Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
1 vote
0 answers
32 views

A question about the Rehabilitation of Offenders Act. UK

Suppose I get an offer to study a PhD, and in the application procedure I was not asked about a criminal record at all. According to the rehabilitation of offenders, I can choose to withhold my ...
HMPtwo's user avatar
  • 155
1 vote
1 answer
138 views

Can a student ask other students about their grades and then publish an average under FERPA?

Can a student ask other students (>14) to fill out an online form disclosing their grade on an assignment and then publish an average of the grades? Or is the implicit permission given by filling ...
belkarx's user avatar
  • 234
3 votes
1 answer
197 views

What is the legal basis for a Schengen country embassy to call the hotel to confirm the applicant's reservation?

When applying for a Schengen visa, an applicant is typically required to provide a proof of accommodation. Often it's a screenshot from a hotel aggregator, or an email from a hotel (if booked directly)...
yeputons's user avatar
  • 131
-1 votes
1 answer
79 views

How to make sure your startup or project idea is not stolen or given away when sharing it with professors or sources of support [duplicate]

Say you have an idea for which you can appreciate some intellectual and financial support. For this you may reach out to different sources, such as university professors or research institutes that ...
Alejandro's user avatar
  • 230
8 votes
1 answer
731 views

Does gdpr.eu violate GDPR compliancy?

As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
panda-byte's user avatar
2 votes
1 answer
78 views

What is the status of Meta's fine for breaking the EU privacy laws during the appeal?

Today it was in the news that Meta (owner of facebook) was fined 390 million Euros for GDPR violation by the Irish data protection officer. They were also told they have 3 months to change their user ...
quarague's user avatar
  • 3,456
12 votes
3 answers
7k views

Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people?

I remember some password managers like Google's would give me a warning about passwords that have been compromised. My question is this. How is Google or any company able to see that the password I ...
devin's user avatar
  • 237
-1 votes
1 answer
73 views

Choosing region for database to be US / EU compliant

I wanted to ask about how one should go about choosing region for database / cloud provider when working on an application that stores user data for EU and US customers. Business behind the app is a ...
Ilja's user avatar
  • 101
0 votes
2 answers
191 views

Can a mobile app save data about a user without a user giving the permission?

Is it allowed to store a user id to remember him, his settings, preferences and history, without asking for his permission? Is there anyknowledge about that how that goes with privacy laws like GDPR ...
Sir hennihau's user avatar
1 vote
0 answers
74 views

Can Bob, as the client, share any information about his project in any way he wants?

Bob hires vendor A and vendor B independently to work on a project for Bob. The two vendors are not partners, they work independently and do not communicate with each other although they are aware of ...
Skies's user avatar
  • 348
-1 votes
2 answers
119 views

How restrictive is the General Data Protection Regulation (GDPR) in Europe?

Lets say that I want to take a picture or record a video of a city I am visiting in Europe and like its inevitable people will appear in the picture or video. I cannot do this before asking permission ...
S. Feunmajer's user avatar
2 votes
1 answer
201 views

What legal actions can we take for website that doesn't remove PII upon requests?

A business directory listing website scraped old data for their listings. They use random contact information, personally identifiable information (PII), logos/banners to falsely represent those ...
Skies's user avatar
  • 348
5 votes
1 answer
1k views

Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?

Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)? I am following the current issue ...
Paul-Beyond's user avatar
2 votes
2 answers
115 views

Is nickname on an android app consider as personal Information for GDPR policy

I am currently developing a puzzle game where the player initially has the option to enter a "NIckname" of his choice ( might also be his name - its up to him what to enter) so that his time ...
Panos's user avatar
  • 21
5 votes
2 answers
5k views

Is displaying the user first name and last name a breach of GDPR?

We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
Ced's user avatar
  • 151
1 vote
1 answer
84 views

Is there a legal procedure in debt collection?

A company sells your data to a debt collection agency without proven attempts to collect payments from you for years. A law firm sends you a letter of demand when they have not attempted to contact ...
CheeseBeer's user avatar
1 vote
1 answer
91 views

Does revealing my personal email address in the To field constitute/qualify as a data breach for under the Australian Privacy Act

An email address was given for contact to a "charity". The charity then decided to notify a number of individuals on the list without using the BCC field. A number of individual were not ...
Alekos Fragkoulias's user avatar
-2 votes
1 answer
62 views

Why do some data controllers require two forms of ID and others only one?

Meet Bob. Bob has submitted a number of subject access requests to various data controlling bodies, including businesses and several police forces. Some police forces simply require scan of id with ...
JosephCorrectEnglishPronouns's user avatar
2 votes
1 answer
212 views

How can data received in online subject access request form be used by ACRO?

Meet Bob. Bob has requested his PNC file from ACRO Criminal Records Office under the Data Protection Act. Their online request form solicits much intrusive information. What purposes may information ...
JosephCorrectEnglishPronouns's user avatar
-1 votes
1 answer
75 views

Audio obfuscation for HIPPA compliance

I have audio files of medical conversations that require HIPPA level protection. I would like to send these files to a third party for transcription. However, the service I would like to use does not ...
connor449's user avatar
  • 101
4 votes
2 answers
214 views

What is the lawful basis for running Know Your Customer (KYC) checks on startup investors?

Suppose you have a startup that raises money from a number of angel investors, many of whom are investing as natural persons. What is the lawful GDPR basis for processing the investors' personal data, ...
Paul Razvan Berg's user avatar
0 votes
1 answer
34 views

Does a UK private company need a privacy notice to store shareholders' personal data?

I'm the co-founder of a UK-based startup, and we're on the cusp of raising a seed round from a number of angel investors, the majority of whom will invest as private persons. Our lawyers advised us to ...
Paul Razvan Berg's user avatar
3 votes
2 answers
878 views

Is Pushshift.io compliant to GDPR if they refuse to delete collected content?

Pushshift.io collects posts and comments using Reddit API, and saves that data into their database. This service is used by websites that allow you to see deleted contents in Reddit. For example, if ...
GDPR's user avatar
  • 47
2 votes
1 answer
211 views

What exactly triggers the GDPR Article 14?

Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject: Art. 14 ...
User65535's user avatar
  • 6,608
10 votes
4 answers
5k views

Is there a way to determine if an email address is personal information?

The GDPR defines personal data as: Personal data is information that relates to an identified or identifiable individual. My understanding is that this means that [email protected] is ...
User65535's user avatar
  • 6,608
1 vote
2 answers
452 views

Is password reset to a known default value GDPR compliant?

I am working in a project where there are two procedure to change user password : The more common technique, in which user click on "change password" button (or "forgot password")....
Skary's user avatar
  • 115
1 vote
1 answer
35 views

Responsabilities on data breaches UK Data Protection Act

Following a question from THIS StackExchange about Data Protection Act application in the UK, there is an aspect about "proactivity" and "responsabilities" that I do not fully ...
Javier Gonzalez Moncayo's user avatar
0 votes
1 answer
45 views

Does GDPR apply to a non-EU company communicating with me?

Someone used my e-mail address to create an account at one on-line service in a country that is not in EU. I told the company about that and they responded with that they have undone that. But now, I ...
jiwopene's user avatar
  • 151
0 votes
1 answer
56 views

Does the UK have a (enforcable) law linked with the Data Protection Act to control document's metadata?

Reading the information on the ICO's website, I came across a few items mentioning how to handle metadata on my organization's workflow like THIS or THIS. I noticed they use expressions like "...
Javier Gonzalez Moncayo's user avatar
0 votes
1 answer
111 views

Is who your employer is a public/accessable knowledge in Germany

Assuming you don't have LinkedIn or any social network that says who your current employer is, can your previous employer somehow find out through a certain source or access this information from ...
Alejandro's user avatar
  • 230
0 votes
2 answers
54 views

If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?

Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with ...
User65535's user avatar
  • 6,608
2 votes
2 answers
132 views

GDPR and personal data reselling

The situation is following: I had an account in company A which then was sold to company B, both conduct online services. I wasn't aware of this because I didn't log in to my account for several years,...
Suncatcher's user avatar
1 vote
1 answer
141 views

Do you need to remove a customer's data for GDPR or the like, if that data has been anonymized and used as part of an aggregate?

Say I have a SaaS which collects users financial information, or location information, or other random information, and aggregates it in an anonymous way. Say for example I present to my users "...
Alien's user avatar
  • 113
0 votes
1 answer
156 views

GDPR - When does data become personal data, and what exactly comprises personal data?

As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following: ...
DerGoliHerr's user avatar
1 vote
1 answer
285 views

Data backups, data loss, the GDPR right to be forgotten, and timing

This question concerns the timing of GDPR demands in regard to the "right to be forgotten", and data loss. I am considering creating a web app that allows users to play a game against one ...
Hammerite's user avatar
  • 125
1 vote
1 answer
50 views

What’s the internal DPO access level?

Since the internal Data Protection Officer (DPO) should be independent, he needs to have access to all company files. But should he have access to everything at all time, or can the company only allow ...
borisrorsvort's user avatar
3 votes
2 answers
104 views

Would changing your signature bar you from getting a UKVI SAR?

I am in the process of trying to submit a SAR (Subject Access Request) to UK Visas and Immigration (UKVI), but, I have read this paragraph: your signature and the date, within the last 6 months – ...
Nicolas Formichella's user avatar
0 votes
1 answer
198 views

Are javascript keyloggers on websites legal?

I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
User65535's user avatar
  • 6,608
10 votes
2 answers
3k views

Can I store the names of arbitrary business associates in my CRM system?

I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships. For example, "Gina works on reception." Is this allowed ...
Jordan Regan's user avatar
0 votes
0 answers
43 views

Is my app's displaying of email IDs illegal from a data privacy perspective?

I am building an app that will easily help connect Spotify playlist curators with artists who are trying to promote their music. As part of this, i would like my app to display names and business ...
pmallepu's user avatar
3 votes
2 answers
109 views

Does obscuring personally identifiable and directory information avoid potential FERPA violations?

Say I have a database of students, each with a unique ID, GPA, placement test scores, and some demographic information (nothing personally identifiable). The ID is generated using a one-way ...
William Denny's user avatar
2 votes
1 answer
84 views

Can (public) schools monetize data collected from students (13+) in the US?

Does CCPA impact whether or not this is allowed? Is it implicitly implied that information can be collected by attending school? Is there different guidance for public (government-managed and ...
belkarx's user avatar
  • 234
22 votes
2 answers
4k views

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
Kin's user avatar
  • 231
4 votes
1 answer
403 views

Do sites need to explicitly ask for cookie consent as of 2022?

I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the ...
Hashim Aziz's user avatar
0 votes
1 answer
132 views

What are the limits of ID requirements for a subject access request?

When one makes a subject access request it is required that the data controller is required to ensure the identity of the requestor, to prevent unauthorised individuals accessing personal data of ...
User65535's user avatar
  • 6,608
1 vote
3 answers
125 views

How to avoid having problem with data protection regulations (GDPR)?

I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by ...
user1419243's user avatar
1 vote
1 answer
82 views

What global big tech does to comply with data protection laws all over the world?

Give this scenario... A user in Germany, a user in US. Each one decides to create an account on Facebook and facebook is located in US... According with GDPR, US cannot store data from EU Citizens. So,...
Marco Jr's user avatar
  • 121
0 votes
1 answer
208 views

What is the correct responce of a data processor to a SAR if they have multiple controllers?

In the case where a subjects data handled both by a data controller and a data processor, and the subject makes a data subject access request (SAR) of the processor the usual procedure if for the data ...
User65535's user avatar
  • 6,608
0 votes
0 answers
72 views

Is it illegal to allow a minor to participate in a site satisfaction survey?

Consider some imaginary website, run by a US legal entity - let's call it Whack Stove Reflow - has registered users, some of whom are under 18. This imaginary website wants to take a community ...
einpoklum's user avatar
  • 630
1 vote
1 answer
53 views

What references are available for the GDPR legitimate interests balancing test?

A basis for the processing of personally identifiable data (PII) is legitimate interest. According to the UK ICO data controllers who rely on this basis should conduct a legitimate interests ...
Dave's user avatar
  • 827

1
2
3 4 5
7