Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
327 questions
8
votes
0
answers
243
views
+100
Using AI assistants in virtual meetings
As of Friday I became aware of otter.ai as it was used in one of my online interviews. I'm not seeking legal advice about the situation but it has certainly raised some big questions for me on the ...
- 377
0
votes
3
answers
101
views
Using phonebooks or public data for commercial purposes, GDPR
I'm wondering if it is legal for individuals or companies to use phonebook data for commercial purposes, such as contacting people found on the phone book to sell them products or services, or even ...
- 1
12
votes
2
answers
4k
views
Is marking an advertisement/tracker cookie strictly necessary legal?
Suppose Bob has a website that is really popular. Bob has promised users that he will never sell user data, but he never said that he wouldn't put a third party tracker in his website, and he also ...
- 169
2
votes
1
answer
416
views
How does the First Amendment protect collection of information?
A comment on an answer to another question makes the assertion
The First Amendment protects both the collection and dissemination of information.
The First Amendment, according to the Library of ...
- 1,514
0
votes
2
answers
184
views
Do patients have the right to foot moulds / models from chiropodists? [closed]
If a chiropodist produces a 3D model or mould from a patient's foot in order to produce orthotic insoles, is the chiropodist required to retain the model or mould for a particular period of time? Does ...
- 97
1
vote
2
answers
197
views
Does a company have an obligation to attempt to answer a GDPR request if the requestor may not have provided sufficient identification information?
An individual has asked to provide information on his personal data which is stored by a company (GDPR). He has only provided his name and surname. He has signed the document electronically, i.e., we ...
- 175
1
vote
1
answer
74
views
EU Data Act - Receive access logs of managed wifi access points from service provider
As an employee of company A I would like to statistically analyse access logs of wifi access points, which are located in offices of company A, but managed by a service provider (company B). company B ...
- 119
5
votes
1
answer
805
views
Witness protection and street photography
I am in a Canadian witness protection and recently went past a 360-degree camera recording video in the middle of a public street which I assume is for some art project.
In the witness protection ...
- 151
2
votes
2
answers
189
views
Is analysis of personal data without saving considered data processing?
One of GDPR's main topics is processing data. Article 4 tells:
(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or ...
- 175
3
votes
5
answers
1k
views
Standards for data availability for internal employees
Our organization possesses a lot of personal data, and when we provide the data to external partners we are very strict on complying with all the data confidentiality rules, recommendations, etc. The ...
- 175
-4
votes
1
answer
438
views
How do I keep my web site out of Europe?
Say I want to publish a web page that includes URLs for for Google-hosted font files in its stylesheet. If your user agent deigns to, it can download those font files and display the page with them.
...
- 3,847
2
votes
2
answers
108
views
Does a "Data Controller" need to decide on behalf of others over their Data to become a Data Controller? [closed]
We provide Software for a school, more specifically for the Students Councils there. Hence we don't sign our contract with the school, but with "the Head" of the Students Council, which is ...
- 39
1
vote
0
answers
102
views
Does a Push Notification Service (Apple/Google) have to be mentioned in an DPA. Do i need a DPA with the Service Providers? [closed]
We are a Software Company that provides a Software (an IOS and Android Application) to our Customers. That Customer itself would be treated as an Data Controller and thus we are the Data Processor, ...
- 39
1
vote
2
answers
61
views
How can you tell if an application author or user is the one controlling or processing data?
Say I produce a tool that a user can enter a bunch of personal data into to accomplish some task. Say I distribute it as an EXE file or a web site or an app, but the tool does all its thinking and ...
- 3,847
-4
votes
1
answer
229
views
How can someone exercise their right to a copy of their data from a company? [closed]
I’m familiar with GDPR; in Utah it appears the analogous law is the Consumer Protection Act. In principle, I thought that GDPR gives anyone the right to request a copy of the data a company has about ...
- 797
-3
votes
1
answer
139
views
How is Bob meant to obtain Cameron’s contact address for Data Protection concerns?
Cameron is almost certainly a data controller for the prose of the the UKGDPR.
How can Bob practically go about seeking recourse and a means to reach Cameron, or an address on which to serve ...
0
votes
0
answers
70
views
Is amateur/hobbyist journalism/photography a purely household purpose?
Alice takes photos of people in public and puts them into a portfolio binder for grading by her photography class instructor but does not publish them.
Barbara takes photos on her nights out and ...
1
vote
1
answer
153
views
Is Cameron a data controller?
Cameron doesn’t take greatly thoughtful pains in defining himself with respect to his street and online activities. Some may consider him a political activist, some a citizen and/or amateur journalist,...
0
votes
1
answer
346
views
Microsoft's Bing Chat says 'Ask me anything...'. Is it legal then for Americans to ask Bing Chat for classified information?
Microsoft's Bing Chat is an artificial intelligence web application, and it has a dialog box for users to ask it questions and there is a text message displayed in that dialog box that says, "Ask ...
user39281
-1
votes
1
answer
79
views
Do data controllers have fewer obligations to self-represented data subjects than to their solicitors or insurers?
Bob makes a data protection request to a data controller who tells him that they are unable to comply with it and that he should therefore have his solicitors or insurers contact them. Do these types ...
16
votes
2
answers
4k
views
Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?
The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
- 9,354
1
vote
0
answers
80
views
What data protection law was broken by Alison Rose lying about the reason for closing Nigel Farage’s bank accounts?
The former NatWest chief executive Alison Rose spoke to a BBC journalist about the planned closure of Nigel Farage’s bank accounts. It is in the news today that the ICO has said in a report said that ...
- 9,354
1
vote
1
answer
86
views
What is the likely penalty for an organisation failing to comply with a subject access request by many months, on the 1st, 2nd, and 3rd occasions?
ACME Inc. Receives a subject access request from Bob, and fails to respond to it for 5 months. What are the likely sanctions faced by ACME, in case this was the:
1st,
2nd,
or 3rd
Such incident of ...
3
votes
0
answers
82
views
When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?
When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately?
There exists an argument ...
- 131
-4
votes
1
answer
97
views
Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?
Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to ...
0
votes
1
answer
119
views
Are outward facing security cameras’ footage on the outside of ambassadorial missions subject to subject access rights?
Bob walks past the front entrance of the embassy of the republic of Zwakilostan which is somehow under diplomatic protocols Zwakilostani sovereign territory. The cameras point outside toward the road ...
-6
votes
1
answer
62
views
Is the CPS a data controller for its defendants?
Alice was charged with an offence by the CPS. Is her file with the subject to the DPA 2018?
-1
votes
1
answer
76
views
Is it reasonable for a data controller to require proof of one’s address before honouring a subject’s right of access
Alice has requested access to her personal data from a shopkeeper.
Barbara has submitted a SAR to a police force for BWV footage.
They both require one item of identification and another for evidence ...
1
vote
1
answer
98
views
What Would be the Legality of a Company Paying Individuals for their Data?
Let's say I started a new social media company, which collects and sells it's users' data. To entice people to use my social media site, I give them a cut of the money that I get from selling that ...
4
votes
1
answer
118
views
How can Standard Contractual Clauses overcome Schrems II?
My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
- 143
1
vote
1
answer
73
views
Does 2 party consent apply if the data is anonymized?
If I have a text conversation between myself and another party, both of whom reside in 2 party consent states in the US, if I remove all reasonably identifying information, do I still need consent ...
- 244
-6
votes
2
answers
714
views
Is it legal for a business to deny me access to their store on the basis of how I look? [closed]
Is it legal for a business to use discriminatory (and notoriously false-positive) fingerprinting algorithms that prevent me from loading their website purely on the basis of how I look (as opposed to ...
- 180
0
votes
0
answers
844
views
GDPR implications of email sent to a misconfigured host
I sent an email to a website's contact and my mailserver received this error:
<...@...>: host ....mail.protection.outlook.com[104.47.70.110] said:
451 4.4.4 Mail received as unauthenticated, ...
- 103
4
votes
1
answer
228
views
Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?
Suppose a person living in Colorado is a registered member of a church. In this church, certain “blessings” are considered contingent on your membership. Membership is recorded on a digital system.
...
- 3,078
1
vote
1
answer
128
views
SARing received text messages from a lost phone
Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received.
Bob loses his phone but ...
-3
votes
1
answer
104
views
Is compensation available for requested data improperly withheld and deleted against data subject’s wishes?
Bob requests data from ACME. They ask him for identification according to very unreasonable and onerous requirements. He objects to these on grounds of infeasibility and inaccessibility. They bicker ...
-2
votes
2
answers
125
views
Can personal data compelled by police able to be disclosed to a private business?
Bob is ejected from a private business as the police are called because the security guard felt his dietary proclivities were socially unacceptable in public. The police arrived and Bob was already ...
5
votes
2
answers
774
views
How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?
Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. ...
1
vote
0
answers
65
views
Receive written confirmation about non-breached data
Context:
I am working for an institution which has recently suffered a data breach.
There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
- 153
2
votes
0
answers
33
views
Does article 8 of the European Convention protect against the dissemination of sensitive information about a research subject in scientific research?
I have a couple of questions related to the scope of Article 8(1) of the European Convention on Human Rights and who can be responsible for infringements in the rights outlined in the article. My ...
- 21
8
votes
1
answer
3k
views
Can a non-profit organization record attendance by name without permission?
I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
- 201
3
votes
0
answers
57
views
Search engine data breaches, osint
Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
- 53
0
votes
1
answer
360
views
Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?
Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls.
The fact that it's now allowed again makes me wonder if Italy (and the ...
- 47
3
votes
1
answer
180
views
GDPR protection for non-EU individuals by using EU services through VPN use?
REASON FOR QUESTION:
I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
4
votes
1
answer
264
views
Choosing DPA to submit data breach complaint (EU-specific)
Context
The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
The offenders ...
- 153
4
votes
1
answer
121
views
How does GDPR's right to erasure apply to deduplicated storage?
I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case:
Company A offers a online data storage service that is intended to be used by the users ...
- 43
6
votes
2
answers
689
views
Is a sent email in someone else’s inbox subject to data subject rights of the sender?
Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
0
votes
1
answer
67
views
Can a user opt-out of embedded services without prior account-linking?
Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
- 111
0
votes
2
answers
55
views
Official source for Data Export legislation (UK)
I need to find an official source for "Data Export" legislation that applies within the UK, I have searched the .GOV websites and found various pages that refer to physical item (military ...
- 101
0
votes
1
answer
283
views
Is it legal to store Singapore user data outside Singapore?
I am based out of india and has intent to launch the website in Singapore for singapore usesr where datastores and webservers will be hosted on data center in india. Is there any data protect act in ...
- 109