Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
-1
votes
2answers
73 views

HOA creating accounts on a third-party website without my consent

This question is in regards to a situation in Colorado in the US. I began receiving emails from a website distributing community information. The emails did not have an unsubscribe link so I sent them ...
1
vote
0answers
38 views

CPA leaked tax return details

A CPA that is supposedly working on my Tax application accidentally has uploaded some other people tax applications to my account on their "secured" platform. Now I am very worried that they ...
1
vote
1answer
62 views

Am I allowed to sell the reviews of my product to another company?

I ran a company which closed down two months ago. One of my former competitor's has contacted me about buying my branding, product formulations, and business name. They are not interested in my ...
-2
votes
0answers
38 views

Who can collect and process private and personal data? [closed]

I made a small social network and I would like to run it in my country (Slovakia, Europe). But I'm just an ordinary person, I have no business, no company, I don't even have a trade license. Just a ...
0
votes
1answer
73 views

Does a certified letter proof the content?

My previous company has recently updated their website, and included pictures of the employees as well as events and reviews to boost their image. I don't know if they have asked permission to current ...
2
votes
1answer
76 views

Right to personal data on youtube : what if account is banned

Since GDPR at least we have the right to access and get the data we generated on websites like Facebook or Google (our history, likes, almost everything). My question is : what happens if Facebook or ...
1
vote
1answer
45 views

How does GDPR affect game data and how it is processed?

A real-time strategy game's data involving player points is available publicly (the point data is paired with their username). A player gains points through actions such as 'attacking' and 'building'. ...
0
votes
1answer
72 views

Online player nicks: personal data under GDPR?

We run a server for an old, open-source FPS game. The game collects match events that get logged, where the only information stored is player nicknames (changeable at will at any time by the players). ...
2
votes
1answer
127 views

Does sharing personal data publicly imply consent for collection and processing?

Suppose an EU citizen publishes their personal information, such as name and contact details online, for instance, on social media. If I wanted to contact them in my professional capacity over email, ...
2
votes
3answers
469 views

Does GDPR consent notification apply to access points intended purely for maintenance?

Suppose I have a publicly available interface, intended to be used exclusively by me or my employees for the purposes of maintenance, e.g. an SSH server. Since I am processing user's IP address when ...
1
vote
1answer
59 views

Cookie consent compliance: disabling JavaScript and keyboard accessibility

I've noticed that most cookie consent solutions are JavaScript based, and when you have JS disabled, the cookie consent settings may not be accessible. Speaking of accessibility, some cookie consent ...
1
vote
1answer
63 views

Do users who are given another user's email address have obligations under GDPR?

I have an app/website which connects people into groups and then the group performs work in the real world. That work in the real world will occasionally require that group members talk to each other. ...
0
votes
1answer
39 views

International Transfers to a Data Subject

A membership organisation based in the EEA receives membership applications from people based outside of the EEA, in countries which do not have an adequacy decision. During the course of the ...
-5
votes
1answer
97 views

At first UK, then EU, then GERMANY, then GDRP, now LGPD … How far we will be enforced to comply with other countries extraterritorial laws? [closed]

(these are somehow related questions: 1, 2, 3; but not duplicate ). Also, if you downvote, please comment the reason of downvoting, and don't see the rant where it is not. Original question: We (...
0
votes
1answer
68 views

Can employer collect and share employee data such as skin colour?

In an attempt to make the workforce more "diverse", our employer has announced that they will start "collecting and sharing" [sic!] employee data such as ethnicity and gender. This,...
-1
votes
2answers
168 views

The right to hide one's password

It's well known that you should never reveal your password to anyone -- including your boss, your sysadmin, etc. My friend's former boss has sued her, demanding (among other things) the password to ...
6
votes
1answer
110 views

Can a company charge you to update your address under GDPR?

I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
0
votes
0answers
48 views

If a user of my site gives me info of a third party they claim to be affiliated with, am I allowed to contact that third party to check?

I am developing an app where a part of the on-boarding process requires users to enter the email / company name of the agency that they are affiliated with (the 3rd party). I need to confirm that they ...
-1
votes
2answers
110 views

As an individual, not a company, if I collect email addresses of visitors to my website, what gdpr regulations apply to me?

I'm planning on making a website to act as a CV / portfolio of my work as a software developer. I intend to lock this personal data behind a token based access system, so that it isn't available ...
0
votes
0answers
31 views

Face generation using AI

Given how advanced AI has become, I was wondering about the legalities of stuff that it is being used for. I came across https://www.rosebud.ai/ a few days ago. To summarize, it is a service where ...
1
vote
1answer
62 views

Does a hyperlink to a privacy policy have to be available after the user agrees?

A website that deals with personal user data is legally bound by CCPA Privacy Rights and GDPR Data Protection Rights. The user must agree to the privacy policy before the website has consent to share ...
0
votes
1answer
41 views

Is Google obliged to obtain consent for the processing of searches for anonymous searches under the GDPR?

If you do not register a personal account for Google, thereby not giving specific and informed consent for the processing of your personal data, are Google still obliged to obtain consent for the ...
3
votes
1answer
54 views

Why does Google require consent from users in order to process ads personalization data?

Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was ...
0
votes
1answer
36 views

What is the law regarding web/mobile applications and “personal” data?

I'm developing an application for mobile/web/desktop that will (in very watered down basic terms) store free text strings they've self-contributed and access them freely. As it stands, these ...
0
votes
1answer
51 views

Is any attempt to access restricted information on the web considered an attack?

This article reports that a person who "gained access to the admin portal by simply altering the website’s URL" is now under investigation by FBI for "exploiting personal information". I want to ...
1
vote
1answer
62 views

GDPR - Personal data

I've read the definition of "personal data" and I still can't understand it clearly. For example I have a youtube account and create a comment, is this comment now considered my personal data? If that ...
35
votes
2answers
5k views

How to store refusal of cookie consent

If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
10
votes
2answers
1k views

To comply to GDPR, do social networks require to have a button to “Export your Data”?

Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
5
votes
1answer
227 views

Deletion of personal data

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background. ...
0
votes
0answers
26 views

Storing personal data in the cloud and sharing it to particular users

I'm a programming student working on an app which will allow people to create and manage their "teams". An essential feature is allowing youths to create their accounts. My biggest concern are the ...
4
votes
2answers
123 views

If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?

I’m considering buying the assets of an insolvent company that has gone into administration / receivership. Included in the assets is a customer database. How does GDPR apply? is the purchasing ...
1
vote
1answer
43 views

Does the European Union allow to store medical (sensitive) data in cloud platforms such as Amazon Web Services or Google Cloud?

Does the EU allow to store patients medical data in cloud databases from providers such as Amazon Web Services or Google Cloud? What are the legal requirements? Can you point at some legal source ...
1
vote
1answer
76 views

Does Article 27(1) of the GDPR apply to a U.S. controller using Google Analytics if it only sells to U.S. clients?

If a U.S. controller who only sells to U.S. clients uses Google Analytics on their website, would it be required to have a representative in the Union? I am unsure whether Google Analytics in this ...
0
votes
0answers
64 views

Facebook vs GDPR - Is Facebook never deleting the Searches you do?

I frequently delete the Search History from my account's Activity Log. However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past. Suggestions ...
0
votes
1answer
23 views

Which country laws apply to user data? HQ location or Cloud data center location

Anyone here know which country laws apply to user data when a startup based in a different country (ex: UK), than where user data resides (ex: Switzerland) ? Switzerland have better privacy (not ...
0
votes
0answers
48 views

Requesting Proof of Data Deletion

This questions covers the law and tech. If I delete my account at Facebook or any company with a website service, can I ask to be provided proof of data having been deleted in some form provided by ...
1
vote
2answers
75 views

Are insurance companies liable for employee theft of customer data?

Assume that Alice is getting a quote from an insurance company, but something goes wrong in the company's system while processing her quote. The company logs a defect and assigns it to Bob, one of ...
0
votes
0answers
39 views

Handling of names, emails, phone numbers and messages submitted through website forms under GDPR

I am developing a website for a one-man, Swedish, acupressure company. The site contains a contact form that requires the user to submit a name, email and message. It also contains a booking form that ...
0
votes
0answers
37 views

Does data protection apply under a power of attorney relationship?

I have hired a relocation company to help me with dealing with the immigration office and I have signed a power of attorney so that they can visit the authorities and get feedback on my application on ...
0
votes
0answers
51 views

Are publicly available password dumps legal in CIS

There are a lot of databases in form of email:password or username:password publicly available. For example there's Collection #1. Is it legal to download them and check weather your email:password ...
0
votes
0answers
36 views

Data Privacy: Should a user be allowed to change another users profile information?

In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)? What laws (US & EU) would give guidance either way? ...
4
votes
1answer
90 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
1
vote
1answer
39 views

Can someone enlighten me about the main task of the independent supervision of data protection law

So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
0
votes
1answer
56 views

Hiding order invoice information, GDPR

I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like: Name Surname ...
1
vote
2answers
55 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
1
vote
1answer
167 views

Hypothetical question about Whistleblower Protection

Let's say a US non-government employment comes in contact with very sensitive unprotected information on the web. The information was gathered using opsint (Open Source Intelligence) there was no ...
0
votes
1answer
106 views

GDPR on Proxy Users

I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc... My questions here are about the scope of GDPR. Does GDPR apply to people who: ...
1
vote
0answers
47 views

Question Regarding GDPR

I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
3
votes
1answer
30 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
1
vote
2answers
69 views

Can governments require administrators of groups on social media platforms to buy licenses?

The Kenyan government now wants administrators of WhatsApp groups and other social media platforms to pay for licenses. Is this possible with the GDPR, Facebook privacy policy, etc., as the proposed ...