Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
1
vote
1answer
29 views

Are insurance companies liable for employee theft of customer data?

Assume that Alice is getting a quote from an insurance company, but something goes wrong in the company's system while processing her quote. The company logs a defect and assigns it to Bob, one of ...
0
votes
0answers
15 views

Handling of names, emails, phone numbers and messages submitted through website forms under GDPR

I am developing a website for a one-man, Swedish, acupressure company. The site contains a contact form that requires the user to submit a name, email and message. It also contains a booking form that ...
0
votes
0answers
37 views

Does data protection apply under a power of attorney relationship?

I have hired a relocation company to help me with dealing with the immigration office and I have signed a power of attorney so that they can visit the authorities and get feedback on my application on ...
0
votes
0answers
48 views

Are publicly available password dumps legal in CIS

There are a lot of databases in form of email:password or username:password publicly available. For example there's Collection #1. Is it legal to download them and check weather your email:password ...
0
votes
0answers
35 views

Data Privacy: Should a user be allowed to change another users profile information?

In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)? What laws (US & EU) would give guidance either way? ...
4
votes
1answer
82 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
1
vote
1answer
36 views

Can someone enlighten me about the main task of the independent supervision of data protection law

So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
0
votes
1answer
49 views

Hiding order invoice information, GDPR

I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like: Name Surname ...
1
vote
2answers
47 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
1
vote
1answer
105 views

Hypothetical question about Whistleblower Protection

Let's say a US non-government employment comes in contact with very sensitive unprotected information on the web. The information was gathered using opsint (Open Source Intelligence) there was no ...
0
votes
1answer
53 views

GDPR on Proxy Users

I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc... My questions here are about the scope of GDPR. Does GDPR apply to people who: ...
1
vote
0answers
46 views

Question Regarding GDPR

I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
3
votes
1answer
28 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
1
vote
2answers
67 views

Can governments require administrators of groups on social media platforms to buy licenses?

The Kenyan government now wants administrators of WhatsApp groups and other social media platforms to pay for licenses. Is this possible with the GDPR, Facebook privacy policy, etc., as the proposed ...
2
votes
1answer
49 views

Data processing locations post-Brexit

I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients. I have several UK-based clients, all ...
2
votes
1answer
51 views

Public WiFi - when do you have to delete stored user data?

Note: I originally thought of this for germany, but if you have examples from other countries those are also welcome, since im interested in the topic in general. So lets say im using a public WiFi, ...
17
votes
4answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
1
vote
1answer
65 views

Do I violate GDRP if install WhatsApp as a private user?

As far as I can understand, if I install WhatsApp, the app sends my contact list to the server. Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
1
vote
1answer
20 views

Is a system that stores credentials required to meet the cyber security requirements of the systems it could give access to?

IT companies often use access keys, credentials, and remote management software to maintain their client's infrastructure. These access methods are then saved in some form of database so that the IT ...
0
votes
0answers
23 views

Legally act on the behalf of someone else, within a web application?

I've the following scenario. There is a computer system (web application), which let users log data of their work. This data is processed into bills and metrics. Now a new function should be added, ...
1
vote
2answers
107 views

Is newspaper publishing of a defendant's details considered doxing in the United Kingdom?

Does doxing apply to a newspaper that publishes a defendant’s full name and full address (minus the postcode) following a first hearing in the Magistrates Court? Can a defendant who is yet to stand ...
1
vote
3answers
65 views

Does GDPR apply to personal information entered in a password-field?

If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply? For example if someone enters their email, phone number or name in a password-field? If so, ...
0
votes
1answer
29 views

United States HIPAA and New Zealand HISO from outside these countries

We are developing a software product for storing and managing health records in Australia, with the software product primarily targeted towards Australian healthcare organisations. This requires us to ...
-1
votes
1answer
64 views

Do I have to include a GDPR in my app even tho I don't collect data from users? [closed]

I have written an android app The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user? Is is ...
1
vote
2answers
79 views

File copying and deletion before employee leaves to competitor

This may be a mundane question but I cannot find an answer for it, as the law is not my area of expertise. If an employee is under contract and copies files (on mass to a personal cloud storage) for ...
1
vote
1answer
65 views

Private company making it hard to delete customer's personal data

Storyline A friend of mine opened an account with an online company that sells picture prints. Without her knowing, just after signing in, somehow (she did not understand how; probably through the ...
4
votes
1answer
102 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
0
votes
2answers
48 views

GDPR question about processing personal data for research purposes that yield aggregated results

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...
3
votes
2answers
88 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
30
votes
4answers
8k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
0
votes
2answers
50 views

GDPR: can we ask the building owner to share and/or destroy data about one's RFID activity?

this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways It seems most buildings store the activity of one's RFID key activity. ...
3
votes
4answers
125 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
1
vote
4answers
276 views

Can a one-time-pad provide legal immunity - (make data inadmissible) -?

IMPORTANT NOTE: This question is quite niche, I am not sure if this stack is the most relevant place, please inform me if there is a better place for it. To explain the question: I am asking if, a ...
3
votes
3answers
212 views

If you find something indexed on a search engine, is it legal to access and report that to the firm?

I found a US law firm's SQL database indexed on Google exposing email addresses, phone numbers, comments/questions of its clients. Not to mention the user database with even worse information. This is ...
4
votes
1answer
80 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
0
votes
2answers
57 views

Proportion of copyrighted material that can be distributed without infringement

Is there a threshold or a descriptive proportion that is considered not copyright infringement but merely creative and educational use when distributing some copyright protected material along with ...
2
votes
0answers
57 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
1
vote
2answers
113 views

Do you have to provide the name and email address of your data protection officer?

Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them: You can contact Valve's data protection officer at the address below. While we ...
0
votes
1answer
61 views

A query with regard to Defamation and Data Privacy

Suppose student X fails in Professor A’s class. X takes professor A’s picture from the university website and then puts up posters around campus with the picture along with offensive comments. Note: ...
3
votes
1answer
49 views

A general question under Personal Data Privacy

Suppose X is a student body that holds a database of comments made by its members about the lecturers of ABC University. Professor Y from ABC requests X to send him a copy of all comments about him. ...
1
vote
0answers
36 views

EU Cookie Law: Consent required in addition to accepted privacy policy

According to iubenda [1], a cookie consent is required in mobile apps too, though I did not see many apps following this advice yet. The realization of such a cookie consent on web sites is typically ...
1
vote
1answer
60 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
0
votes
1answer
24 views

When to authorize someone and when to sign a contract for processing personal data

There are two ways for the data controller to let someone else process the data he controls: authorise him or her to do so, sign a legal contract making him or her a 'processor' (Article 28 GDPR). ...
2
votes
1answer
71 views

What practical confidentiality protections can BSA offer to software piracy whistleblowers?

This question refers to a form for reporting software piracy. That page has an FAQ question: If I report software piracy to the BSA, will my name be kept confidential? Your name will never be ...
1
vote
1answer
60 views

The case of creating personal data by combining non-personal data

In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
2
votes
2answers
170 views

Can I share scammers personal details online? What type of details can I share?

I live in the UK, and I constantly see scams on Facebook such as: "£300pm house. I live abroad, so you will need to send me the money, and I will send you the keys in the post," or "Free iPad for ...
0
votes
1answer
59 views

Data Scraping public athlete name and performance data. Does this need to be treated as personal data?

Consider the following data for amateur/professional athletes: Athlete name, Athletic event + best performance data e.g.: Joe Bloggs 5k 19:00 10k 40:00 Half Marathon 85:00 other events etc... and ...
4
votes
1answer
58 views

Would revealing/storing whether or not an EU customer uses a service violate the GDPR?

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
0
votes
2answers
65 views

Is a step by step route considered as personal data?

I would like to know whether a route between two physical places A and B, with its different step by step streets, can be considered as a personal data and should be processed as it. We don't know ...
1
vote
1answer
99 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...