Questions tagged [gdpr]

Questions about the European Union General Data Protection Regulation (GDPR)

Filter by
Sorted by
Tagged with
0
votes
2answers
78 views

Do companies have the right to demand proof of being present in the EU before executing a GDPR request?

Under the GDPR, any company doing business in the EU must remove EU users' personal data upon request from that user. Since the statute only applies to persons present in the EU, are companies ...
0
votes
1answer
46 views

Hiding order invoice information, GDPR

I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like: Name Surname ...
0
votes
2answers
40 views

GDPR Information and consent

I am building a game that stores score/level on the local device and uses non-personalized AdMob. Do I need to inform the user about storing the score locally? Do I need consent for using non-...
0
votes
1answer
57 views

How much can the GDPR be amended by EU member states in their national laws?

Citing article 8 of the GDPR (emphasis added): Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the ...
0
votes
3answers
93 views

Is this information considered personal?

Imagine a UK-based company made an application to order food from restaurants. The company decided to share the following information with the restaurants to summarize orders made restaurant location ...
0
votes
1answer
69 views

Is it legal to collect reviews/ratings about people and show it on website?

There are websites which show reviews, ratings, scores about companies (restaurants, hotels, etc.). For example, I create a website which would collect similar data about concrete persons. Could a ...
0
votes
2answers
110 views

GDPR - Confirm company terms and conditions by button click

This May the General Data Protection Regulation (GDPR) will be applied across the EU. I read somewhere that users have to always 'opt-in' after this law is effective. Since I'm concerned about ...
0
votes
2answers
50 views

GDPR compliance in ads SDK for iOS/Android

I have opened this question in SO, but was suggested to ask here, as the solution might come from a lawyer, rather than developer. I work on a native ads SDK for iOS/Android (banner, interstitial, ...
0
votes
1answer
49 views

GDPR on Proxy Users

I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc... My questions here are about the scope of GDPR. Does GDPR apply to people who: ...
0
votes
4answers
155 views

Data Protection Laws

Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/...
0
votes
2answers
73 views

Is a company still required to pay fines if the applicability of a law changes during the investigation?

This question was inspired by this question on Security.SE, regarding a data breach in a UK-based company. In short, the data of a UK-based company was leaked by an US-based contractor. Since the UK ...
0
votes
1answer
55 views

Allowing access to data before employment

If a company wishes to allow access to their system (e.g a new manager to view HR records, salary etc) before their employment start date, does this break any privacy, GDPR laws etc? Lets say they ...
0
votes
1answer
99 views

Is deterministic anonymization of test data ok?

Deterministic anonymization of test data? When anonymizing multiple data sources and preserving data consistency we usually end up with a mapping table for "real to anonymized" values. Typically ...
0
votes
2answers
151 views

Are Steam account IDs (and telemetry data associated with Steam IDs) deemed personal data?

A few friends and were having an argument on the following situation: People can sign up for Steam accounts for free, letting them purchase games and play games over their network. Users are able to ...
0
votes
1answer
72 views

Does GDPR require consent for a processor to confirm or deny the existence of data?

Assume we have two separate lists of emails handled by two different processors. List A is gathered by company A in a way that the subject has given their consent for its processing for marketing ...
0
votes
1answer
24 views

When to authorize someone and when to sign a contract for processing personal data

There are two ways for the data controller to let someone else process the data he controls: authorise him or her to do so, sign a legal contract making him or her a 'processor' (Article 28 GDPR). ...
0
votes
1answer
55 views

Identity of the controller (GDPR): can any website now ever be anonymous?

No matter whether a website collects personal data or not, it seems that a privacy policy is required anyway, and such a policy should contain (citing article 13 of the GDPR, first paragraph): (a) ...
0
votes
1answer
131 views

GDPR - is user social ID personal data

1) Is Google or Facebook user ID number considered personal data? The ID itself is just a number, but you can use it to construct a profile url and reveal his identity through Google or Facebook ...
0
votes
1answer
157 views

Hetzner is trying to charge me for Bandwidth overuse and will not respond when I use the contact form

A few months ago, I was using Hetzner Cloud for my VPS, and they blocked a server because someone seems to have DDoSed it. I requested it to be unblocked, and they ignored me. I also noticed they are ...
0
votes
3answers
113 views

GDPR for dummies: can I track anonymous data? can I track how many people accept / refuse my new cookie policy?

is it legal following the GDPR law, to track anonymous data without consent? I was reading many articles, but GDPR is so broad, there is so much information that receiving a simple answer as that, ...
0
votes
2answers
107 views

GDPR vs. Copyright for a recommendation letter

Spurred by a discussion on academia.se: suppose prof. X writes a letter of recommendation for her student mr. Y, and sends it to university Z through an on-line system. Then, the student mr. Y writes ...
0
votes
1answer
115 views

Autoresponders and GDPR - do they comply with the law?

Would it be GDPR compliant to have an autoresponder request opt-in permission? For example, a customer makes an enquiry by sending an email to the company in question. The company in question then ...
0
votes
1answer
333 views

GDPR and local data storage in mobile app

Let's say that I have a mobile app that tracks the user and saves his GPS coordinates locally only on a mobile device so that he can check where he was. The mobile application does not send this data ...
0
votes
1answer
194 views

Opt Out Consent under GDPR

I am having an Android App which uses certain service such as Analytics, Ad Networks. I am taking the consent from the user at when the app starts, i.e. before collecting any info. But there are ...
0
votes
2answers
55 views

Is anonymous analytics data subject to GDPR?

I am reading the definition of "personal data" here https://gdpr-info.eu/issues/personal-data/. My understanding is that GDPR comes into play when information is about personal data. Let's say there ...
0
votes
1answer
56 views

GDPR - We're a global company and are expanding to Europe, do we need to save data there?

We're a global company and are expanding to Europe. We have users log in to our service and then they can use it. If a user is from the EU, do we have to store all of their personal information ...
0
votes
1answer
31 views

Does anonymised Google Analytics require positive opt-in under GDPR/PECR?

The EU defines personal data as: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can ...
0
votes
2answers
49 views

GDPR - Service storing other people's clients' emails

I am working on a service that allows people to import data regarding their sales within a particular platform. This data is imported in an excel format (CSV) and contains all sales informations for a ...
0
votes
2answers
51 views

GDPR - Company employee [closed]

I believe to know that an employee at a company that I'm customer at, I believe has accessed my customer profile and gotten personal information, such as my full name, ID number and address. I know ...
0
votes
1answer
50 views

GDPR: legal to combine (clickstreams) tracking and survey?

I am working on a website that collects clickstream data using Google Analytics. There is also a opti-layer. In the near future a survey to ask in which industry a visitor works shall be integrated, ...
0
votes
2answers
48 views

GDPR question about processing personal data for research purposes that yield aggregated results

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...
0
votes
2answers
88 views

Do I need permission to publish a FOI response in a blog post or open letter?

I recently submitted a FOI request to my local council, and had a response. Part of the response stated the following: You are free to use this information for your own use, including for non-...
0
votes
1answer
108 views

Locate me data obtained from european register

There is an entry on locatefamily.com that I know because it has certain details that were used on a European domain register in 2014. I an EU citizen living in the states. Does the GDPR apply to them ...
0
votes
1answer
84 views

Do corporations have any legal liability for XSS exploits that can harvest private/payment info?

So let's say there's a website that is made up of crowd sourced articles (let's say it's about politics). The website has users from around the world. All articles have to be approved by an editor, ...
0
votes
2answers
50 views

GDPR: can we ask the building owner to share and/or destroy data about one's RFID activity?

this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways It seems most buildings store the activity of one's RFID key activity. ...
0
votes
1answer
63 views

GDPR: Can I do anything that touches a system with live customer data if I have no instructions at all

I have just become aware of this particular Article 29, which has one good side: it is short. The processor and any person acting under the authority of the controller or of the processor, who has ...
0
votes
1answer
167 views

GDPR: Can a website not process personal data?

I want to have a website where I publish my own articles. When a user requests a webpage, I receive an HTTP request from their browser, which contains the IP. Now, for a split second while the ...
0
votes
1answer
43 views

Data Portability in GDPR

I've reading: https://gdpr-info.eu/art-20-gdpr/ It says: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, ...
0
votes
1answer
59 views

Data Scraping public athlete name and performance data. Does this need to be treated as personal data?

Consider the following data for amateur/professional athletes: Athlete name, Athletic event + best performance data e.g.: Joe Bloggs 5k 19:00 10k 40:00 Half Marathon 85:00 other events etc... and ...
0
votes
1answer
50 views

Replication of user data a violation of GDPR

I'm in the planing staging of building game service provider, kind of like Xbox Live, PSN, Steam, etc. As far as I understand in the terms of the GDPR, information that can directly identify users ...
0
votes
1answer
102 views

Yahoo Messenger and the GDPR

Yahoo Messenger was was discontinued on December 1, 2018. On this date downloading of chat history was stopped. However they did not tell their users what happened to their data associated with Yahoo ...
0
votes
1answer
39 views

Does GDPR impose requirement for an EU based e-mail address?

Does GDPR impose requirement for an EU based e-mail address? I mean, not directly but indirectly for all practical purposes. Assume an EU based company having a public website. GDPR requires a ...
0
votes
2answers
91 views

Emails from clients and GDPR

I created a website for a friend's company that has no user account feature, it is only meant to be an online catalog for prices. The only user data we might receive are data that users fill in the ...
0
votes
1answer
43 views

Modify a client file

After the setup of the GDPR law about personnal data security, I have a case I'm not sure about. Test case: I receive an addresses file from a client containing x lines of addresses with personnal ...
0
votes
1answer
128 views

How can GDPR affect user generated content?

I'm wondering where the lines of GDPR are in regard to user generated content and how it meets the Communications Decency Act. Section 230 has been what ISPs and websites (Yelp as an example) use as ...
0
votes
1answer
764 views

GDPR: cookie for login management

I use cookie in my site for login management. I user logs in the cookie dies with the sessione, if user flags "Keep me logged in" when logging in a long time cookie persists. In the long time cookie I ...
0
votes
1answer
51 views

How does GDPR affect a personal web application that uses third parties to authenticate?

I created a publicly accessible web application that allows me to remotely control the heating system in my home. The only data the app itself collects is logs of user activity (e.g.: logging when I ...
0
votes
1answer
56 views

GDPR - User invitation functionality within learning and development platform

There are similar answers to queries around this but I just wanted to introduce this scenario to get some advice. Company A provides pharmaceutical products to Company B Company B is a pharmacy ...
0
votes
1answer
25 views

What if I stored Personally identifiable information (PII) on cloud but with IP restricted environment or using VPN. Will it be GDPR compliance?

I have a requirement to fetch and search (partial search, full text search, fuzzy search etc) personally identifiable information (PII) data in Admin Panel and I can restrict my environment with IP ...
0
votes
2answers
106 views

GDPR - Do we need to give individual mixed personal data of 2 individuals? (Right of access)

Individual is asking for phone recording which contains personal information of that individual and our marketing person, it also contains our sales speech. Do we need to provide copy of phone ...