Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
1
vote
1answer
72 views

Google Analytics on mobile: possible to use without consent?

I saw this thread where it's possible to use Google Analytics without consent on websites: Is it really possible to use Google Analytics without consent, and if so, why exactly? My question is: does ...
1
vote
1answer
79 views

Store browser width / screen size and browser type without user consent?

I have a question about GDPR compliance for a web app. May I store users' browser window width / screen size (like 768px) and browser type (eg. Firefox) to be used for future responsive design ...
1
vote
1answer
49 views

Does the GDPR mandate that web sites provide access to cookie settings?

Cross referenced this question with SO just to get more technical perspective In this article it says with respect to: Google Analytics and GDPR consent to cookies and tracking: Based on a true ...
1
vote
1answer
71 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
1
vote
1answer
53 views

Users counting and GDPR

Do I need a GDPR "coockie" banner if I implement not a unique identifier but only a naive counter? My web app check a key presence in local storage. Key is the same for all. If it's not found - call /...
1
vote
2answers
303 views

Is it legal to ignore “Do Not Track” for data subjects who fall under the GDPR?

The "Do Not Track" (DNT) flag is an optional header field in HTTP requests sent by web browsers to web servers. It requests that the website not track the user, or not track the user across different ...
1
vote
1answer
63 views

Do I need an active consent according to GDPR? [duplicate]

If I have a form on a website where people fill in their personal details and credit card information to subscribe to a monthly delivery of apples, do I need an active consent (e.g. checkbox) from the ...
1
vote
1answer
37 views

Responsible GDPR data protection authority (DPA) responsible for non-EU companies?

Article 15 EU GDPR is often cited as basis of what needs to be included in privacy policy. The data subject shall have the right to obtain from the controller confirmation as to whether or not ...
1
vote
1answer
29 views

Can a data subject be asked to share a limited part of their data if it would be in their interest to do so?

I am an adviser for a UK agency that provides free advice to the public. I have two employment cases that differ in detail, but are fundamentally the same issues and involve the same company. It could ...
1
vote
1answer
99 views

GDPR: How to respond to clinicians who ask for subject access requests for results to be made in writing

During a hospital stay, when requesting a copy of blood test results from doctors or nurses, unfortunately patients are often met with the response "Your request must be made in writing and must be ...
1
vote
1answer
80 views

Can GDPR violations lead to piercing of the corporate veil?

Does GDPR have any clauses that hint at piercing of the corporate veil? Can GDPR violations lead to piercing of the corporate veil?
1
vote
1answer
64 views

Fee for Subject Access Request to GCHQ, Data Protection Act 2018

When making a Subject Access Request to GCHQ I was told that I would have to pay a fee for this Request. The GDPR does not allow for such a fee, while the UK Data Protection Act does(Part 4 – Chapter ...
1
vote
1answer
151 views

Does the process of anonymizing web server logs count as 'Processing' under GDPR?

As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons. I am looking to implement a log anonymization ...
1
vote
2answers
99 views

Deliberately inaccurate data

The GDPR seem to assume that the client would want us to maintain accurate data. Article 5(1)(d) makes it clear we have to correct inaccurate data. But I deliver pizzas for a big chain, and I ...
1
vote
2answers
311 views

GDPR: if a user doesn't agree cookies on my banner, what must I do?

if a guest of my site click on "Not agree" on cookie banner, what must I do? Have I to disable all the cookies? Have I to disable all the cookies except technical cookies (eg. login session cookies)? ...
1
vote
1answer
50 views

Crawling a web forum and presenting the posts in a search

Is what this site is doing with steam community legal? https://www.steamtrades.com/ I assume that is a grey area, no? So what are the factors that would make it legal or not? I assume one should not ...
1
vote
1answer
146 views

Is it reasonable to ask me to change my email address after it was leaked?

My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later ...
1
vote
1answer
253 views

What is exactly a joint controller in GDPR? Examples

I am not sure I really understand the concept of "joint controllers" in GDPR, and I'd like to have some concrete examples, especially examples of joint controllers relating to the internet (websites, ...
1
vote
1answer
42 views

Who is the Controller and who is the Processor if Company X hosts/embeds content of Company Y

Let's say we have two companies "WeServe" and "OurContent" and the following relationships, who is the Controller and who is the Processor or are they Joint Controllers (Art. 26 GDPR) or is there ...
1
vote
1answer
101 views

How to fulfill the General Data Protection Regulation (GDPR) when receiving emails

Suppose, a scientist is planning to publish a paper, and his email address will be printed on it. I'm wondering, if the European General Data Protection Regulation would be relevant in that case. ...
1
vote
1answer
200 views

Is it legal for me to use publicly accessible user data about a person on my website?

I run a wiki service and I was wondering if someone doxes an anonymous person in the from of a dump (pastebin, screenshots, recordings etc), can we keep that data or perhaps cite it? For instance if ...
1
vote
1answer
441 views

google analytics cookie consent with anonymized ip on

I am not even sure how is this possible, so here I am. I have google analytics with anonymized IP on, my users can activate and deactivate google analytics cookies at any time. BUT, on top of that, ...
1
vote
2answers
747 views

What does “monitor the behavior of individuals in the EU” mean?

https://www.truevault.com/blog/do-i-need-to-be-gdpr-compliant.html GDPR was created by the European Union to protect its citizens, and so it only affects organizations with some kind of relationship ...
1
vote
2answers
1k views

Are Phone Number lists with no other personal data allowed under GDPR?

Given a phone number list stored in a format such as this: 02321 203201, 203120 023102, etc. Would this be classed as personally identifiable information under the new GDPR regulations or as there ...
1
vote
2answers
79 views

Is it possible, under the GDPR, to request publicly available information to be taken down from an aggregator?

In Sweden, there are many services available that collect publicly available personal information (such as telephone numbers, addresses, social security numbers, income, mortgages, registered cars) ...
1
vote
1answer
451 views

Parent company GDPR compliance

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
1
vote
1answer
54 views

GDPR - If am am allowing user to post on twitter and Facebook from my IOS app?

If am allowing user to post on twitter and Facebook from my IOS app, Do I have to get user consent ? If yes what do I have to mention in user consent ?
1
vote
1answer
406 views

GDPR - Offshoring

We work for consulting company in India, call it Z. Z has a partnership with a European cards & transactions processing company Y. So the Indian consulting company Z does offshore production ...
1
vote
2answers
45 views

Does the GDPR apply to the data subject's computers?

In this answer to a GDPR question about processing conducted by an app on the user's computer I wrote: The GDPR only applies to data processed by you on your computer. Any processing that happens on ...
1
vote
1answer
66 views

Is it legal to post an email to social media if the email also contains a photo of the sender and other personal identifiable information?

I've seen a few similar questions asked before, however would posting a screenshot of an email onto social media be legal under the following circumstances: The poster on social media is the ...
1
vote
0answers
72 views

Is facebook in violation of CCPA if they don't delete all messenger messages when you delete your account?

It seems like Facebook won't delete your messages from the recipient's inbox when you delete your account. People send a lot of personal information in messages including their address, phone number, ...
1
vote
0answers
43 views

University diploma / various certificates under GDPR

Background: I'm considering building a web (focused to Europe) which, for one of it's part, would require users to upload their university diplomas and/or other similar certificates of achieved ...
1
vote
2answers
57 views

What consequences are there to ignoring GDPR rules as a non-EU entity?

If a non-EU entity ignores the GDPR rules, including not paying any fines they receive from not following them, what consequences are they subject to? Can a company simply decide to ignore GDPR rules ...
1
vote
1answer
63 views

Has a data loss taken place if, after the fact, it is discovered that the data was never lost

Data on external media was misplaced and all the protocols to report it as lost were followed. A few months after, the media was discovered. It never left the secure location. Given that data was ...
1
vote
2answers
61 views

Reporting poor privacy practices in a mobile app

I found a vulnerability in a paid Smartphone app. It is supposed to contain a lot of private details. There is a logging option for support that you can switch off and on, to extract the part that ...
1
vote
2answers
188 views

GDPR and CDN (content delivery networks)

I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content. A CDN is, basically, a distributed network of servers. ...
1
vote
0answers
41 views

Corporate responsibility when allowing biometric authentication

At our company, we are discussing allowing (but not forcing) the use of facial recognition to authenticate on employee laptops (Windows Hello). The laptops are owned by the company, but are for ...
1
vote
0answers
36 views

Is Apple's default Privacy settings GDPR compliant?

I recently realized that some apps were able to "link" my identity to Facebook. I checked my off facebook activity and could see some apps that I've never given my email. Investigating ...
1
vote
0answers
32 views

Company acquired a website with existing users. Is GDPR announcement obligatory?

When company acquires a website with existing registered users - is it obligatory (by GDPR) to send a notification/announcement email about the acquisition?
1
vote
0answers
47 views

Question Regarding GDPR

I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
1
vote
0answers
40 views

Is it obligatory to store ToS and Privacy Policy consent for a web app?

I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should". So my ...
1
vote
0answers
55 views

Replace User ID with pseudonym, still need consent?

I use a service called Matomo (as opposed to Google Analytics) so that I can own the data collected, and I thought they were better in regards of user privacy. My goal is to avoid collecting any ...
1
vote
0answers
63 views

To achieve ECTS credits at my school a student is forced to drop his/her right of privacy

Some background about the situation: I attend a vocational university (university of applied sciences) I live in the Netherlands - Europe We have a mandatory activity that provides us with ECTS ...
1
vote
0answers
55 views

A company finds out that it has made a material decision based on incorrect personal data, what should it do?

A company terminates an employee based on what it believes to be a record of the actions of person gained from log files. Months later the company finds out that this information is not correct. ...
1
vote
0answers
49 views

Minimal GDPR requirements for a website

Currently I use cookiesandyou javascript service that provides a popup like "We use cookies here" with 3 options: Agree Decline "Read more" link to a common page "What are cookies?" Additionally I ...
1
vote
0answers
83 views

Is geocoding an IP address but not storing it considered processing under GDPR?

As a data controller who intends to be GDPR compliant, if someone visits my website a request is made to my server with their IP address. If I geocode the IP address to get the visitor's country and ...
1
vote
1answer
59 views

GDPR article 20, portability of future data

Article 20.2 of the GDPR states: "In exercising his or her right to data portability [...], the data subject shall have the right to have the personal data transmitted directly from one controller to ...
1
vote
1answer
72 views

Processing of genetic data: which are the required “technical and organisational measures”?

Several articles of the Regulation require to apply the “appropriate technical and organisational measures” or “appropriate safeguards” in order to ensure the security of data. While GDPR ...
1
vote
1answer
145 views

GDPR - Recording simple page views

We are currently using google analytics to track our site. The issue we now have with GDPR is we don't have a clear picture of our entrance pages. Our landing page data is messed up badly because the ...
1
vote
1answer
165 views

GDPR and a cell phone paid through work?

Company Contacts page From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B. For instance my private email is regulated by GDPR, but my work ...