Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1
vote
1answer
84 views

Is it possible to create data subject to the GDPR without any involvement by the person in question?

Say I email a colleague, in a professional capacity: I have been thinking about offering John Smith, who currently works at Big Corp, a job John Smith has had no involvement with my organisation. ...
1
vote
1answer
89 views

GDPR dilemma: Does a full name contained in a URL constitute PII as stated by Google Analytics?

But wait, it gets better: This full name belongs to person who was interviewed in an article under this URL. https://support.google.com/analytics/answer/7686480?hl=en What Google considers PII: ......
1
vote
2answers
51 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
1
vote
1answer
83 views

Can the GDPR be used to ask free race photographs?

A lot of time pictures of participants are taken during a sports event. These are often sold afterwards for e.g. 10 euro each. Some people just share the watermarked image on social media. But my ...
1
vote
1answer
135 views

How can I get Twitter to delete my account?

I want to delete my old (7 years unused, never logged in) Twitter account. I lost the email to it, but it has my name so I would like to delete it. I wrote Twitter support twice and told them "This is ...
1
vote
2answers
81 views

Does creating an account or making a purchase apply consent for all marketing communications?

Many companies I have registered with or interacted with sign me up to their email newsletters without my providing my consent. For example, I created an account using my email and hired a bike from ...
1
vote
1answer
143 views

What can i do if my GDPR requests are being ignored?

I have requested my personal data removal from one shady company that has gotten to my email somehow. They said they've complied, but i am still getting newsletters from them. What can i do as a ...
1
vote
1answer
67 views

Do I violate GDRP if install WhatsApp as a private user?

As far as I can understand, if I install WhatsApp, the app sends my contact list to the server. Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
1
vote
1answer
59 views

Can GDPR be used to reset an account?

I have an issue with AirBnb: My account is something like 7-8 years old and I didn't use it for 6+ year. I don't have the password anymore so I did a password reset, but it wants me to confirm my ...
1
vote
2answers
117 views

Does GDPR's physical address rule apply to my real world hobby art group?

I run an art group (in the UK) that meets up every other month to give feedback on each others' work. To share the meeting dates and to share the work we're giving feedback on that month, I have an ...
1
vote
1answer
79 views

Is it illegal to state in your website that an employee of a company emailed you?

I have an open source project regarding software used in banking and I have received emails about it from employees working in top banks/consultancies. I am considering to mention this in the website,...
1
vote
1answer
73 views

Copy of ID card: blacken / hide fields that are not relevant (Switzerland)

In recent c't there is an article about GDPR (Sorry for the German). In Switzerland there is so far no GDPR, but we have a similar mechanism called Auskunftsrecht. In article there is written that ...
1
vote
1answer
40 views

GDPR and collecting politician's social media posts

I am interested in collecting tweets and social media posts from politicians in the USA. Specifically from their political social media accounts. After reading this finextra article, I believe this ...
1
vote
1answer
27 views

Handling medical data received from outside the EU

If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU? In particular, does ...
1
vote
1answer
18 views

GDPR and date of fields creation / update

Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields : client_id name first_name and that I want to be GPDR Complient does I ...
1
vote
1answer
73 views

Does allowing users to see user tracking on my analytics software violate GDPR?

I'm not really sure what to title this question, but I've built an analytics software, Paperclip, and this is the dashboard: However, you can click on a user ID (right) like abaer and see ...
1
vote
1answer
33 views

GDPR collecting vs storing

I have a website that stores no personal data, however it does use ($_SERVER['REMOTE_ADDR']), a code that scans the IP address of visitors, but the IP address isn't stored anywhere. It's only scanned ...
1
vote
1answer
66 views

The case of creating personal data by combining non-personal data

In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
1
vote
1answer
19 views

Is information only about financial transactions personally identifiable in terms of GDPR?

I am creating application where you can manage your incomes/expenses e.g. on eBay. Main functionality is: create new item and specify price you've payed to get it set price that you've All other ...
1
vote
1answer
183 views

In the EU, with GDPR in force, can a company refuse service if a customer doesn't want marketing emails?

I am having an argument with a local discount airline in the EU: They have been sending 3 up-sell emails for a single flight. Under GDPR, it is my right to revoke any consent to receive marketing ...
1
vote
1answer
95 views

Does a website owner (data controller) have to disclose its data processors in its privacy policy?

A website owner is data controller. Most website owners are using web hosting companies, i.e. data processors. Each website owner must have a GDPR compliant privacy policy. Must each website owner ...
1
vote
1answer
161 views

GDPR: Do I have to mention MailChimp in the privacy policy of a website if the registration form is only linked?

If I use MailChimp to send out newsletters and on my website I link to the registration form hosted on the MailChimp server, but don't embed it, do I need a MailChimp section in the privacy policy of ...
1
vote
1answer
486 views

What is “disclosure by transmission”?

Article 4(2) GDPR states: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as ...
1
vote
1answer
82 views

GDPR Article 13.4 - how do you know that the data subject already has the information?

Article 13.1 states: Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject ...
1
vote
1answer
1k views

GDPR: cookie for login management

I use cookie in my site for login management. I user logs in the cookie dies with the session, if user flags "Keep me logged in" when logging in a long time cookie persists. In the long time cookie I ...
1
vote
1answer
77 views

Can background screening companies be forced to remove stored personal data under GDPR?

I understand that a background screening company requires a certain set of personal data to deliver a service. One typically consents for this data to be processed when completing associated paperwork....
1
vote
2answers
67 views

Description of 3rd party cookies in the privacy policy for GDPR compliance?

In order to comply with GDPR's right to be informed section, some sites try to describe what specific cookies that 3rd parties supply do. Is it OK to just list what cookies these parties set, and ...
1
vote
1answer
517 views

What's the difference between “GDPR” “Privacy Shield” and “Safe Harbor”?

I'm getting confused on the differences between "GDPR", "Privacy Shield", and "Safe Harbor". Can someone please elaborate? I think Privacy Shield replaces "Safe Harbor" but I still don't understand ...
1
vote
1answer
129 views

In GDPR, who exactly are the processors and what do they have to do?

I thought the processor was just someone who processes all personal data on behalf of the controller, basically a simple substitute for some matters. But from what I read online it seems that a ...
1
vote
1answer
63 views

European nexus into U.S. through Google product?

I'm in the U.S. with my websites. I'm not under European Union jurisdiction unless my use of one or another Google product puts me under EU jurisdiction. I need to find out if any Google product gives ...
1
vote
1answer
140 views

Does GDPR apply to announcement/technical emails?

I work on a SaaS website offering both free, and paid subscriptions to B2C customers. On it, I collect statistics, and emails(subscribed and double-opt-in users only) As far as newsletters and ...
1
vote
2answers
129 views

GDPR: what can I record about website visitors?

My use case is very simple. I have a website, on which I have articles that I wrote. It behooves me to learn about the people who visit my site so that I know what articles are popular and why, mainly....
1
vote
2answers
86 views

Can my user agreement require end users to indemnify me for misuse of their data by third-party services embedded in my app?

I have an Android App which is already in the Play Store. Now due to GDPR I am planning to improve my Privacy Policy and a Terms of service. I am planning to add certain terms in my Terms of service ...
1
vote
3answers
11k views

Will the GDPR apply to small hobby clubs?

When it comes into force, how will the General Data Protection Regulation affect small hobbyist organisations? Will it apply to, for example, student societies that are holding lists of email ...
1
vote
1answer
58 views

GDPR - Personal data

I've read the definition of "personal data" and I still can't understand it clearly. For example I have a youtube account and create a comment, is this comment now considered my personal data? If that ...
1
vote
1answer
89 views

Subject Access Request (SAR) of data relating to cookies?

Take a search engine (e.g. Google), where user A can make searches without logging in with their account. The search engine collects, processes and stores, over time, a number of data about the user A,...
1
vote
2answers
67 views

Process IP address without GDPR consent

We are trying to log the location of our visitors, without storing their actual IP address on our servers. To geolocate the IP address, we use an external service, to which we make an API request ...
1
vote
1answer
39 views

Can someone enlighten me about the main task of the independent supervision of data protection law

So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
1
vote
1answer
61 views

GDPR in a scientific, transborder scenario

Let us assume that a dental clinic, in a country that is not part of EU, is making dental x-rays for its patients, which may or may not be EU citizens. By the law of this country, the clinic is sole ...
1
vote
1answer
61 views

User-solicited personal information beyond consent

What does the GDPR say about personal information provided by a user about themselves, in the case that the service sign-up process and ToS have always asked of the users not to provide personal ...
1
vote
1answer
47 views

Is sending log data + customer name + location compatible with data privacy and GDPR?

I've written an updater program. Our customer downloads it to update our software with database. It would be helpful if we would know who has already updated our software. For this purpose I've added ...
1
vote
1answer
486 views

Cookie expiration time per GDPR guidelines

I am working on a task that requires to set cookie expiry date to Jan 2038. This cookie is used for showing personalized content to end user e.g. If user is on Home page and he clicks on Business ...
1
vote
1answer
33 views

Am I responsible of the personal data of a second degree user according to GDPR

Suppose we have an flight ticket booking system. As with many of these systems the account booking the ticket doesn't have to be the one using the ticket (i.e. you can book for someone else the ticket)...
1
vote
1answer
141 views

Can I use GDPR to read an Airbnb review about me before I post mine?

I just had a bad experience with Airbnb. The circumstances would be too long to describe and not relevant to my question. The fact is that I just have had an email that the host (I am the guest) let ...
1
vote
1answer
66 views

Google Analytics on mobile: possible to use without consent?

I saw this thread where it's possible to use Google Analytics without consent on websites: Is it really possible to use Google Analytics without consent, and if so, why exactly? My question is: does ...
1
vote
1answer
78 views

Store browser width / screen size and browser type without user consent?

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design ...
1
vote
1answer
49 views

Does the GDPR mandate that web sites provide access to cookie settings?

Cross referenced this question with SO just to get more technical perspective In this article it says with respect to: Google Analytics and GDPR consent to cookies and tracking: Based on a true ...
1
vote
1answer
71 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
1
vote
1answer
53 views

Users counting and GDPR

Do I need a GDPR "coockie" banner if I implement not a unique identifier but only a naive counter? My web app check a key presence in local storage. Key is the same for all. If it's not found - call /...
1
vote
2answers
277 views

Is it legal to ignore “Do Not Track” for data subjects who fall under the GDPR?

The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different ...

1
5 6
7
8 9
11