72
votes
Accepted
Is requesting waiving the right to deletion of contributions against GDPR?
Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer.
GDPR rights cannot be waived (mrllp.com).
The last bit should have been:
Therefore, in ...
- 3,172
59
votes
Accepted
Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?
Sure, you can make such a request, but its not likely to help you.
Scammers are criminals and don't generally care about GDPR compliance.
Scammers are criminals, and won't just publish their real ...
- 23.5k
57
votes
Accepted
Does GDPR include UK customers, or not anymore?
GDPR will continue to apply to UK customers directly until the end of the transition period (31 December 2020):
So, while the UK will no longer have any voting rights, it will need
to follow EU ...
- 24k
51
votes
Other use of profile photos: legality fair-use and permissions
BAD idea
It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook.
It isn't a fair use of the phonebook pictures - and you might not have a license anyway, ...
- 27.5k
47
votes
Accepted
How does SE's arbitration clause hold up under the GDPR?
Not going to hold up. Dutch Supreme Court confirmed 2012-09-21 in LJN BW6135 that arbitration is still covered by the the right to an independent judge, as established in Golder v UK, ECHR 1975-02-21, ...
- 5,031
43
votes
How can I get more than 10 years of transaction history from my bank?
Businesses only keep transaction data for as long as they have to
For a live loan account they will keep transactions while the account is live and then for as long as local law dictates (it varies ...
- 183k
41
votes
Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?
GDPR does not cease to apply because of the location of data storage. It applies based on the location of the data processor, data controller, and data subject. If you are in the EU, you are a data ...
- 31.5k
38
votes
Accepted
How to store refusal of cookie consent
The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for ...
- 9,284
38
votes
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
If the data controller has “reasonable doubts concerning the identity of the natural person making the request”, then “the controller may request the provision of additional information necessary to ...
- 23.5k
37
votes
Accepted
What should a website do if the end user refuses to accept the necessary cookies?
These kinds of cookie banners are typically noncompliant and useless since they are not clear and provide too little information to users.
Careful: blocking a user who declines consent is usually a ...
- 23.5k
36
votes
Accepted
In Europe, can I refuse to use Gsuite / Office365 at work?
You probably can't refuse to use such services.
The relationship between you and these services is very different when you interact with them as a consumer, versus when these services are provided on ...
- 23.5k
34
votes
Accepted
GDPR and right to provide meter readings
I spent a few years working in and around the Energy industry - including a stint working at a supplier, I'm no longer there so unfortunately I no longer have access to the email chains I had ...
- 4,138
33
votes
Accepted
Am I obligated to decrypt lots of data for GDPR requests?
It is the data controller's responsibility to respond to data subject requests. If you provide a B2B service, you are most likely a data processor who only acts on the controller's behalf, on the ...
- 23.5k
33
votes
Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?
I've also been wondering, how they got access to my mail-address,
Probably just randomly generated. Or, maybe bought from an address seller.
so I sent a request of information
This is great! Now ...
- 2,139
33
votes
Accepted
Accessing public CCTV footage about you
You have a right to access per Art 15 GDPR. You can make a request to the data controller (the person managing those cameras) free of charge. In your request, you should mention the approximate time ...
- 23.5k
30
votes
Is there a way to determine if an email address is personal information?
Treat all email addresses as if they are personal data.
All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address.
If your ...
- 2,603
29
votes
Accepted
ISP is not hashing the password I log in with online. Should I take any action?
The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient ...
- 112k
28
votes
Accepted
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
The point of privacy laws is to set basic standards that apply to everyone, whether or not they have a privacy policy. A privacy policy that is inconsistent with privacy laws cannot be enforced. ...
- 7,437
27
votes
Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?
GDPR consent must be freely given
The GDPR conditions for consent define it as (article 4.11) "‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of ...
- 2,171
27
votes
Do I need to present a GDPR banner to IP addresses outside of GDPR regions?
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't ...
- 12.1k
27
votes
Accepted
On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?
Since you are from Europe, GDPR applies to all your processing activities per Art 3(1) GDPR, regardless of where the users are located. If you would like to avoid GDPR compliance, you would have to ...
- 23.5k
26
votes
Accepted
How to satisfy GDPR's consent requirement for IP logging?
In the question, you write:
The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file).
No, it does not.
To quote Miss Infogeek:...
- 3,172
26
votes
Under GDPR, can I give permission once to allow everyone to store and process my data?
You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are ...
- 27.5k
26
votes
Accepted
Does the German GDPR require storing the data in a German datacenter for a tele-health company?
The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in ...
- 23.5k
23
votes
Accepted
How can consent-banner as a service be GDPR compliant?
The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed.
If the embed-provider acts as your data processor, then things are ...
- 23.5k
23
votes
Are global user account systems now illegal following the EU's May 2023 fine of Meta?
I assume this refers to the case covered here:
https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta
The gist is: Under GDPR you can only ...
- 920
22
votes
Why can't I add a governing law to my terms of service to avoid GDPR?
However, if a website is based in the US and the terms of service say that the law governing the terms is US law, how can GDPR have any affect?
It is unlikely that the EU will be able to enforce ...
- 31.5k
22
votes
Is displaying the user first name and last name a breach of GDPR?
Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service?
For your scenario a common answer ...
- 2,603
21
votes
Accepted
Do the GDPR and Cookie-Law regulations apply to localStorage?
The official EU-legislation does not use the word "cookies", except in the recitals. The "Cookie-Law" is part of the Privacy and Electronic Communications Directive 2002/58/EC and is amended by ...
- 2,845
21
votes
In Europe, can I refuse to use Gsuite / Office365 at work?
Your employer should have a Data Protection Officer. The first step when you have data privacy concerns at the workplace should be to talk to the DPO.
An institution using software as a service by ...
- 12k
Only top scored, non community-wiki answers of a minimum length are eligible