely necessary under the GDPR?

Under the GDPR regulations, is there a way of avoiding the need to disclose the full names and details of subprocessors? Must I absolutely declare this information in the appropriate manner or can I ...
1
vote
0answers
70 views

Are data processors allowed to locally store live customer information for testing GDPR

We develop software for another company and use their live data to test our applications locally before they go live. This means we keep live customer information on office computers. Will this be ...
1
vote
1answer
97 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
1
vote
2answers
126 views

Is GDPR really needed if my android app doesn't collect any personal data?

I have developed some Android applications, and they don't store any personal data, but they do some calculation about some input, for example the annual salary provided by user and return to him a ...