72
votes
Accepted
Is requesting waiving the right to deletion of contributions against GDPR?
Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer.
GDPR rights cannot be waived (mrllp.com).
The last bit should have been:
Therefore, in ...
- 3,212
58
votes
Accepted
Does GDPR include UK customers, or not anymore?
GDPR will continue to apply to UK customers directly until the end of the transition period (31 December 2020):
So, while the UK will no longer have any voting rights, it will need
to follow EU ...
- 27.5k
58
votes
Accepted
Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?
Sure, you can make such a request, but its not likely to help you.
Scammers are criminals and don't generally care about GDPR compliance.
Scammers are criminals, and won't just publish their real ...
- 23.9k
50
votes
Other use of profile photos: legality fair-use and permissions
BAD idea
It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook.
It isn't a fair use of the phonebook pictures - and you might not have a license anyway, ...
- 39.3k
49
votes
Accepted
How does SE's arbitration clause hold up under the GDPR?
Not going to hold up. Dutch Supreme Court confirmed 2012-09-21 in LJN BW6135 that arbitration is still covered by the the right to an independent judge, as established in Golder v UK, ECHR 1975-02-21, ...
- 5,649
43
votes
How can I get more than 10 years of transaction history from my bank?
Businesses only keep transaction data for as long as they have to
For a live loan account they will keep transactions while the account is live and then for as long as local law dictates (it varies ...
- 209k
41
votes
Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?
GDPR does not cease to apply because of the location of data storage. It applies based on the location of the data processor, data controller, and data subject. If you are in the EU, you are a data ...
- 37.2k
38
votes
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
If the data controller has “reasonable doubts concerning the identity of the natural person making the request”, then “the controller may request the provision of additional information necessary to ...
- 23.9k
38
votes
Accepted
What should a website do if the end user refuses to accept the necessary cookies?
These kinds of cookie banners are typically noncompliant and useless since they are not clear and provide too little information to users.
Careful: blocking a user who declines consent is usually a ...
- 23.9k
37
votes
Accepted
How to store refusal of cookie consent
The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for ...
- 16.8k
36
votes
Accepted
In Europe, can I refuse to use Gsuite / Office365 at work?
You probably can't refuse to use such services.
The relationship between you and these services is very different when you interact with them as a consumer, versus when these services are provided on ...
- 23.9k
34
votes
Accepted
GDPR, online shopping and phone numbers for shipping - Is it legal?
Shipping does not require a phone number
First, in many places shipping does require a phone number. Even if not strictly mandatory, it may be part of standard business practices to facilitate the ...
- 5,903
33
votes
Accepted
GDPR and right to provide meter readings
I spent a few years working in and around the Energy industry - including a stint working at a supplier, I'm no longer there so unfortunately I no longer have access to the email chains I had ...
- 4,650
33
votes
Accepted
Am I obligated to decrypt lots of data for GDPR requests?
It is the data controller's responsibility to respond to data subject requests. If you provide a B2B service, you are most likely a data processor who only acts on the controller's behalf, on the ...
- 23.9k
32
votes
Can I request a copy of my personal data (GDPR) from email-scammers and sue them if they don't comply?
I've also been wondering, how they got access to my mail-address,
Probably just randomly generated. Or, maybe bought from an address seller.
so I sent a request of information
This is great! Now ...
- 2,253
32
votes
Accepted
Accessing public CCTV footage about you
You have a right to access per Art 15 GDPR. You can make a request to the data controller (the person managing those cameras) free of charge. In your request, you should mention the approximate time ...
- 23.9k
30
votes
Accepted
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
The point of privacy laws is to set basic standards that apply to everyone, whether or not they have a privacy policy. A privacy policy that is inconsistent with privacy laws cannot be enforced. ...
- 9,178
30
votes
Is there a way to determine if an email address is personal information?
Treat all email addresses as if they are personal data.
All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address.
If your ...
- 3,466
30
votes
Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?
There are not enough facts to draw a conclusion
First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the ...
- 209k
29
votes
Accepted
ISP is not hashing the password I log in with online. Should I take any action?
The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient ...
- 114k
28
votes
Accepted
How to satisfy GDPR's consent requirement for IP logging?
In the question, you write:
The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file).
No, it does not.
To quote Miss Infogeek:...
- 3,212
27
votes
Is asking users to waive GDPR compliance a legal way of escaping GDPR data handling requirements?
GDPR consent must be freely given
The GDPR conditions for consent define it as (article 4.11) "‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of ...
- 2,199
27
votes
Do I need to present a GDPR banner to IP addresses outside of GDPR regions?
Your VPN scenario is the reason why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because ...
- 17k
27
votes
Accepted
On a mobile app, can I use IP location services to determine if a user is from EU prior to GDPR consent?
Since you are from Europe, GDPR applies to all your processing activities per Art 3(1) GDPR, regardless of where the users are located. If you would like to avoid GDPR compliance, you would have to ...
- 23.9k
27
votes
Is a "login timestamp" considered as personal data according to GDPR?
You ask the wrong question first
What do you save in the database? Let's take an example of a door:
Do you have a legitimate interest to know/save who passed this door?
Do you have a legitimate ...
- 39.3k
26
votes
Accepted
Does the German GDPR require storing the data in a German datacenter for a tele-health company?
The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in ...
- 23.9k
25
votes
Under GDPR, can I give permission once to allow everyone to store and process my data?
You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are ...
- 39.3k
23
votes
Accepted
How can consent-banner as a service be GDPR compliant?
The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed.
If the embed-provider acts as your data processor, then things are ...
- 23.9k
23
votes
Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?
"Article 5.3" here means the following from the ePrivacy Directive, 2002/58/EC, as amended amended by Directive 2009/136/EC.
Member States shall ensure that the use of electronic ...
- 6,315
22
votes
Accepted
Do the GDPR and Cookie-Law regulations apply to localStorage?
The official EU-legislation does not use the word "cookies", except in the recitals. The "Cookie-Law" is part of the Privacy and Electronic Communications Directive 2002/58/EC and is amended by ...
- 2,845
Only top scored, non community-wiki answers of a minimum length are eligible