Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
306
questions
0
votes
1
answer
38
views
Are outward facing security cameras’ footage on the outside of ambassadorial missions subject to subject access rights?
Bob walks past the front entrance of the embassy of the republic of Zwakilostan which is somehow under diplomatic protocols Zwakilostani sovereign territory. The cameras point outside toward the road ...
- 7,167
-6
votes
1
answer
50
views
Is the CPS a data controller for its defendants?
Alice was charged with an offence by the CPS. Is her file with the subject to the DPA 2018?
- 7,167
-1
votes
1
answer
68
views
Is it reasonable for a data controller to require proof of one’s address before honouring a subject’s right of access
Alice has requested access to her personal data from a shopkeeper.
Barbara has submitted a SAR to a police force for BWV footage.
They both require one item of identification and another for evidence ...
- 7,167
1
vote
1
answer
66
views
What Would be the Legality of a Company Paying Individuals for their Data?
Let's say I started a new social media company, which collects and sells it's users' data. To entice people to use my social media site, I give them a cut of the money that I get from selling that ...
-4
votes
0
answers
72
views
What is the regime for calculating compensation for data breaches?
There seem to be firms that basically specialise in this as their business model… so there must be a reliable basis for predicting damages whether it is an established body of case law or statute ...
- 7,167
-1
votes
0
answers
77
views
What does Publicly Available mean under CCPA?
Are a collection of deed owners (real names), postal addresses, property attributes derived from county records, regulated by CCPA?
CCPA (California Consumer Privacy Act) 1798.140 (v)(2) “Personal ...
4
votes
1
answer
85
views
How can Standard Contractual Clauses overcome Schrems II?
My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
- 143
1
vote
1
answer
64
views
Does 2 party consent apply if the data is anonymized?
If I have a text conversation between myself and another party, both of whom reside in 2 party consent states in the US, if I remove all reasonably identifying information, do I still need consent ...
- 234
-6
votes
2
answers
324
views
Is it legal for a business to deny me access to their store on the basis of how I look? [closed]
Is it legal for a business to use discriminatory (and notoriously false-positive) fingerprinting algorithms that prevent me from loading their website purely on the basis of how I look (as opposed to ...
- 180
0
votes
0
answers
181
views
GDPR implications of email sent to a misconfigured host
I sent an email to a website's contact and my mailserver received this error:
<...@...>: host ....mail.protection.outlook.com[104.47.70.110] said:
451 4.4.4 Mail received as unauthenticated, ...
- 103
4
votes
1
answer
195
views
Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?
Suppose a person living in Colorado is a registered member of a church. In this church, certain “blessings” are considered contingent on your membership. Membership is recorded on a digital system.
...
- 3,060
1
vote
1
answer
114
views
SARing received text messages from a lost phone
Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received.
Bob loses his phone but ...
- 7,167
-3
votes
1
answer
100
views
Is compensation available for requested data improperly withheld and deleted against data subject’s wishes?
Bob requests data from ACME. They ask him for identification according to very unreasonable and onerous requirements. He objects to these on grounds of infeasibility and inaccessibility. They bicker ...
- 7,167
-2
votes
2
answers
90
views
Can personal data compelled by police able to be disclosed to a private business?
Bob is ejected from a private business as the police are called because the security guard felt his dietary proclivities were socially unacceptable in public. The police arrived and Bob was already ...
- 7,167
5
votes
2
answers
745
views
How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?
Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. ...
1
vote
0
answers
63
views
Receive written confirmation about non-breached data
Context:
I am working for an institution which has recently suffered a data breach.
There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
- 153
2
votes
0
answers
32
views
Does article 8 of the European Convention protect against the dissemination of sensitive information about a research subject in scientific research?
I have a couple of questions related to the scope of Article 8(1) of the European Convention on Human Rights and who can be responsible for infringements in the rights outlined in the article. My ...
- 21
8
votes
1
answer
3k
views
Can a non-profit organization record attendance by name without permission?
I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
- 201
2
votes
0
answers
38
views
Search engine data breaches, osint
Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
- 43
0
votes
1
answer
185
views
Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?
Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls.
The fact that it's now allowed again makes me wonder if Italy (and the ...
- 47
3
votes
1
answer
53
views
GDPR protection for non-EU individuals by using EU services through VPN use?
REASON FOR QUESTION:
I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
4
votes
1
answer
248
views
Choosing DPA to submit data breach complaint (EU-specific)
Context
The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
The offenders ...
- 153
4
votes
1
answer
91
views
How does GDPR's right to erasure apply to deduplicated storage?
I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case:
Company A offers a online data storage service that is intended to be used by the users ...
- 43
6
votes
2
answers
602
views
Is a sent email in someone else’s inbox subject to data subject rights of the sender?
Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
- 7,167
0
votes
1
answer
63
views
Can a user opt-out of embedded services without prior account-linking?
Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
- 111
0
votes
0
answers
13
views
Can a B2B outbound sales lead generation company legally capture and sell publicly available information without the consent of the leads?
I am researching the business model of a B2B outbound sales lead generation company that captures publicly available information for professionals such as name, company email, LinkedIn, Twitter, ...
0
votes
2
answers
45
views
Official source for Data Export legislation (UK)
I need to find an official source for "Data Export" legislation that applies within the UK, I have searched the .GOV websites and found various pages that refer to physical item (military ...
- 101
0
votes
1
answer
63
views
Is it legal to store Singapore user data outside Singapore?
I am based out of india and has intent to launch the website in Singapore for singapore usesr where datastores and webservers will be hosted on data center in india. Is there any data protect act in ...
- 109
-3
votes
1
answer
91
views
Do investors have any copyrights on the application they invest on?
Considering I am the founder of Instagram, it means I have written 100% of the application code by myself, then found an investor and they put some money into the startup and got 30% of the new ...
- 249
1
vote
1
answer
36
views
GDPR When using an external CV formatting company
As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
- 11
0
votes
1
answer
95
views
Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?
ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
- 7,167
10
votes
2
answers
2k
views
GDPR - Are technical identifiers personal data?
I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
- 203
0
votes
1
answer
35
views
Can a Data Controller refuse a second SAR from the same person?
Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
- 112k
2
votes
0
answers
67
views
Is there anything to stop a subject access requester from being barred by a business?
A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
- 7,167
1
vote
0
answers
32
views
A question about the Rehabilitation of Offenders Act. UK
Suppose I get an offer to study a PhD, and in the application procedure I was not asked about a criminal record at all. According to the rehabilitation of offenders, I can choose to withhold my ...
- 155
1
vote
1
answer
67
views
Can a student ask other students about their grades and then publish an average under FERPA?
Can a student ask other students (>14) to fill out an online form disclosing their grade on an assignment and then publish an average of the grades?
Or is the implicit permission given by filling ...
- 234
3
votes
1
answer
160
views
What is the legal basis for a Schengen country embassy to call the hotel to confirm the applicant's reservation?
When applying for a Schengen visa, an applicant is typically required to provide a proof of accommodation. Often it's a screenshot from a hotel aggregator, or an email from a hotel (if booked directly)...
- 131
-1
votes
1
answer
75
views
How to make sure your startup or project idea is not stolen or given away when sharing it with professors or sources of support [duplicate]
Say you have an idea for which you can appreciate some intellectual and financial support. For this you may reach out to different sources, such as university professors or research institutes that ...
- 230
0
votes
0
answers
16
views
Is there a legal context regarding non-personal data retention for older SAS clients? [EU]
Can EU based SAS company keep non-personal data that what created by an former EU-based client (for example blog posts/)?
If yes for how long?
- 137
8
votes
1
answer
716
views
Does gdpr.eu violate GDPR compliancy?
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
- 183
2
votes
1
answer
77
views
What is the status of Meta's fine for breaking the EU privacy laws during the appeal?
Today it was in the news that Meta (owner of facebook) was fined 390 million Euros for GDPR violation by the Irish data protection officer. They were also told they have 3 months to change their user ...
- 3,063
12
votes
3
answers
6k
views
Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people?
I remember some password managers like Google's would give me a warning about passwords that have been compromised.
My question is this. How is Google or any company able to see that the password I ...
- 237
-1
votes
1
answer
58
views
Choosing region for database to be US / EU compliant
I wanted to ask about how one should go about choosing region for database / cloud provider when working on an application that stores user data for EU and US customers. Business behind the app is a ...
- 101
0
votes
2
answers
91
views
Can a mobile app save data about a user without a user giving the permission?
Is it allowed to store a user id to remember him, his settings, preferences and history, without asking for his permission?
Is there anyknowledge about that how that goes with privacy laws like GDPR ...
- 101
1
vote
0
answers
71
views
Can Bob, as the client, share any information about his project in any way he wants?
Bob hires vendor A and vendor B independently to work on a project for Bob. The two vendors are not partners, they work independently and do not communicate with each other although they are aware of ...
- 187
-1
votes
2
answers
110
views
How restrictive is the General Data Protection Regulation (GDPR) in Europe?
Lets say that I want to take a picture or record a video of a city I am visiting in Europe and like its inevitable people will appear in the picture or video. I cannot do this before asking permission ...
- 101
2
votes
1
answer
195
views
What legal actions can we take for website that doesn't remove PII upon requests?
A business directory listing website scraped old data for their listings. They use random contact information, personally identifiable information (PII), logos/banners to falsely represent those ...
- 187
5
votes
1
answer
1k
views
Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?
Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)?
I am following the current issue ...
- 129
2
votes
2
answers
66
views
Is nickname on an android app consider as personal Information for GDPR policy
I am currently developing a puzzle game where the player initially has the option to enter a
"NIckname" of his choice ( might also be his name - its up to him what to enter) so that his
time ...
- 21
5
votes
2
answers
4k
views
Is displaying the user first name and last name a breach of GDPR?
We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
- 151