Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
5 votes
1 answer
467 views

Witness protection and street photography

I am in a Canadian witness protection and recently went past a 360-degree camera recording video in the middle of a public street which I assume is for some art project. In the witness protection ...
fejyesynb's user avatar
  • 151
2 votes
2 answers
110 views

Is analysis of personal data without saving considered data processing?

One of GDPR's main topics is processing data. Article 4 tells: (2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or ...
ZygD's user avatar
  • 163
3 votes
5 answers
1k views

Standards for data availability for internal employees

Our organization possesses a lot of personal data, and when we provide the data to external partners we are very strict on complying with all the data confidentiality rules, recommendations, etc. The ...
ZygD's user avatar
  • 163
-4 votes
1 answer
151 views

How do I keep my web site out of Europe?

Say I want to publish a web page that includes URLs for for Google-hosted font files in its stylesheet. If your user agent deigns to, it can download those font files and display the page with them. ...
interfect's user avatar
  • 3,471
0 votes
2 answers
72 views

Does a "Data Controller" need to decide on behalf of others over their Data to become a Data Controller?

We provide Software for a School, more specifically for the Students Councils there. Hence we dont sign our contract with the School, but with "the Head" of the Students Council, which is ...
captain_joni's user avatar
1 vote
0 answers
36 views

Does a Push Notification Service (Apple/Google) have to be mentioned in an DPA. Do i need a DPA with the Service Providers?

We are a Software Company that provides a Software (an IOS and Android Application) to our Customers. That Customer itself would be treated as an Data Controller and thus we are the Data Processor, ...
captain_joni's user avatar
1 vote
2 answers
58 views

How can you tell if an application author or user is the one controlling or processing data?

Say I produce a tool that a user can enter a bunch of personal data into to accomplish some task. Say I distribute it as an EXE file or a web site or an app, but the tool does all its thinking and ...
interfect's user avatar
  • 3,471
-4 votes
1 answer
77 views

How can someone exercise their right to a copy of their data from a company? [closed]

I’m familiar with GDPR; in Utah it appears the analogous law is the Consumer Protection Act. In principle, I thought that GDPR gives anyone the right to request a copy of the data a company has about ...
Julius Hamilton's user avatar
-3 votes
1 answer
131 views

How is Bob meant to obtain Cameron’s contact address for Data Protection concerns?

Cameron is almost certainly a data controller for the prose of the the UKGDPR. How can Bob practically go about seeking recourse and a means to reach Cameron, or an address on which to serve ...
TylerDurden's user avatar
0 votes
0 answers
64 views

Is amateur/hobbyist journalism/photography a purely household purpose?

Alice takes photos of people in public and puts them into a portfolio binder for grading by her photography class instructor but does not publish them. Barbara takes photos on her nights out and ...
TylerDurden's user avatar
1 vote
1 answer
149 views

Is Cameron a data controller?

Cameron doesn’t take greatly thoughtful pains in defining himself with respect to his street and online activities. Some may consider him a political activist, some a citizen and/or amateur journalist,...
TylerDurden's user avatar
0 votes
1 answer
291 views

Microsoft's Bing Chat says 'Ask me anything...'. Is it legal then for Americans to ask Bing Chat for classified information?

Microsoft's Bing Chat is an artificial intelligence web application, and it has a dialog box for users to ask it questions and there is a text message displayed in that dialog box that says, "Ask ...
user57467's user avatar
  • 1,543
-1 votes
1 answer
77 views

Do data controllers have fewer obligations to self-represented data subjects than to their solicitors or insurers?

Bob makes a data protection request to a data controller who tells him that they are unable to comply with it and that he should therefore have his solicitors or insurers contact them. Do these types ...
TylerDurden's user avatar
16 votes
2 answers
4k views

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
User65535's user avatar
  • 6,608
1 vote
0 answers
76 views

What data protection law was broken by Alison Rose lying about the reason for closing Nigel Farage’s bank accounts?

The former NatWest chief executive Alison Rose spoke to a BBC journalist about the planned closure of Nigel Farage’s bank accounts. It is in the news today that the ICO has said in a report said that ...
User65535's user avatar
  • 6,608
1 vote
1 answer
76 views

What is the likely penalty for an organisation failing to comply with a subject access request by many months, on the 1st, 2nd, and 3rd occasions?

ACME Inc. Receives a subject access request from Bob, and fails to respond to it for 5 months. What are the likely sanctions faced by ACME, in case this was the: 1st, 2nd, or 3rd Such incident of ...
TylerDurden's user avatar
3 votes
0 answers
80 views

When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?

When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately? There exists an argument ...
GolDDranks's user avatar
-4 votes
1 answer
95 views

Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?

Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to ...
TylerDurden's user avatar
0 votes
0 answers
38 views

Is jigsaw identification enough to render a piece of information DPA-subject “personal data“? [duplicate]

In some legal contexts there is the notion of “jigsaw identification,” that is pieces of information that could allow certain people if adequately placed and privileged to other pieces of information ...
TylerDurden's user avatar
0 votes
1 answer
113 views

Are outward facing security cameras’ footage on the outside of ambassadorial missions subject to subject access rights?

Bob walks past the front entrance of the embassy of the republic of Zwakilostan which is somehow under diplomatic protocols Zwakilostani sovereign territory. The cameras point outside toward the road ...
TylerDurden's user avatar
-6 votes
1 answer
58 views

Is the CPS a data controller for its defendants?

Alice was charged with an offence by the CPS. Is her file with the subject to the DPA 2018?
TylerDurden's user avatar
-1 votes
1 answer
75 views

Is it reasonable for a data controller to require proof of one’s address before honouring a subject’s right of access

Alice has requested access to her personal data from a shopkeeper. Barbara has submitted a SAR to a police force for BWV footage. They both require one item of identification and another for evidence ...
TylerDurden's user avatar
1 vote
1 answer
77 views

What Would be the Legality of a Company Paying Individuals for their Data?

Let's say I started a new social media company, which collects and sells it's users' data. To entice people to use my social media site, I give them a cut of the money that I get from selling that ...
Neil Svedberg's user avatar
4 votes
1 answer
105 views

How can Standard Contractual Clauses overcome Schrems II?

My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
baarkerlounger's user avatar
1 vote
1 answer
66 views

Does 2 party consent apply if the data is anonymized?

If I have a text conversation between myself and another party, both of whom reside in 2 party consent states in the US, if I remove all reasonably identifying information, do I still need consent ...
belkarx's user avatar
  • 234
-6 votes
2 answers
501 views

Is it legal for a business to deny me access to their store on the basis of how I look? [closed]

Is it legal for a business to use discriminatory (and notoriously false-positive) fingerprinting algorithms that prevent me from loading their website purely on the basis of how I look (as opposed to ...
Michael Altfield's user avatar
0 votes
0 answers
727 views

GDPR implications of email sent to a misconfigured host

I sent an email to a website's contact and my mailserver received this error: <...@...>: host ....mail.protection.outlook.com[104.47.70.110] said: 451 4.4.4 Mail received as unauthenticated, ...
Nemo's user avatar
  • 103
4 votes
1 answer
215 views

Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?

Suppose a person living in Colorado is a registered member of a church. In this church, certain “blessings” are considered contingent on your membership. Membership is recorded on a digital system. ...
moonman239's user avatar
  • 3,060
1 vote
1 answer
128 views

SARing received text messages from a lost phone

Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received. Bob loses his phone but ...
TylerDurden's user avatar
-3 votes
1 answer
104 views

Is compensation available for requested data improperly withheld and deleted against data subject’s wishes?

Bob requests data from ACME. They ask him for identification according to very unreasonable and onerous requirements. He objects to these on grounds of infeasibility and inaccessibility. They bicker ...
TylerDurden's user avatar
-2 votes
2 answers
104 views

Can personal data compelled by police able to be disclosed to a private business?

Bob is ejected from a private business as the police are called because the security guard felt his dietary proclivities were socially unacceptable in public. The police arrived and Bob was already ...
TylerDurden's user avatar
5 votes
2 answers
762 views

How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?

Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. ...
CarrotsHamster's user avatar
1 vote
0 answers
65 views

Receive written confirmation about non-breached data

Context: I am working for an institution which has recently suffered a data breach. There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
Vassilis Markos's user avatar
2 votes
0 answers
32 views

Does article 8 of the European Convention protect against the dissemination of sensitive information about a research subject in scientific research?

I have a couple of questions related to the scope of Article 8(1) of the European Convention on Human Rights and who can be responsible for infringements in the rights outlined in the article. My ...
ahcrd's user avatar
  • 21
8 votes
1 answer
3k views

Can a non-profit organization record attendance by name without permission?

I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
Tripartio's user avatar
  • 201
3 votes
0 answers
48 views

Search engine data breaches, osint

Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
J.G.'s user avatar
  • 53
0 votes
1 answer
283 views

Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?

Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls. The fact that it's now allowed again makes me wonder if Italy (and the ...
GDPR's user avatar
  • 47
3 votes
1 answer
100 views

GDPR protection for non-EU individuals by using EU services through VPN use?

REASON FOR QUESTION: I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
Bruno Genovese's user avatar
4 votes
1 answer
254 views

Choosing DPA to submit data breach complaint (EU-specific)

Context The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it. The offenders ...
Vassilis Markos's user avatar
4 votes
1 answer
107 views

How does GDPR's right to erasure apply to deduplicated storage?

I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case: Company A offers a online data storage service that is intended to be used by the users ...
Tomas's user avatar
  • 43
6 votes
2 answers
648 views

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
TylerDurden's user avatar
0 votes
1 answer
65 views

Can a user opt-out of embedded services without prior account-linking?

Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
Martin Braun's user avatar
0 votes
2 answers
50 views

Official source for Data Export legislation (UK)

I need to find an official source for "Data Export" legislation that applies within the UK, I have searched the .GOV websites and found various pages that refer to physical item (military ...
Darkcat Studios's user avatar
0 votes
1 answer
169 views

Is it legal to store Singapore user data outside Singapore?

I am based out of india and has intent to launch the website in Singapore for singapore usesr where datastores and webservers will be hosted on data center in india. Is there any data protect act in ...
M Sach's user avatar
  • 109
-3 votes
1 answer
98 views

Do investors have any copyrights on the application they invest on?

Considering I am the founder of Instagram, it means I have written 100% of the application code by myself, then found an investor and they put some money into the startup and got 30% of the new ...
best_of_man's user avatar
1 vote
1 answer
41 views

GDPR When using an external CV formatting company

As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
Sara's user avatar
  • 11
0 votes
1 answer
193 views

Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?

ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
TylerDurden's user avatar
10 votes
2 answers
2k views

GDPR - Are technical identifiers personal data?

I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
kol's user avatar
  • 203
0 votes
1 answer
40 views

Can a Data Controller refuse a second SAR from the same person?

Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
David Siegel's user avatar
2 votes
0 answers
78 views

Is there anything to stop a subject access requester from being barred by a business?

A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
TylerDurden's user avatar

1
2 3 4 5
7