Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
0 votes
1 answer
99 views

Are javascript keyloggers on websites legal?

I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
user avatar
  • 1,271
10 votes
2 answers
3k views

Can I store the names of arbitrary business associates in my CRM system?

I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships. For example, "Gina works on reception." Is this allowed ...
user avatar
0 votes
0 answers
43 views

Is my app's displaying of email IDs illegal from a data privacy perspective?

I am building an app that will easily help connect Spotify playlist curators with artists who are trying to promote their music. As part of this, i would like my app to display names and business ...
user avatar
3 votes
2 answers
58 views

Does obscuring personally identifiable and directory information avoid potential FERPA violations?

Say I have a database of students, each with a unique ID, GPA, placement test scores, and some demographic information (nothing personally identifiable). The ID is generated using a one-way ...
user avatar
2 votes
1 answer
51 views

Can (public) schools monetize data collected from students (13+) in the US?

Does CCPA impact whether or not this is allowed? Is it implicitly implied that information can be collected by attending school? Is there different guidance for public (government-managed and ...
user avatar
  • 184
22 votes
2 answers
3k views

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
user avatar
  • 231
3 votes
1 answer
89 views

Do sites need to explicitly ask for cookie consent as of 2022?

I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the ...
user avatar
0 votes
1 answer
68 views

What are the limits of ID requirements for a subject access request?

When one makes a subject access request it is required that the data controller is required to ensure the identity of the requestor, to prevent unauthorised individuals accessing personal data of ...
user avatar
  • 1,271
1 vote
3 answers
97 views

How to avoid having problem with data protection regulations (GDPR)?

I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by ...
user avatar
0 votes
1 answer
55 views

What global big tech does to comply with data protection laws all over the world?

Give this scenario... A user in Germany, a user in US. Each one decides to create an account on Facebook and facebook is located in US... According with GDPR, US cannot store data from EU Citizens. So,...
user avatar
  • 111
0 votes
1 answer
37 views

What is the correct responce of a data processor to a SAR if they have multiple controllers?

In the case where a subjects data handled both by a data controller and a data processor, and the subject makes a data subject access request (SAR) of the processor the usual procedure if for the data ...
user avatar
  • 1,271
0 votes
0 answers
53 views

Is it illegal to allow a minor to participate in a site satisfaction survey?

Consider some imaginary website, run by a US legal entity - let's call it Whack Stove Reflow - has registered users, some of whom are under 18. This imaginary website wants to take a community ...
user avatar
  • 569
1 vote
1 answer
29 views

What references are available for the GDPR legitimate interests balancing test?

A basis for the processing of personally identifiable data (PII) is legitimate interest. According to the UK ICO data controllers who rely on this basis should conduct a legitimate interests ...
user avatar
  • 837
0 votes
1 answer
51 views

How does GDPR Art. 14 apply to large scale B2B data transfer

Article 14 of the GDPR appears to require any data controller to inform the data subject when a business to business transfer of personal data occurs. Business to business transfer of personal data ...
user avatar
  • 1,271
1 vote
1 answer
61 views

Under GDPR can a company give out the demographics of employees e.g. ethnic background without anonymising it?

If a client asks for the demographics of a company's employees e.g. female to male ratio or ethnicity. Does this have to be anonymised so it is compliant with the GDPR or can the names be revealed?
user avatar
  • 231
2 votes
1 answer
78 views

Can I use forum posts related to user to analyze them?

I would like to create an app, which would make analyses based on user behaviors, posts, comments. I can gather those data from sites, forums because e.g twitter and so are public websites, they are ...
user avatar
  • 123
1 vote
1 answer
54 views

How long should I wait for a Data Access Request in Ireland

A few weeks ago I made a Data Access request to an Irish company I've been doing business with for just over 10 years. I've not received any sort of response - not even an acknowledgment of my e-mail. ...
user avatar
  • 13
1 vote
1 answer
80 views

GPDR: Are third party companies alowed to track my e-mails

I live in Ireland and I've been doing business with an Irish company. That company has using a third party for its main IT system and this system has been sending me e-mails. Just recently I've had a ...
user avatar
30 votes
2 answers
5k views

How can the UK government fine itself?

In this news story the UK government has been fined £500,000 but who is doing the fining? Is the government fining itself?
user avatar
  • 561
1 vote
0 answers
121 views

Is YouTube legally required to not allow "Made For Kids" videos to be added to playlists?

In the last few years YouTube introduced a Made For Kids classification for videos, which requires uploaders to state whether a given video is made for children, in which case certain features are ...
user avatar
2 votes
0 answers
57 views

Could a cell phone carrier sell this privacy plan?

Suppose Verizon offered a "privacy plan" (e.g., for $50 extra per month) in which they intentionally delete any location/ping/connection/dialing history data from their servers/towers such ...
user avatar
  • 889
0 votes
0 answers
22 views

Are there any special requirements for UK employer for processing its employees data in another country?

Some background to this question. I'm asking as an employee wondering if a company that hired me can keep my details anywhere in the world, if I have any say in that and to see what special ...
user avatar
1 vote
1 answer
99 views

Is it illegal for a school to take photos of children during online classes?

Consider a situation where some students are required to turn on the camera during online classes - my question is: If a student's facial image is collected during online classes, is parental consent ...
user avatar
1 vote
1 answer
100 views

How to notify Facebook of no consent to their use of my information?

I do not have a Facebook account (and never had one under any alias). I'd like to notify Facebook that I do not consent to their storing / displaying any information related to me (images of me, name ...
user avatar
  • 127
-1 votes
2 answers
103 views

Under GDPR's strict consent requirement rules, could a criminal/hacker/troll remain anonymous in all his activities?

Since GDPR strictly requires consent to Personal Identifiable Information (PII), could a criminal exploit online services by remaining anonymous in all his criminal activities? Providers are not ...
user avatar
  • 1,441
12 votes
5 answers
4k views

Does the law give provisions for well known service providers to deny service if users don't accept their privacy policy?

Service providers like Google and Facebook are pretty much part of people's lives. Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
user avatar
  • 1,441
2 votes
1 answer
100 views

Date Privacy and Twitch; Do I have the right to access my chat logs?

Under Data Privacy laws, the user has a right to access their data, erasure, etc. Yet under Twitch the users have no way to access their own logs, only the streamer and a team of mods. This has always ...
user avatar
  • 23
0 votes
1 answer
44 views

GDPR Compliance - Password Protected Documents in AutoRecovery

I'm working with personnel data in my job, including lots of details which I know to be sensitive and most certainly covered by GDPR. In order to maintain compliance with the regulations while ...
user avatar
  • 1
3 votes
1 answer
61 views

Site user posts data under licnese, can user demand erasure?

Suppose that a site, run as a free service, allows communication between users (a chat site). Suppose that the site also permits users to optionally upload text documents or images, which will be ...
user avatar
  • 89.6k
8 votes
2 answers
2k views

Are there ways of storing personal data beyond standard GDPR limitations?

So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data. ...
user avatar
0 votes
2 answers
236 views

Is Google's Consent Management Platform not GDPR compliant since it does not show a consent form when 'personalised ads' are disabled?

This question borders the line between technical and legal but I am posting here because it is not a coding problem in itself. Apologies if this is the wrong forum. I have set up my mobile app to use ...
user avatar
4 votes
2 answers
129 views

Is it legal to process PII in EU of customers which are not in EU?

So I have an app that processes the PII of users and their interests, the app is south Asia based. The app doesn't support EU customers and is geo-blocked by default. I would like to process and store ...
user avatar
9 votes
1 answer
1k views

Denied Data Subject Access Request (DSAR) due to third-party information

A while ago I made a data subject access request (DSAR, asking for personal information which is stored about me) which was part of an ongoing complaint. In a nutshell, I did a complaint to a company ...
user avatar
  • 241
1 vote
1 answer
94 views

How long can a company take to answer my GDPR request to download my data?

In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be ...
user avatar
0 votes
1 answer
95 views

Is there generally a duration after which a permission given to a person is terminated automatically?

Consider the following as an example: Jack and Sam were both 18 years old. At the time, both were good friends, and Jack has given Sam permission to use his e-mail account for sending and reading e-...
user avatar
0 votes
0 answers
20 views

General Data Protection Regulation- Responsibility & consequences

Currently I am working for a company/foundation that technically doesn't exist yet, but I have to get a few thing in order and I was wondering about the legal ramifications of a few aspects. To ...
user avatar
  • 101
2 votes
1 answer
105 views

Would it be legal to sequence human DNA from wastewater?

DNA can Identify Individuals I have asked this question in the biology stackexchange. Below the law part: I know that there are some efforts from scientists working with bladder cancer to perform ...
user avatar
  • 123
0 votes
1 answer
109 views

The Data ownership for an automated server running for years prior to GDPR Regulations

Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various ...
user avatar
1 vote
1 answer
344 views

Impact of GDPR on remote work outside of the EU (as LLC)?

I do remote work for clients in the EU. The legal foundation is a B2B contract between two EU legal entities, one of which is the client's limited company, the other my limited company. Since both ...
user avatar
0 votes
1 answer
172 views

GDPR - Are the typical lists of examples for personal data misleading?

Article 4 of the EU GDPR states ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); The explanation for the term ‘personal data’ as ...
user avatar
0 votes
0 answers
42 views

Is [company] breaching any data protection legislation in Canada needing my wife's details to authenticate MY account?

I created an online account in my name with a large Canadian retailer. My wife enters her credit card details to pay for the shopping. When I log in to the website it greets me with my name. When I ...
user avatar
0 votes
1 answer
32 views

EU privacy and data protection law for small WhatsApp group

We have created a small WhatsApp group to feed poor people and street children who are Covid affected in India. We are people from the EU, US, Australia and even from India. Members want transparency ...
user avatar
1 vote
1 answer
71 views

Does the Data Protection Act 2018 in UK require users of a website to explicitly

Now that Brexit has happened, GDPR no longer takes effect in UK. However, the Data Protection Act 2018 will continue to apply. With GDPR's Article 6, a website is required to request explicit consent ...
user avatar
  • 973
5 votes
1 answer
163 views

GDPR unbelievable legitimate interest. What action to take?

If a website is claiming legitimate interest in data collection in a way that is unbelievable is there any action that a web site visitor can take? For example, if one was to visit The Daily Mail you ...
user avatar
  • 837
1 vote
2 answers
77 views

The UK GDPA article 17 right to erasure. Can I retain the person's ID number if it no longer identifies them?

I manage a small relational database for members of a club with about 600 members. The 'member' table has records holding the memberID , their name, address phone etc. The memberID is then used as a ...
user avatar
1 vote
2 answers
155 views

How long can an employer keep financial details after employee has left under GDPR?

I finished a job in 2019, but just received notification of a data breach at that job in 2021, and my bank account number, sort code, national insurance number, full name, address and date of birth ...
user avatar
  • 323
2 votes
0 answers
34 views

GDPR data deletion: can I ask the company to delete the data it had exported in the United States?

I am located in Italy. I have subscribed to a service and provided some PII that "could be exported in the United States". If I send a GDPR request to delete my data, can I ask them to also ...
user avatar
2 votes
0 answers
40 views

GDPR data deletion: do I have a right to have the company specify which data it retained and why?

I requested the DPO of a company to delete all my data under GDPR. After a step of "account ownership" verification, it replied that: XXXX has deleted all of your personal data except where ...
user avatar
3 votes
1 answer
53 views

What is a "sealed" document?

When reading about T.J Miller, I noticed one sentence Student conduct proceedings were held, the results of which are sealed (...) What is the legal framework for such "sealing" of ...
user avatar
  • 1,677
1 vote
1 answer
50 views

Can I use an Employee's Personal ID in an company internal project? (EU Data protection Law)

I want to create an Order-Website for our company, where employees can order dishes from the canteen, so they know roughly how much food to order. Now the question came up, if you order some dish, but ...
user avatar

1
2 3 4 5