Skip to main content
34 votes
Accepted

GDPR, online shopping and phone numbers for shipping - Is it legal?

Shipping does not require a phone number First, in many places shipping does require a phone number. Even if not strictly mandatory, it may be part of standard business practices to facilitate the ...
xngtng's user avatar
  • 6,128
30 votes

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the ...
Dale M's user avatar
  • 213k
27 votes

Is a "login timestamp" considered as personal data according to GDPR?

You ask the wrong question first What do you save in the database? Let's take an example of a door: Do you have a legitimate interest to know/save who passed this door? Do you have a legitimate ...
Trish's user avatar
  • 40.4k
25 votes

I forgot to BCC people in music promotion email

Don’t do it again This is a data breach under the GDPR. So, you should implement your data breach protocol which you established when you decided to become a data controller. You did do that, right? ...
Dale M's user avatar
  • 213k
23 votes

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

"Article 5.3" here means the following from the ePrivacy Directive, 2002/58/EC, as amended amended by Directive 2009/136/EC. Member States shall ensure that the use of electronic ...
alexg's user avatar
  • 7,000
22 votes
Accepted

Does GDPR apply when PII is already publicly available?

The site would combine the data in novel ways, which is processing the data. Processing personal data which is publicly available is still processing personal data. You would have to take GDPR into ...
o.m.'s user avatar
  • 18.3k
20 votes
Accepted

Is a "login timestamp" considered as personal data according to GDPR?

The timestamp being among the data related to "an identified or identifiable natural person (‘data subject’)", the user, yes it is personal data. GDPR Article 4(1): ‘personal data’ means ...
Lag's user avatar
  • 17.3k
19 votes

Is scraping an iCal link legal?

Reading public data on the internet is not illegal. They published it for exactly that reason. So people would take an app and show them those fancy bytes in a way a human can understand them. Even if ...
nvoigt's user avatar
  • 8,133
18 votes

Are developers data processors?

(I work for a Data Processor, and so have to take GDPR training ever year.) If all you are in an independent contractor who writes the software and then hands it over to someone else, you're not a DP. ...
RonJohn's user avatar
  • 585
18 votes

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

No. when storing/accessing is strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service (Sometimes known as ...
Lag's user avatar
  • 17.3k
16 votes

GDPR: Can a city request deletion of all personal data that uses a certain domain for logins?

Can a city request deletion of all personal data that uses a certain domain for logins? Well, they can, but they have no legal backing to make it happen. Their chances of succeeding are about as good ...
nvoigt's user avatar
  • 8,133
14 votes

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

The first question is, is the school required to obtain your consent. The answer is highly jurisdiction-dependent. California is very protective of the individual's personality right and there are ...
user6726's user avatar
  • 215k
12 votes

Are developers data processors?

The data processor is the legal entity which operates the data processing system under orders of the data controller. A developer is a legal entity, and a developer might provide software as a service ...
o.m.'s user avatar
  • 18.3k
12 votes

Standards for data availability for internal employees

Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, ...
Dale M's user avatar
  • 213k
11 votes
Accepted

If website uses cookies only after users login, can I ask for cookie consent during account creation instead of website launch?

Under European rules (GDPR, ePrivacy), you only need consent here if you both access or store information on the user's device (such as cookies), and this access/storage is not strictly necessary for ...
amon's user avatar
  • 24k
11 votes

If this has nothing to do with GDPR, is this acceptable legally?

Simply put, there isn't enough information here to definitively say whether there's a GDPR violation here – taking the customer's personal info could have all sorts of GDPR-compliant purposes here, ...
motosubatsu's user avatar
  • 4,744
8 votes

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

Depending on jurisdiction, the right to any picture of you may be yours. Some countries allow taking and publishing pictures of you, as long as you are in public or on the picture taker's private ...
nvoigt's user avatar
  • 8,133
8 votes

Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?

No In the first place, that “right” applies when you go to court and it isn’t the right to know them, it’s a right “to examine or have examined witnesses against him…”. And, in certain circumstances, ...
Dale M's user avatar
  • 213k
8 votes

If this has nothing to do with GDPR, is this acceptable legally?

To cover the non-GDPR side, assuming EU consumer law: it's valid for the seller to ask for a proof of purchase. A receipt definitely is enough, but at their discretion they may also offer to locate ...
MSalters's user avatar
  • 5,751
8 votes
Accepted

GDPR compliance - Font Awesome

germany Is this form of tracking allowed under GDPR without prior consent No, and the responsible person is you the site owner. You decided to take your customers IP address and give it to ...
nvoigt's user avatar
  • 8,133
8 votes
Accepted

Collecting Pseudonymous order information without consent - GDPR

Data is personal information if it is or can be tied to an individual. A hash is problematic since it is merely pseudonymous and not anonymous. (Pseudonymization may be a good measure to mitigate the ...
o.m.'s user avatar
  • 18.3k
8 votes

Standards for data availability for internal employees

If you read further-on in the GDPR, article 32 gives you the answer, especially under In assessing the appropriate level of security account shall be taken in particular of the risks that are ...
Ljm Dullaart's user avatar
7 votes
Accepted

GDPR and privacy policy compliance for software used internally by customer company

Alice's business sells database management software. Organisations buy or licence the software, deploy it on hardware they control and use the software to help store and, process and analyse 'personal ...
Lag's user avatar
  • 17.3k
7 votes

Standards for data availability for internal employees

Data minimization means that the organization should not store unnecessary data (that is, "personal data shall be relevant and limited to what is necessary"). You are asking about access to ...
phoog's user avatar
  • 37.8k
7 votes
Accepted

Should restaurants provide information to the data subject when taking reservations

Is there any explanation as to why restaurants usually don't provide these information? I imagine it's mostly because it doesn't occur to the restauranteur, instead of a decision based on legal ...
Lag's user avatar
  • 17.3k
6 votes

GDPR Privacy Policy - how to handle non standard cases without much budget

If you want some boilerplate text to just drop in and have done, you are going to be disappointed. But you don't need a lawyer either. Treat it as a coding job. First, list all the ways you are going ...
Paul Johnson's user avatar
  • 13.6k
6 votes
Accepted

UK GDPR Transcribing calls

GDPR seems quite clear that if you are recording calls, video and/or audio, you must get consent. Wrong. The GDPR requires that your have a legal basis for processing personal data. Consent is a ...
Dale M's user avatar
  • 213k
6 votes
Accepted

Are deleted comments left by U.K. based users retained and subject to subject access under U.K. GDPR?

The answers are "yes" and "yes". The first "yes" being based on my experience as a moderator: if I can still see the "deleted" comments, then obviously they ...
nvoigt's user avatar
  • 8,133
6 votes
Accepted

Under which federal and / or state laws could GDPR be enforced in the United States?

The United States isn't a signatory to any treaty regarding recognition of foreign judgments, leaving those questions to the states, as per USC decision Hilton v. Guyot. Some states have enacted the ...
Nicolas Formichella's user avatar
6 votes
Accepted

Is the company still a GDPR data controller if all data is end-to-end encrypted?

This has been a matter of some speculation over the years and I'll admit I'm not 100% up to date on the current legal position. That said encrypted personal data is still considered personal data (...
motosubatsu's user avatar
  • 4,744

Only top scored, non community-wiki answers of a minimum length are eligible