108
votes
Accepted
Why do some GDPR emails require me to opt-out and some to opt-in?
It is not clear that the first kind of email is legal. A French association, la Quadrature du Net, is planning to launch a class action against five big tech companies (the famous "GAFAM") on May 28th ...
- 992
44
votes
Accepted
Is displaying email addresses in an application log file allowed under GDPR?
The goal of GDPR is about protecting personally identifiable information (PII) as much as possible. The interaction of a specific user with your application are pretty sure such PII.
If you really ...
- 208k
38
votes
Accepted
Hashing email addresses for GDPR compliance
MD5 or SHA is not the concern. Hashes can be used for pseudonymization. The problem is that the hash would need to be salted (or peppered) so that data from other sources could not be used to identify ...
- 132k
32
votes
Is displaying email addresses in an application log file allowed under GDPR?
Logging data is not the issue under GDPR. The part that matters is what happens to the log, who can see it, how long it is stored, what the log is used for, and if you can satisfy the rights of the ...
- 132k
22
votes
Accepted
Is gender considered PII (Personally Identifiable Information) under the GDPR?
The definition of personal data as mentioned in the GDPR:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural ...
- 1,736
19
votes
Why do some GDPR emails require me to opt-out and some to opt-in?
Some quotes from the GDPR law:
[...] Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to ...
- 15.9k
12
votes
Accepted
How to handle emails as usernames under GDPR?
IANAL, but GDPR does not make encryption mandatory for personal data. Read this article to understand the complexity around encryption and GDPR better.
In the GDPR encryption is explicitly ...
11
votes
Why do some GDPR emails require me to opt-out and some to opt-in?
The 1st category are the big companies (like large e-mail providers) that will do what they want anyway and since you want to use their service you will have accept their conditions. Not doing that ...
- 8,939
10
votes
Why do some GDPR emails require me to opt-out and some to opt-in?
Firstly, there's no case law yet, and different lawyers are interpreting the rules in different ways: some are playing very safe, others are sailing closer to the wind. Some probably reckon that they ...
- 491
9
votes
Accepted
If I'm PCI-DSS compliant, do I need to worry about GDPR?
Assuming GDPR apply to your organization, yes you should worry about GDPR.
PCI-DSS compliance doesn't imply GDPR compliance.
There are many concept present in GDPR and not in PCI-DSS or not with the ...
- 572
8
votes
Accepted
Does it make sense to encrypt database to comply with GDPR?
On Compliance
I'm only loosely familiar with the specifics of the legislation, but as I understand it, there's nothing to indicate that database encryption is required to hold personal information ...
- 4,028
8
votes
Is gender considered PII (Personally Identifiable Information) under the GDPR?
TLDR: Possible
From https://www.seobyrvc.com/what-is-personally-identifiable-information-pii/:
The following are examples of “potentially personally-identifiable information”. That is, the data ...
- 594
8
votes
Is displaying email addresses in an application log file allowed under GDPR?
Article 5 of GDPR specified the basic principles for processing data.
Article 5 "Principles relating to processing of personal data"
(1) Personal data shall be:
...
(b) collected for ...
- 191
6
votes
Why do some GDPR emails require me to opt-out and some to opt-in?
As other answers have stated, GDPR requires explicit, informed, unambiguous consent. Plus, according to the accountability principle, data controllers shall be able to demonstrate that.
In theory:
...
- 161
6
votes
Accepted
EU GDPR - Data protection requirement standards missing?
In the GDPR regulation (Article 39, on page 7), it says
Personal data should be processed in a manner that ensures
appropriate security and confidentiality of the personal data,
...
- 491
5
votes
Caching personal data: GDPR
The law is about what you are allowed to store and targets your infrastructure. And the law is intended to give the user control over his data.
The client cache belongs to the client's infrastructure ...
- 3,472
5
votes
Does GDPR apply to generic service providers?
Technically, the Data Controller is responsible for making sure all processes are GDPR compliant. That means that whoever uses your service needs to make sure that they are being compliant. If they ...
- 132k
5
votes
Why do some GDPR emails require me to opt-out and some to opt-in?
On top of the areas already mentioned here, there's a section of GDPR relating to data retention. A lot of the e-mails which are asking people (or at least the ones I am getting) to opt in are also ...
- 384
5
votes
Accepted
Documentation for GDPR best practices for partially masking email addresses
There is no official guidance because this is not a GDPR enforced requirement. GDPR does not regulate specific security measures beyond making recommendations about what you should consider. Since you ...
- 8,939
5
votes
Accepted
Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?
From a pure security standpoint, I see 3 possible improvements to your system:
Using a slow hash like bcrypt. It is serveral order of magnitude slower than SHA-1. Your application won't be impacted, ...
- 14.7k
5
votes
Does GDPR apply for volatile data
The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to ...
- 15.9k
4
votes
Accepted
Tokenization - Is it bad practice to reuse tokens?
Yes, it introduces risk, but might be required, depending on what you're doing with the data.
Imagine a database of lots of people. Perhaps it includes names, addresses, and dates of birth, but the ...
- 27.4k
4
votes
Accepted
GDPR Deletion Request Tracking Paradox - Suppression Lists
It is exactly the right thing to have a deletion request management system. In fact, given the importance of this function, the timeframes for response, the workflows to coordinate, it is almost ...
- 3,577
4
votes
Accepted
Steps to make website GDPR Compliant
There is no binary answer to be 'GDPR compliant'. There are however some steps you can take to be compliant to some extend. Key element to the GDPR is that you need either explicit permission from ...
- 1,634
4
votes
Hashing email addresses for GDPR compliance
Realistically, pseudonymization is any method of obfuscating someone's PII/NPI so that it can't be reasonably traced back to one certain individual. GDPR doesn't necessarily dictate what hashing ...
4
votes
Documentation for GDPR best practices for partially masking email addresses
GDPR is more restrictive than the US definition of PII, in which, non-PII that allow any inference to the identities is also under GDPR jurisdiction.
I doubt given masking examples will withstand ...
- 2,417
3
votes
If I'm PCI-DSS compliant, do I need to worry about GDPR?
If you are selling goods or services to EU residents, then yes. GDPR regulation is different from PCI-DSS. Even if you are compliant with PCI-DSS, that doesn't mean you are compliant with GPPR. ...
3
votes
Is a company decrypting all SSL traffic through a Root CA GDPR compliant?
The problem with the GDPR lies in the remark: "without even notifying this software is being installed". In that case: no it is not compliant.
If you dig a little deeper, you will find that in almost ...
- 2,180
3
votes
Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?
As long as you are not storing IP addresses alongside other personally identifiable information, they do not have to be handled under GDPR rules. They only become sensitive when enriched with a user's ...
- 49
3
votes
Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?
GDPR requires reasonable protection of such data but does not totally forbid storing these data. Since the hashes are only stored on the server (where the attacker should have no access anyway and ...
- 208k
Only top scored, non community-wiki answers of a minimum length are eligible