Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [data-protection]

The tag has no usage guidance.

3
votes
4answers
91 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
0
votes
4answers
217 views

Can a one-time-pad provide legal immunity - (make data inadmissible) -?

IMPORTANT NOTE: This question is quite niche, I am not sure if this stack is the most relevant place, please inform me if there is a better place for it. To explain the question: I am asking if, a ...
2
votes
1answer
101 views

If you find something indexed on a search engine, is it legal to access and report that to the firm?

I found a US law firm's SQL database indexed on Google exposing email addresses, phone numbers, comments/questions of its clients. Not to mention the user database with even worse information. This is ...
3
votes
1answer
59 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
0
votes
2answers
44 views

Proportion of copyrighted material that can be distributed without infringement

Is there a threshold or a descriptive proportion that is considered not copyright infringement but merely creative and educational use when distributing some copyright protected material along with ...
2
votes
0answers
51 views

Removing my personal data ex-employer (RGPD/GPDR ?)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
1
vote
1answer
38 views

Do you have to provide the name and email address of your data protection officer?

Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them: You can contact Valve's data protection officer at the address below. While we ...
0
votes
1answer
44 views

A query with regard to Defamation and Data Privacy

Suppose student X fails in Professor A’s class. X takes professor A’s picture from the university website and then puts up posters around campus with the picture along with offensive comments. Note: ...
3
votes
1answer
46 views

A general question under Personal Data Privacy

Suppose X is a student body that holds a database of comments made by its members about the lecturers of ABC University. Professor Y from ABC requests X to send him a copy of all comments about him. ...
1
vote
0answers
20 views

EU Cookie Law: Consent required in addition to accepted privacy policy

According to iubenda [1], a cookie consent is required in mobile apps too, though I did not see many apps following this advice yet. The realization of such a cookie consent on web sites is typically ...
1
vote
1answer
53 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
0
votes
1answer
21 views

When to authorize someone and when to sign a contract for processing personal data

There are two ways for the data controller to let someone else process the data he controls: authorise him or her to do so, sign a legal contract making him or her a 'processor' (Article 28 GDPR). ...
2
votes
1answer
37 views

What practical confidentiality protections can BSA offer to software piracy whistleblowers?

This question refers to a form for reporting software piracy. That page has an FAQ question: If I report software piracy to the BSA, will my name be kept confidential? Your name will never be ...
1
vote
1answer
42 views

The case of creating personal data by combining non-personal data

In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
2
votes
1answer
94 views

Can I share scammers personal details online? What type of details can I share?

I live in the UK, and I constantly see scams on Facebook such as: "£300pm house. I live abroad, so you will need to send me the money, and I will send you the keys in the post," or "Free iPad for ...
0
votes
1answer
48 views

Data Scraping public athlete name and performance data. Does this need to be treated as personal data?

Consider the following data for amateur/professional athletes: Athlete name, Athletic event + best performance data e.g.: Joe Bloggs 5k 19:00 10k 40:00 Half Marathon 85:00 other events etc... and ...
4
votes
1answer
47 views

Would revealing/storing whether or not an EU customer uses a service violate the GDPR?

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
0
votes
2answers
65 views

Is a step by step route considered as personal data?

I would like to know whether a route between two physical places A and B, with its different step by step streets, can be considered as a personal data and should be processed as it. We don't know ...
1
vote
1answer
69 views

Can my employer gather personal data without written consent

I'm located in the EU. My employer recently became a contractor for an american company. We deal with software. A requirement of the american company was that on all machine of the people working ...
5
votes
1answer
98 views

Company makes confidential CV publicly available and searchable. Legal recourse?

A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
4
votes
1answer
62 views

Does possesing BUT NOT processing a personal data make the organization their controller?

According to Article 4(7) of GDPR: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
0
votes
0answers
29 views

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer

Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer ? Is above fundamental right's affected by Clauses in temporary employment contract like '...
1
vote
0answers
29 views

Liability for data when reselling used data storage (US)

If I purchase used storage media from a company, what is my liability for the data that it may contain? As a standard practice, all such media would be wiped. However, secure data destruction is not ...
3
votes
1answer
53 views

Does GDPR apply to location data collected by apps?

I've just been reading this article in the New York Times which expounds on the business practices of mobile apps which collect your location data and use it/sell it. The article gives examples of ...
1
vote
1answer
72 views

Is it theft/fraud if one sends confidential info from their work laptop to their own personal web mail but there is no malicious intent? (UK/US)

Sender's intentions are non malicious, but the sender knows they are not supposed to send confidential info out of work laptop, and sender deleted some sent emails to cover up. Their intent is to do ...
-1
votes
1answer
32 views

US/International Law regarding collection of diagnostic data from iPhone app [closed]

I am designing an iPhone ultrasound transceiver. In order to improve the algorithm I wish to send an occasional ~2-3s chunk of audio containing the signal to my server. As such, this would clearly ...
0
votes
1answer
50 views

How can GDPR affect user generated content?

I'm wondering where the lines of GDPR are in regard to user generated content and how it meets the Communications Decency Act. Section 230 has been what ISPs and websites (Yelp as an example) use as ...
1
vote
2answers
76 views

Deliberately inaccurate data

The GDPR seem to assume that the client would want us to maintain accurate data. Article 5(1)(d) makes it clear we have to correct inaccurate data. But I deliver pizzas for a big chain, and I ...
0
votes
1answer
102 views

Hetzner is trying to charge me for Bandwidth overuse and will not respond when I use the contact form

A few months ago, I was using Hetzner Cloud for my VPS, and they blocked a server because someone seems to have DDoSed it. I requested it to be unblocked, and they ignored me. I also noticed they are ...
2
votes
1answer
33 views

GDPR and Storing Non-EU Citizen Data as an EU-based company

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
1
vote
2answers
51 views

Is it legal to require registration to obtain US Government software or data?

Is it legal to require registration to obtain US Government software or data? For example, if a government web site makes you put in an email address before you can access public data or public ...
1
vote
1answer
138 views

Is it reasonable to ask me to change my email address after it was leaked?

My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later ...
1
vote
0answers
46 views

Derogation for small companies in GDPR

Question What does Recital 13 in GDPR make exempt? refers to Article 30 on the technical definition on record keeping. But I am interested in another aspect of this sentence: To take account of ...
-2
votes
1answer
86 views

Can a good lawyer mitigate a failure to prevent data breaches?

I was curious how important it is for a software startup to seek legal council during the fundraising/growth stages. Basically, I don't want to be up a creek if we have some data breach or hack. How ...
0
votes
1answer
69 views

Is it legal to list parties not willing to take part in a survey?

I am building a website where hospitals, schools and hotels would be rated by referring to several factors. I need to collect the data (certificates, documents, etc...) from the hospitals/schools/...
10
votes
2answers
1k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
1
vote
2answers
51 views

Sharing confidential information between two companies

I own a small company and submitted a proposal to a major company and I received no response. Another company considered my proposal and invited me to present the proposal to the board. I was asked ...
5
votes
2answers
154 views

Are publicly available password dumps legal under GDPR

When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or ...
2
votes
0answers
31 views

GDPR which practice is compliant?

I have seen many ways of requiring user acceptance of their data usage on the internet. Which are conforming? Keep in mind I am talking just about the consent acquiring mechanism. In order from the ...
1
vote
1answer
166 views

GDPR and Query String Variables

I have a project where a customised email is sent out to clients and there is a link that takes them to a landing page, with a form, that currently gets populated by way of query string variables e.g. ...
3
votes
2answers
66 views

Recruiter forwarding freelancer's profile without consent

I work as a freelancer, so being contacted by recruiters is a regular occurrence. Recently I responded to a request from a recruiter of a UK-based, "award-winning" recruitment company. We talked on ...
7
votes
2answers
1k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
0
votes
0answers
23 views

To what extent does US Law allow algorithmic transparency?

The European Union GDPR (General Data Protection Regulation) is a regulation in EU law on data protection and privacy for all individuals within the European Union ...It also addresses the export of ...
0
votes
2answers
103 views

Privacy concerns regarding my data on a website

Recently, I signed up on this website. As soon as I registered, they sent me an activation email. After seeing the activation email, I was a little disturbed. The activation email consisted of the ...
1
vote
1answer
34 views

What prosecution can one expect for violation of information privacy principles in New Zealand?

I recently received a marketing letter in my mailbox from a building supplies company that I had never dealt with. Upon contacting them I found out that they had bought a database of people who had ...
7
votes
2answers
377 views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
1
vote
1answer
95 views

Facebook blocked my account until I consent to their new privacy policy under GDPR. If I consent now, will I be able to withdraw my consent later?

I am going to delete my Facebook account in a month, I can't do it now because I still use it for work. I live in the EU and Facebook has blocked access to my account unless I accept their privacy ...
3
votes
1answer
462 views

Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?

I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
2
votes
0answers
208 views

Explanations for GDPR if no personal data is collected?

I have a website that is a travel search engine and I am very concerned about GDPR. I am not interested in any private information from the users for marketing or such things. I just use Google ...
0
votes
1answer
92 views

Autoresponders and GDPR - do they comply with the law?

Would it be GDPR compliant to have an autoresponder request opt-in permission? For example, a customer makes an enquiry by sending an email to the company in question. The company in question then ...