Hot answers tagged

13 votes

Can I store the names of arbitrary business associates in my CRM system?

The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as ...
user avatar
  • 17.1k
5 votes

Can I store the names of arbitrary business associates in my CRM system?

The answer by Amon is quite correct. But I want to mention a few other GDPR requirements. When a Data Controller (DC) first acquires Personal Data (PD) about a Data Subject (DS), the DC must send the ...
user avatar
  • 89.2k
3 votes
Accepted

Collecting statistics from online gaming and GDPR obligations

Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service ...
user avatar
  • 89.2k
2 votes
Accepted

should a website show cookies popup in following context?

Such a first party cookie is not "strictly necessary" for the operation of the site, and so if the site is to be used where the EU e-privacy directive is in force (more or less the same ...
user avatar
  • 89.2k
2 votes

UK - Privacy Policy requirements for website with no tracking

Sounds like you're pretty much set. Serving a website inherently involves processing of personal data. You have minimized this processing to what you consider the minimum, taking into account your ...
user avatar
  • 17.1k
2 votes

Are javascript keyloggers on websites legal?

From the cfaa perspective this is potentially fine, from the gdpr perspective probably not. For a cfaa violation, it would be necessary to show that authorization was exceeded. But the user has ...
user avatar
  • 17.1k
1 vote

Limits of automated decision making WRT workplace surveys

Workplace surveys aren't ATM, which is good because ATM wouldn't be permissible in a workplace context. The GDPR's concept of automated decision making (ADM) refers to decisions that are based solely ...
user avatar
  • 17.1k
1 vote

My previous employer had a data breach

The should delete your data as soon as it is no longer needed Different data will be needed for different periods of time. For example: Your name and your period of service may need to be kept ...
user avatar
  • 147k
1 vote
Accepted

Is it possible to send an additional email to people who didn't confirm their subscription?

The GDPR does not specifically regulate sending emails. Sending an email is a form of processing the data that is the email address, whch is surely personal data (PD) and thus requires a lawful basis ...
user avatar
  • 89.2k

Only top scored, non community-wiki answers of a minimum length are eligible