Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
321
questions
1
vote
0
answers
32
views
A question about the Rehabilitation of Offenders Act. UK
Suppose I get an offer to study a PhD, and in the application procedure I was not asked about a criminal record at all. According to the rehabilitation of offenders, I can choose to withhold my ...
1
vote
1
answer
138
views
Can a student ask other students about their grades and then publish an average under FERPA?
Can a student ask other students (>14) to fill out an online form disclosing their grade on an assignment and then publish an average of the grades?
Or is the implicit permission given by filling ...
3
votes
1
answer
197
views
What is the legal basis for a Schengen country embassy to call the hotel to confirm the applicant's reservation?
When applying for a Schengen visa, an applicant is typically required to provide a proof of accommodation. Often it's a screenshot from a hotel aggregator, or an email from a hotel (if booked directly)...
-1
votes
1
answer
79
views
How to make sure your startup or project idea is not stolen or given away when sharing it with professors or sources of support [duplicate]
Say you have an idea for which you can appreciate some intellectual and financial support. For this you may reach out to different sources, such as university professors or research institutes that ...
8
votes
1
answer
731
views
Does gdpr.eu violate GDPR compliancy?
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
2
votes
1
answer
78
views
What is the status of Meta's fine for breaking the EU privacy laws during the appeal?
Today it was in the news that Meta (owner of facebook) was fined 390 million Euros for GDPR violation by the Irish data protection officer. They were also told they have 3 months to change their user ...
12
votes
3
answers
7k
views
Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people?
I remember some password managers like Google's would give me a warning about passwords that have been compromised.
My question is this. How is Google or any company able to see that the password I ...
-1
votes
1
answer
73
views
Choosing region for database to be US / EU compliant
I wanted to ask about how one should go about choosing region for database / cloud provider when working on an application that stores user data for EU and US customers. Business behind the app is a ...
0
votes
2
answers
191
views
Can a mobile app save data about a user without a user giving the permission?
Is it allowed to store a user id to remember him, his settings, preferences and history, without asking for his permission?
Is there anyknowledge about that how that goes with privacy laws like GDPR ...
1
vote
0
answers
74
views
Can Bob, as the client, share any information about his project in any way he wants?
Bob hires vendor A and vendor B independently to work on a project for Bob. The two vendors are not partners, they work independently and do not communicate with each other although they are aware of ...
-1
votes
2
answers
119
views
How restrictive is the General Data Protection Regulation (GDPR) in Europe?
Lets say that I want to take a picture or record a video of a city I am visiting in Europe and like its inevitable people will appear in the picture or video. I cannot do this before asking permission ...
2
votes
1
answer
201
views
What legal actions can we take for website that doesn't remove PII upon requests?
A business directory listing website scraped old data for their listings. They use random contact information, personally identifiable information (PII), logos/banners to falsely represent those ...
5
votes
1
answer
1k
views
Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?
Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)?
I am following the current issue ...
2
votes
2
answers
115
views
Is nickname on an android app consider as personal Information for GDPR policy
I am currently developing a puzzle game where the player initially has the option to enter a
"NIckname" of his choice ( might also be his name - its up to him what to enter) so that his
time ...
5
votes
2
answers
5k
views
Is displaying the user first name and last name a breach of GDPR?
We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
1
vote
1
answer
84
views
Is there a legal procedure in debt collection?
A company sells your data to a debt collection agency without proven attempts to collect payments from you for years.
A law firm sends you a letter of demand when they have not attempted to contact ...
1
vote
1
answer
91
views
Does revealing my personal email address in the To field constitute/qualify as a data breach for under the Australian Privacy Act
An email address was given for contact to a "charity". The charity then decided to notify a number of individuals on the list without using the BCC field. A number of individual were not ...
-2
votes
1
answer
62
views
Why do some data controllers require two forms of ID and others only one?
Meet Bob. Bob has submitted a number of subject access requests to various data controlling bodies, including businesses and several police forces.
Some police forces simply require scan of id with ...
2
votes
1
answer
212
views
How can data received in online subject access request form be used by ACRO?
Meet Bob. Bob has requested his PNC file from ACRO Criminal Records Office
under the Data Protection Act.
Their online request form solicits much intrusive information. What purposes may information ...
-1
votes
1
answer
75
views
Audio obfuscation for HIPPA compliance
I have audio files of medical conversations that require HIPPA level protection. I would like to send these files to a third party for transcription. However, the service I would like to use does not ...
4
votes
2
answers
214
views
What is the lawful basis for running Know Your Customer (KYC) checks on startup investors?
Suppose you have a startup that raises money from a number of angel investors, many of whom are investing as natural persons.
What is the lawful GDPR basis for processing the investors' personal data, ...
0
votes
1
answer
34
views
Does a UK private company need a privacy notice to store shareholders' personal data?
I'm the co-founder of a UK-based startup, and we're on the cusp of raising a seed round from a number of angel investors, the majority of whom will invest as private persons.
Our lawyers advised us to ...
3
votes
2
answers
878
views
Is Pushshift.io compliant to GDPR if they refuse to delete collected content?
Pushshift.io collects posts and comments using Reddit API, and saves that data into their database. This service is used by websites that allow you to see deleted contents in Reddit. For example, if ...
2
votes
1
answer
211
views
What exactly triggers the GDPR Article 14?
Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject:
Art. 14 ...
10
votes
4
answers
5k
views
Is there a way to determine if an email address is personal information?
The GDPR defines personal data as:
Personal data is information that relates to an identified or identifiable individual.
My understanding is that this means that [email protected] is ...
1
vote
2
answers
452
views
Is password reset to a known default value GDPR compliant?
I am working in a project where there are two procedure to change user password :
The more common technique, in which user click on "change password" button (or "forgot password")....
1
vote
1
answer
35
views
Responsabilities on data breaches UK Data Protection Act
Following a question from THIS StackExchange about Data Protection Act application in the UK, there is an aspect about "proactivity" and "responsabilities" that I do not fully ...
0
votes
1
answer
45
views
Does GDPR apply to a non-EU company communicating with me?
Someone used my e-mail address to create an account at one on-line service in a country that is not in EU. I told the company about that and they responded with that they have undone that.
But now, I ...
0
votes
1
answer
56
views
Does the UK have a (enforcable) law linked with the Data Protection Act to control document's metadata?
Reading the information on the ICO's website, I came across a few items mentioning how to handle metadata on my organization's workflow like THIS or THIS.
I noticed they use expressions like "...
0
votes
1
answer
111
views
Is who your employer is a public/accessable knowledge in Germany
Assuming you don't have LinkedIn or any social network that says who your current employer is, can your previous employer somehow find out through a certain source or access this information from ...
0
votes
2
answers
54
views
If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?
Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with ...
2
votes
2
answers
132
views
GDPR and personal data reselling
The situation is following:
I had an account in company A which then was sold to company B, both conduct online services.
I wasn't aware of this because I didn't log in to my account for several years,...
1
vote
1
answer
141
views
Do you need to remove a customer's data for GDPR or the like, if that data has been anonymized and used as part of an aggregate?
Say I have a SaaS which collects users financial information, or location information, or other random information, and aggregates it in an anonymous way. Say for example I present to my users "...
0
votes
1
answer
156
views
GDPR - When does data become personal data, and what exactly comprises personal data?
As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following:
...
1
vote
1
answer
285
views
Data backups, data loss, the GDPR right to be forgotten, and timing
This question concerns the timing of GDPR demands in regard to the "right to be forgotten", and data loss.
I am considering creating a web app that allows users to play a game against one ...
1
vote
1
answer
50
views
What’s the internal DPO access level?
Since the internal Data Protection Officer (DPO) should be independent, he needs to have access to all company files. But should he have access to everything at all time, or can the company only allow ...
3
votes
2
answers
104
views
Would changing your signature bar you from getting a UKVI SAR?
I am in the process of trying to submit a SAR (Subject Access Request) to UK Visas and Immigration (UKVI), but, I have read this paragraph:
your signature and the date, within the last 6 months – ...
0
votes
1
answer
198
views
Are javascript keyloggers on websites legal?
I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
10
votes
2
answers
3k
views
Can I store the names of arbitrary business associates in my CRM system?
I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships.
For example, "Gina works on reception."
Is this allowed ...
0
votes
0
answers
43
views
Is my app's displaying of email IDs illegal from a data privacy perspective?
I am building an app that will easily help connect Spotify playlist curators with artists who are trying to promote their music. As part of this, i would like my app to display names and business ...
3
votes
2
answers
109
views
Does obscuring personally identifiable and directory information avoid potential FERPA violations?
Say I have a database of students, each with a unique ID, GPA, placement test scores, and some demographic information (nothing personally identifiable). The ID is generated using a one-way ...
2
votes
1
answer
84
views
Can (public) schools monetize data collected from students (13+) in the US?
Does CCPA impact whether or not this is allowed?
Is it implicitly implied that information can be collected by attending school?
Is there different guidance for public (government-managed and ...
22
votes
2
answers
4k
views
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
4
votes
1
answer
403
views
Do sites need to explicitly ask for cookie consent as of 2022?
I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the ...
0
votes
1
answer
132
views
What are the limits of ID requirements for a subject access request?
When one makes a subject access request it is required that the data controller is required to ensure the identity of the requestor, to prevent unauthorised individuals accessing personal data of ...
1
vote
3
answers
125
views
How to avoid having problem with data protection regulations (GDPR)?
I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by ...
1
vote
1
answer
82
views
What global big tech does to comply with data protection laws all over the world?
Give this scenario...
A user in Germany, a user in US.
Each one decides to create an account on Facebook and facebook is located in US...
According with GDPR, US cannot store data from EU Citizens. So,...
0
votes
1
answer
208
views
What is the correct responce of a data processor to a SAR if they have multiple controllers?
In the case where a subjects data handled both by a data controller and a data processor, and the subject makes a data subject access request (SAR) of the processor the usual procedure if for the data ...
0
votes
0
answers
72
views
Is it illegal to allow a minor to participate in a site satisfaction survey?
Consider some imaginary website, run by a US legal entity - let's call it Whack Stove Reflow - has registered users, some of whom are under 18. This imaginary website wants to take a community ...
1
vote
1
answer
53
views
What references are available for the GDPR legitimate interests balancing test?
A basis for the processing of personally identifiable data (PII) is legitimate interest. According to the UK ICO data controllers who rely on this basis should conduct a legitimate interests ...