New answers tagged gdpr
1
Article 32 of the GDPR requires companies to adequately secure their data when handling data belonging to EU citizens. This also applies to cross border scenarios where data is transferred between countries.
Technically speaking, the GDPR doesnt set a standard for security: you dont have to encrypt your data, use aes or rsa encryption, or hash and salt ...
0
From my understanding, while not illegal, it is a very , not to be rude but, unintelligent practice. I can't speak on GDPR or foreign laws as an American. I've seen protected information sent via email, for example an email sent to my mother in which I was asked to look at, contained sensitive data and include an NDA covering the contents of the ...
2
GDPR and domestic French legislation applies to data held by the state (with some exceptions)
Most French government sites seem to place the information consistently at the bottom of the page under Personal Data and Cookies (Données personnelles et cookies). For the Ministry of Education:
Vous pouvez accéder aux données vous concernant et exercer vos ...
2
The GDPR right to erasure /to be forgotten only applies in comparatively limited circumstances and has many exceptions. They can more or less claim that they will need to keep some of your data for purposes like fraud prevention.
Furthermore, they have a month until they have to execute any GDPR request. Where you want to to exercise your GDPR rights they ...
1
This might be an unnecessary subtle point, but the goal of the GDPR isn't to protect personal data as some abstract concept – it regulates how personal data can be processed. For an organisation's compliance obligations, it matters for what purposes they collect and process personal data. You can't shove sensitive personal data on an unsuspecting recipient ...
1
Password fields are the least of your worries, actually. You shouldn't be storing passwords anyway, and the type of processing you should be doing on them (salt & hashing) is not covered under the GDPR.
But your more general problem is indeed a real concern. However, the impact here is limited. Such a "general" field wouldn't be subject to specific ...
1
Yes
You are confusing personal data with data that can identify a person
Any data that is connected to a person is personal data: my friends list on Facebook, the record of the tweets I’ve viewed on Twitter, my recently watched video list on YouTube, and, yes, my password on any given website. None of that data on its own may be able to identify me but if ...
0
In this situation, EU regulations will cease to be law in the UK the minute that the UK leaves the EU. However, the UK has been preparing for this and at the same moment, all those regulations should be replaced with UK laws (properly modified where necessary). So assuming the UK can get their act together, everything will stay the same.
EU directives on ...
4
GDPR does not require consent. It requires a legal basis. Consent is only one legal basis among many. Some other legal bases are:
legitimate interest (implying an opt out solution)
necessity for performance of a contract
If your customers pay you to deliver email updates, that contract is the legal basis for sending email updates. The only wrinkle is that ...
2
This is an interesting question. The general rule in common-law systems is that the law at the time of the alleged offense applies, unless the law that makes a change explicitly provides otherwise. So this might depend on the exact terms of the parliamentary action by which the UK withdraws from the EU.
However, it is worth noting that the GDPR applies, or ...
1
Yes, GA requires consent even when only collecting anonymous data. The issue is that GA stores a client identifier as a cookie in the visitor's browser.
PECR/ePrivacy require consent if you access any data on a users device where that data is not strictly necessary. Analytics are not strictly necessary, therefore you need consent when using analytics ...
1
No, this would not be legal under PECR as it requires consent from the user (although it may depend on the laws of the country where the company is situated if they're applied or not):
What do we need to do to comply?
The rules on cookies are in
regulation 6. The basic rule is that you must:
tell people the cookies are there;
explain ...
2
In principle, using email as an opt-out mechanism could be ok, at least in theory. But I see three issues with this:
A website visitor might not have an email address, yet the data controller is still required to honour the data subject's rights. (This might be far-fetched, but edge cases are interesting.)
The GDPR allows opt-out when the processing is ...
1
Personal data is any information relating to an identifiable person, the data subject. Here, the “second degree user” (the passenger) is a data subject of your system. They have all the data subject rights, including the right to erasure.
It doesn't make sense to talk about anonymization here. In the GDPR, anonymization means removing identifying data so ...
1
Any website or app potentially has access to personal data. You decide how this data will be processed, so you are a Data Controller and must comply with the GDPR This includes obligations such as providing privacy policy style information and assessing potential risks for your users.
If you are not using any of the data you have access to, that makes ...
2
Do I need to inform the user about storing the score locally?
No, there is no need as long as you don't transmit, store or process any personal info. It's doubtful that the score could be considered personal info, but you're not sending it to your servers in any way, so you don't seem to be processing it anyway.
Do I need consent for using non-personal ...
0
You don't need to inform the user about storing the score locally.
You don't need consent for using non-personal AdMob ads.
You don't have to ask for age unless the law requires: this is usually when your app displays sexual content
You can state in the user agreement that the user is not allowed to use your app if they do x, but unless you have a way ...
1
Personal data is any information relating to an identifiable person. The review relates to you, so you are the data subject and have a right to access. Airbnb is not required to provide this information through their normal procedures (e.g. their website interface), but would have to produce this information in response to a data subject request.
An ...
10
The GDPR gives controllers a lot of latitude. They must decide on the correct course of action taking into account the possible risks to data subjects. Specifically, no notification of the authority is necessary if “the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.”
In your scenario 1, you suggest that ...
2
The GDPR requires data controllers to use appropriate organizational measures to protect the data. It is the controller's job to decide which measures are appropriate, taking into account possible risks.
For an employment context, I'd think the important part is that anyone accessing this data is bound to discretion regarding the data they will see. Whether ...
Top 50 recent answers are included
