Skip to main content
72 votes
Accepted

Is requesting waiving the right to deletion of contributions against GDPR?

Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer. GDPR rights cannot be waived (mrllp.com). The last bit should have been: Therefore, in ...
Free Radical's user avatar
  • 3,212
58 votes
Accepted

Does GDPR include UK customers, or not anymore?

GDPR will continue to apply to UK customers directly until the end of the transition period (31 December 2020): So, while the UK will no longer have any voting rights, it will need to follow EU ...
Greendrake's user avatar
  • 27.5k
58 votes
Accepted

Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?

Sure, you can make such a request, but its not likely to help you. Scammers are criminals and don't generally care about GDPR compliance. Scammers are criminals, and won't just publish their real ...
amon's user avatar
  • 23.9k
50 votes

Other use of profile photos: legality fair-use and permissions

BAD idea It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook. It isn't a fair use of the phonebook pictures - and you might not have a license anyway, ...
Trish's user avatar
  • 39.4k
49 votes
Accepted

How does SE's arbitration clause hold up under the GDPR?

Not going to hold up. Dutch Supreme Court confirmed 2012-09-21 in LJN BW6135 that arbitration is still covered by the the right to an independent judge, as established in Golder v UK, ECHR 1975-02-21, ...
MSalters's user avatar
  • 5,659
43 votes

How can I get more than 10 years of transaction history from my bank?

Businesses only keep transaction data for as long as they have to For a live loan account they will keep transactions while the account is live and then for as long as local law dictates (it varies ...
Dale M's user avatar
  • 209k
41 votes

Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?

GDPR does not cease to apply because of the location of data storage. It applies based on the location of the data processor, data controller, and data subject. If you are in the EU, you are a data ...
phoog's user avatar
  • 37.2k
38 votes

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

If the data controller has “reasonable doubts concerning the identity of the natural person making the request”, then “the controller may request the provision of additional information necessary to ...
amon's user avatar
  • 23.9k
38 votes
Accepted

What should a website do if the end user refuses to accept the necessary cookies?

These kinds of cookie banners are typically noncompliant and useless since they are not clear and provide too little information to users. Careful: blocking a user who declines consent is usually a ...
amon's user avatar
  • 23.9k
37 votes
Accepted

How to store refusal of cookie consent

The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for ...
Lag's user avatar
  • 16.9k
36 votes
Accepted

In Europe, can I refuse to use Gsuite / Office365 at work?

You probably can't refuse to use such services. The relationship between you and these services is very different when you interact with them as a consumer, versus when these services are provided on ...
amon's user avatar
  • 23.9k
34 votes
Accepted

GDPR, online shopping and phone numbers for shipping - Is it legal?

Shipping does not require a phone number First, in many places shipping does require a phone number. Even if not strictly mandatory, it may be part of standard business practices to facilitate the ...
xngtng's user avatar
  • 6,033
33 votes
Accepted

GDPR and right to provide meter readings

I spent a few years working in and around the Energy industry - including a stint working at a supplier, I'm no longer there so unfortunately I no longer have access to the email chains I had ...
motosubatsu's user avatar
  • 4,650
33 votes
Accepted

Am I obligated to decrypt lots of data for GDPR requests?

It is the data controller's responsibility to respond to data subject requests. If you provide a B2B service, you are most likely a data processor who only acts on the controller's behalf, on the ...
amon's user avatar
  • 23.9k
32 votes

Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?

I've also been wondering, how they got access to my mail-address, Probably just randomly generated. Or, maybe bought from an address seller. so I sent a request of information This is great! Now ...
Jörg W Mittag's user avatar
32 votes
Accepted

Accessing public CCTV footage about you

You have a right to access per Art 15 GDPR. You can make a request to the data controller (the person managing those cameras) free of charge. In your request, you should mention the approximate time ...
amon's user avatar
  • 23.9k
30 votes
Accepted

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

The point of privacy laws is to set basic standards that apply to everyone, whether or not they have a privacy policy. A privacy policy that is inconsistent with privacy laws cannot be enforced. ...
sjy's user avatar
  • 9,178
30 votes

Is there a way to determine if an email address is personal information?

Treat all email addresses as if they are personal data. All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address. If your ...
quarague's user avatar
  • 3,465
30 votes

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the ...
Dale M's user avatar
  • 209k
29 votes
Accepted

ISP is not hashing the password I log in with online. Should I take any action?

The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient ...
David Siegel's user avatar
28 votes
Accepted

How to satisfy GDPR's consent requirement for IP logging?

In the question, you write: The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file). No, it does not. To quote Miss Infogeek:...
Free Radical's user avatar
  • 3,212
27 votes

Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?

GDPR consent must be freely given The GDPR conditions for consent define it as (article 4.11) "‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of ...
Peteris's user avatar
  • 2,199
27 votes

Do I need to present a GDPR banner to IP addresses outside of GDPR regions?

Your VPN scenario is the reason why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because ...
Someone's user avatar
  • 17k
27 votes
Accepted

On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?

Since you are from Europe, GDPR applies to all your processing activities per Art 3(1) GDPR, regardless of where the users are located. If you would like to avoid GDPR compliance, you would have to ...
amon's user avatar
  • 23.9k
27 votes

Is a "login timestamp" considered as personal data according to GDPR?

You ask the wrong question first What do you save in the database? Let's take an example of a door: Do you have a legitimate interest to know/save who passed this door? Do you have a legitimate ...
Trish's user avatar
  • 39.4k
26 votes
Accepted

Does the German GDPR require storing the data in a German datacenter for a tele-health company?

The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in ...
amon's user avatar
  • 23.9k
25 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are ...
Trish's user avatar
  • 39.4k
23 votes
Accepted

How can consent-banner as a service be GDPR compliant?

The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed. If the embed-provider acts as your data processor, then things are ...
amon's user avatar
  • 23.9k
23 votes

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

"Article 5.3" here means the following from the ePrivacy Directive, 2002/58/EC, as amended amended by Directive 2009/136/EC. Member States shall ensure that the use of electronic ...
alexg's user avatar
  • 6,335
22 votes
Accepted

Do the GDPR and Cookie-Law regulations apply to localStorage?

The official EU-legislation does not use the word "cookies", except in the recitals. The "Cookie-Law" is part of the Privacy and Electronic Communications Directive 2002/58/EC and is amended by ...
wimh's user avatar
  • 2,845

Only top scored, non community-wiki answers of a minimum length are eligible