Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
16 votes
2 answers
4k views

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
User65535's user avatar
  • 5,908
1 vote
0 answers
72 views

What data protection law was broken by Alison Rose lying about the reason for closing Nigel Farage’s bank accounts?

The former NatWest chief executive Alison Rose spoke to a BBC journalist about the planned closure of Nigel Farage’s bank accounts. It is in the news today that the ICO has said in a report said that ...
User65535's user avatar
  • 5,908
1 vote
1 answer
58 views

What is the likely penalty for an organisation failing to comply with a subject access request by many months, on the 1st, 2nd, and 3rd occasions?

ACME Inc. Receives a subject access request from Bob, and fails to respond to it for 5 months. What are the likely sanctions faced by ACME, in case this was the: 1st, 2nd, or 3rd Such incident of ...
Seeking answers's user avatar
3 votes
0 answers
78 views

When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?

When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately? There exists an argument ...
GolDDranks's user avatar
-4 votes
1 answer
94 views

Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?

Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to ...
Seeking answers's user avatar
0 votes
0 answers
38 views

Is jigsaw identification enough to render a piece of information DPA-subject “personal data“? [duplicate]

In some legal contexts there is the notion of “jigsaw identification,” that is pieces of information that could allow certain people if adequately placed and privileged to other pieces of information ...
Seeking answers's user avatar
0 votes
1 answer
103 views

Are outward facing security cameras’ footage on the outside of ambassadorial missions subject to subject access rights?

Bob walks past the front entrance of the embassy of the republic of Zwakilostan which is somehow under diplomatic protocols Zwakilostani sovereign territory. The cameras point outside toward the road ...
Seeking answers's user avatar
-6 votes
1 answer
56 views

Is the CPS a data controller for its defendants?

Alice was charged with an offence by the CPS. Is her file with the subject to the DPA 2018?
Seeking answers's user avatar
-1 votes
1 answer
74 views

Is it reasonable for a data controller to require proof of one’s address before honouring a subject’s right of access

Alice has requested access to her personal data from a shopkeeper. Barbara has submitted a SAR to a police force for BWV footage. They both require one item of identification and another for evidence ...
Seeking answers's user avatar
1 vote
1 answer
72 views

What Would be the Legality of a Company Paying Individuals for their Data?

Let's say I started a new social media company, which collects and sells it's users' data. To entice people to use my social media site, I give them a cut of the money that I get from selling that ...
Neil Svedberg's user avatar
4 votes
1 answer
92 views

How can Standard Contractual Clauses overcome Schrems II?

My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
baarkerlounger's user avatar
1 vote
1 answer
64 views

Does 2 party consent apply if the data is anonymized?

If I have a text conversation between myself and another party, both of whom reside in 2 party consent states in the US, if I remove all reasonably identifying information, do I still need consent ...
belkarx's user avatar
  • 234
-6 votes
2 answers
391 views

Is it legal for a business to deny me access to their store on the basis of how I look? [closed]

Is it legal for a business to use discriminatory (and notoriously false-positive) fingerprinting algorithms that prevent me from loading their website purely on the basis of how I look (as opposed to ...
Michael Altfield's user avatar
0 votes
0 answers
473 views

GDPR implications of email sent to a misconfigured host

I sent an email to a website's contact and my mailserver received this error: <...@...>: host ....mail.protection.outlook.com[104.47.70.110] said: 451 4.4.4 Mail received as unauthenticated, ...
Nemo's user avatar
  • 103
4 votes
1 answer
203 views

Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?

Suppose a person living in Colorado is a registered member of a church. In this church, certain “blessings” are considered contingent on your membership. Membership is recorded on a digital system. ...
moonman239's user avatar
  • 3,060
1 vote
1 answer
115 views

SARing received text messages from a lost phone

Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received. Bob loses his phone but ...
Seeking answers's user avatar
-3 votes
1 answer
100 views

Is compensation available for requested data improperly withheld and deleted against data subject’s wishes?

Bob requests data from ACME. They ask him for identification according to very unreasonable and onerous requirements. He objects to these on grounds of infeasibility and inaccessibility. They bicker ...
Seeking answers's user avatar
-2 votes
2 answers
94 views

Can personal data compelled by police able to be disclosed to a private business?

Bob is ejected from a private business as the police are called because the security guard felt his dietary proclivities were socially unacceptable in public. The police arrived and Bob was already ...
Seeking answers's user avatar
5 votes
2 answers
749 views

How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?

Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. ...
CarrotsHamster's user avatar
1 vote
0 answers
63 views

Receive written confirmation about non-breached data

Context: I am working for an institution which has recently suffered a data breach. There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
Vassilis Markos's user avatar
2 votes
0 answers
32 views

Does article 8 of the European Convention protect against the dissemination of sensitive information about a research subject in scientific research?

I have a couple of questions related to the scope of Article 8(1) of the European Convention on Human Rights and who can be responsible for infringements in the rights outlined in the article. My ...
ahcrd's user avatar
  • 21
8 votes
1 answer
3k views

Can a non-profit organization record attendance by name without permission?

I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
Tripartio's user avatar
  • 201
2 votes
0 answers
44 views

Search engine data breaches, osint

Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
J.G.'s user avatar
  • 43
0 votes
1 answer
245 views

Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?

Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls. The fact that it's now allowed again makes me wonder if Italy (and the ...
GDPR's user avatar
  • 47
3 votes
1 answer
70 views

GDPR protection for non-EU individuals by using EU services through VPN use?

REASON FOR QUESTION: I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
Bruno Genovese's user avatar
4 votes
1 answer
251 views

Choosing DPA to submit data breach complaint (EU-specific)

Context The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it. The offenders ...
Vassilis Markos's user avatar
4 votes
1 answer
98 views

How does GDPR's right to erasure apply to deduplicated storage?

I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case: Company A offers a online data storage service that is intended to be used by the users ...
Tomas's user avatar
  • 43
6 votes
2 answers
621 views

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
Seeking answers's user avatar
0 votes
1 answer
65 views

Can a user opt-out of embedded services without prior account-linking?

Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
Martin Braun's user avatar
0 votes
0 answers
13 views

Can a B2B outbound sales lead generation company legally capture and sell publicly available information without the consent of the leads?

I am researching the business model of a B2B outbound sales lead generation company that captures publicly available information for professionals such as name, company email, LinkedIn, Twitter, ...
Jason Spanomanolis's user avatar
0 votes
2 answers
47 views

Official source for Data Export legislation (UK)

I need to find an official source for "Data Export" legislation that applies within the UK, I have searched the .GOV websites and found various pages that refer to physical item (military ...
Darkcat Studios's user avatar
0 votes
1 answer
112 views

Is it legal to store Singapore user data outside Singapore?

I am based out of india and has intent to launch the website in Singapore for singapore usesr where datastores and webservers will be hosted on data center in india. Is there any data protect act in ...
M Sach's user avatar
  • 109
-3 votes
1 answer
94 views

Do investors have any copyrights on the application they invest on?

Considering I am the founder of Instagram, it means I have written 100% of the application code by myself, then found an investor and they put some money into the startup and got 30% of the new ...
best_of_man's user avatar
1 vote
1 answer
38 views

GDPR When using an external CV formatting company

As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
Sara's user avatar
  • 11
0 votes
1 answer
146 views

Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?

ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
Seeking answers's user avatar
10 votes
2 answers
2k views

GDPR - Are technical identifiers personal data?

I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
kol's user avatar
  • 203
0 votes
1 answer
37 views

Can a Data Controller refuse a second SAR from the same person?

Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
David Siegel's user avatar
2 votes
0 answers
77 views

Is there anything to stop a subject access requester from being barred by a business?

A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
Seeking answers's user avatar
1 vote
0 answers
32 views

A question about the Rehabilitation of Offenders Act. UK

Suppose I get an offer to study a PhD, and in the application procedure I was not asked about a criminal record at all. According to the rehabilitation of offenders, I can choose to withhold my ...
HMPtwo's user avatar
  • 155
1 vote
1 answer
96 views

Can a student ask other students about their grades and then publish an average under FERPA?

Can a student ask other students (>14) to fill out an online form disclosing their grade on an assignment and then publish an average of the grades? Or is the implicit permission given by filling ...
belkarx's user avatar
  • 234
3 votes
1 answer
166 views

What is the legal basis for a Schengen country embassy to call the hotel to confirm the applicant's reservation?

When applying for a Schengen visa, an applicant is typically required to provide a proof of accommodation. Often it's a screenshot from a hotel aggregator, or an email from a hotel (if booked directly)...
yeputons's user avatar
  • 131
-1 votes
1 answer
77 views

How to make sure your startup or project idea is not stolen or given away when sharing it with professors or sources of support [duplicate]

Say you have an idea for which you can appreciate some intellectual and financial support. For this you may reach out to different sources, such as university professors or research institutes that ...
Alejandro's user avatar
  • 230
0 votes
0 answers
16 views

Is there a legal context regarding non-personal data retention for older SAS clients? [EU]

Can EU based SAS company keep non-personal data that what created by an former EU-based client (for example blog posts/)? If yes for how long?
borisrorsvort's user avatar
8 votes
1 answer
725 views

Does gdpr.eu violate GDPR compliancy?

As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
panda-byte's user avatar
2 votes
1 answer
77 views

What is the status of Meta's fine for breaking the EU privacy laws during the appeal?

Today it was in the news that Meta (owner of facebook) was fined 390 million Euros for GDPR violation by the Irish data protection officer. They were also told they have 3 months to change their user ...
quarague's user avatar
  • 3,298
12 votes
3 answers
7k views

Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people?

I remember some password managers like Google's would give me a warning about passwords that have been compromised. My question is this. How is Google or any company able to see that the password I ...
devin's user avatar
  • 237
-1 votes
1 answer
63 views

Choosing region for database to be US / EU compliant

I wanted to ask about how one should go about choosing region for database / cloud provider when working on an application that stores user data for EU and US customers. Business behind the app is a ...
Ilja's user avatar
  • 101
0 votes
2 answers
137 views

Can a mobile app save data about a user without a user giving the permission?

Is it allowed to store a user id to remember him, his settings, preferences and history, without asking for his permission? Is there anyknowledge about that how that goes with privacy laws like GDPR ...
Sir hennihau's user avatar
1 vote
0 answers
74 views

Can Bob, as the client, share any information about his project in any way he wants?

Bob hires vendor A and vendor B independently to work on a project for Bob. The two vendors are not partners, they work independently and do not communicate with each other although they are aware of ...
Skies's user avatar
  • 348
-1 votes
2 answers
117 views

How restrictive is the General Data Protection Regulation (GDPR) in Europe?

Lets say that I want to take a picture or record a video of a city I am visiting in Europe and like its inevitable people will appear in the picture or video. I cannot do this before asking permission ...
S. Feunmajer's user avatar

1
2 3 4 5
7