Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
1
vote
1answer
83 views

United States HIPAA and New Zealand HISO from outside these countries

We are developing a software product for storing and managing health records in Australia, with the software product primarily targeted towards Australian healthcare organisations. This requires us to ...
1
vote
1answer
199 views

Hypothetical question about Whistleblower Protection

Let's say a US non-government employment comes in contact with very sensitive unprotected information on the web. The information was gathered using opsint (Open Source Intelligence) there was no ...
5
votes
1answer
122 views

GDPR unbelievable legitimate interest. What action to take?

If a website is claiming legitimate interest in data collection in a way that is unbelievable is there any action that a web site visitor can take? For example, if one was to visit The Daily Mail you ...
1
vote
1answer
47 views

Does the Data Protection Act 2018 in UK require users of a website to explicitly

Now that Brexit has happened, GDPR no longer takes effect in UK. However, the Data Protection Act 2018 will continue to apply. With GDPR's Article 6, a website is required to request explicit consent ...
1
vote
2answers
2k views

Is it legal for Grammarly to read, share and store forever all my emails?

I have just noticed the following paragraph in Grammarly Terms and Conditions. By uploading or entering any User Content, you give Grammarly (and those it works with) a nonexclusive, worldwide, ...
-1
votes
0answers
13 views

International Proxy Shopping and KYC regulations

As I am about to graduate from college, some might say I am starting a new chapter of my life. And so far that chapter has involved exploring a lot of personal finance options. In this process I have ...
1
vote
2answers
67 views

The UK GDPA article 17 right to erasure. Can I retain the person's ID number if it no longer identifies them?

I manage a small relational database for members of a club with about 600 members. The 'member' table has records holding the memberID , their name, address phone etc. The memberID is then used as a ...
0
votes
2answers
77 views

What is the law regarding web/mobile applications and “personal” data?

I'm developing an application for mobile/web/desktop that will (in very watered down basic terms) store free text strings they've self-contributed and access them freely. As it stands, these ...
2
votes
1answer
339 views

What damages could one claim in a data breach, if the data was not subsequently used fraudulently?

Equifax recently announced they suffered a very large data breach, allegedly affecting almost half of all people in the United States. It's expected that lawsuits against Equifax will be popping up ...
1
vote
2answers
63 views

How long can an employer keep financial details after employee has left under GDPR?

I finished a job in 2019, but just received notification of a data breach at that job in 2021, and my bank account number, sort code, national insurance number, full name, address and date of birth ...
1
vote
0answers
31 views

GDPR data deletion: do I have a right to have the company specify which data it retained and why?

I requested the DPO of a company to delete all my data under GDPR. After a step of "account ownership" verification, it replied that: XXXX has deleted all of your personal data except where ...
1
vote
0answers
28 views

GDPR data deletion: can I ask the company to delete the data it had exported in the United States?

I am located in Italy. I have subscribed to a service and provided some PII that "could be exported in the United States". If I send a GDPR request to delete my data, can I ask them to also ...
3
votes
1answer
44 views

What is a “sealed” document?

When reading about T.J Miller, I noticed one sentence Student conduct proceedings were held, the results of which are sealed (...) What is the legal framework for such "sealing" of ...
33
votes
4answers
10k views

Does a private citizen in the US have the right to make a “Contact the Police” poster?

Imagine the following hypothetical situation. Assume the location is in the United States. Mary had a credit card stolen by a suspect. The suspect used the credit card at a store. The manager of the ...
1
vote
1answer
44 views

Can I use an Employee's Personal ID in an company internal project? (EU Data protection Law)

I want to create an Order-Website for our company, where employees can order dishes from the canteen, so they know roughly how much food to order. Now the question came up, if you order some dish, but ...
6
votes
1answer
749 views

UK: What information are the police legally required to collect when going door-to-door, and why?

A few days ago, a police officer knocked on my door in the evening and asked whether I had noticed any disturbances in my street earlier in the day - he said it was in relation to reports that they'd ...
0
votes
1answer
70 views

Youtube made for kids

Youtube allows youtubers to mark videos as made for kids. There the United States COPPA is cited The age of a kid here is thirteen . In U.K. it is 16 and some country it may be else if they wish to ...
1
vote
1answer
49 views

Does legitimate interest need to be justified in response to a GDPR DSAR?

In the response to a GDPR Data Subject Access Request, in describing the lawful basis under which the data controller is processing my data, I got this: We process your personal data for our ...
1
vote
0answers
75 views

Mendeley is encrypting my data on my hard disk with a key only available to them: can I ask for unencrypted data under GDPR?

I use Mendeley Desktop to manage my bibliography. Now I want to switch to Zotero. Zotero used to be able to import the Mandeley's database. However, Mendeley 1.19 encrypted my data on my HDD with a ...
2
votes
1answer
109 views

Public WiFi - when do you have to delete stored user data?

Note: I originally thought of this for germany, but if you have examples from other countries those are also welcome, since im interested in the topic in general. So lets say im using a public WiFi, ...
2
votes
2answers
98 views

Giving contact information on estranged family member without consent

Background: I'm based in the UK, specifically in England whilst my brother is in Scotland. We are also both adults. I have a bit of a weird situation and I wanted to know where I stand legally. ...
1
vote
2answers
73 views

GDPR: What data am I allowed to keep after a user requests deletion?

I struggle to find an insightful article on what, specifically, I have to delete and what I don't have to delete when a user requests deletion of their data. Some things are obvious to me: personal ...
0
votes
1answer
86 views

Twitter and account deactivation - Do you have to explicitly ask for account to be deleted if company nowhere says that it will do so? [duplicate]

I am trying to delete my Twitter account. Twitter only has a "deactivate" account button, and no "delete" account button, as I posted here. It looks like in the guides posted by ...
2
votes
1answer
86 views

Advertising in mobile apps and proof of consent

What does CCPA require for proof of consent to display advertising in mobile applications (vs a web site), especially for apps that do not create a user profile? Hypothetically, would it be sufficient ...
7
votes
3answers
1k views

Are publicly available password dumps legal under GDPR

When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or ...
0
votes
2answers
64 views

Are websites mandated to retain I.P. addresses fr five years or not under this regulation or id is a mis interpretation?

If one searches about "Indonesia data retention law 5 years" one will find that there seems t be a regulation in Indonesia that states that one must retain ll collected data fr five years ...
2
votes
1answer
104 views

Removing my personal data ex-employer (RGPD/GDPR)

I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
-2
votes
1answer
187 views

Will a court order be taken out for this? Could the FBI get involved in something like this? [closed]

I had 3 gmail accounts (where I had the same generic random first name and other words and random letters that I was made to put in to get them). None of them contained no personal information of mine....
2
votes
1answer
43 views

Is it legal to upload NASA's SRTM dataset to kaggle?

Short Version: Is it legal to upload NASA's SRTM dataset to kaggle.com? Long Version: I'm doing a computer science and data science project on landslide analysis. For this, I'm considering a variety ...
-3
votes
1answer
93 views

Can the POPI act land the CEO of a tech giant in a South African jail?

How likely is it that a breach of POPI act will lead to a CEO of a tech giant being subject to jail?Will it really be the CEO or other officials? The South African POPI Act could impose imprisonment ...
0
votes
1answer
46 views

Does GDPR apply to data of users who lied about their country of residence?

Imagine a website which requires users to register in order to use all its features. In order to avoid exposure to GDPR complains, would any of the following tactics work? Ask the user for their ...
0
votes
1answer
148 views

I emailed a law and data privacy professor regarding an issue I was having to do with internet privacy law. Will I get in legal trouble for this?

I emailed an American law and data privacy professor to ask to help explain whether google could reveal my information if a court order was taken out to identify me. I was very over emotional in the ...
-2
votes
2answers
137 views

Is it legal if I collect and sell public data from Twitter?

Let's assume that, technically i am able to collect the public information from Twitter (including user's profile and their tweets) from Twitter. I am wondering, is it legal to sell this data? How ...
1
vote
1answer
52 views

Legality of Network companies scanning TCP ports - how has my consent been obtained?

In my firewall and IIS logs I constantly see entries for servers from companies like ZenLayer, Dedipath, DigitalOcean and other Network-related businesses that appear to ping/scan my systems to ...
-4
votes
1answer
173 views

What is the meaning of mail in the CCPA (California Consumer Privacy Act of 2018)?

The CCPA states that under section 1798.130(2) customers can request their data BY_MAIL OR BY ELECTRONIC MEANS as the customer chooses. However NOWHERE on any website can I find a button or form to ...
0
votes
1answer
72 views

UK - Does a foreign, non-EU company's ToS Override GDPR

MiHoyo is a Chinese company that has recently produced the hugely popular online game, Genshin Impact. However, terrible online security has led to thousands of user details, emails, phone numbers, ...
-2
votes
1answer
68 views

Conflict between data protection laws and import export laws regarding cryptography [closed]

Main question: Cryptography laws restrict import of cryptography however data protection laws demand it. Which laws prevails? Background: Under the Wassenaar Arrangement going many countries control ...
1
vote
1answer
143 views

Is it against the law to forge identity documents if relevant information is accurate?

Organisations are required to "use all reasonable measures to verify the identity of a data subject who requests access". This has been implemented in some cases by requiring the data ...
14
votes
2answers
3k views

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member. I will explain the best I can: ...
0
votes
0answers
16 views

Collecting consent for online surveys in the UK

Where/what are the laws pertinent to collecting consent from participants before they can participate in an online user study? The most official ting I've found so far is this gov.uk guidance, but it ...
-2
votes
2answers
142 views

What is the definition of computer virus by law?The definition seems to be broad

According to the Indian IT Act we cannot place computer virus(which includes cookies) without user permission but does that mean we need to take permission even for placing nessecary cookies? ...
-1
votes
1answer
55 views

Is requesting a customer database for testing purposes legal?

We're a company working in building industry and have a program, develeoped together with our software vendor, to create quotes and configurate products. The program uses a MS SQL database. It stores ...
1
vote
1answer
32 views

What restrictions can organisations impose on the method of making a DSAR?

From the ICO "An individual can make a [Subject Access request] SAR verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their ...
5
votes
1answer
132 views

Are there temporal limits to data requirements for a GDPR SAR?

Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data? The particular case I am thinking about is SAR made to the 3 credit ...
2
votes
1answer
98 views

Identity photographs under GDPR

Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018? ...
11
votes
2answers
1k views

To comply to GDPR, are social networks required to have a button to “Export your Data”?

Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
7
votes
2answers
634 views

As per GDPR, how are the agree/disagree to cookie buttons to be designed?

I just stumbled over this very... interesting cookie dialogue on the Ansible site: How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
1
vote
3answers
50 views

Can cloud services providers be asked to turn over data from foreign countries?

Can cloud providers be asked to provide data from other countries to the government/law enforcement for security purposes? Can Amazon be asked to provide data from non-US countries for any security ...
2
votes
1answer
43 views

What subject access rights exist when only some of the data relates to you?

If some data record exists where some of the data relates to person A (eg. telephone number) while other data does not (eg. name), what right of access does person A have to that record under the GDPR?...
-5
votes
1answer
119 views

At first UK, then EU, then GERMANY, then GDRP, now LGPD … How far we will be enforced to comply with other countries extraterritorial laws? [closed]

(these are somehow related questions: 1, 2, 3; but not duplicate ). Also, if you downvote, please comment the reason of downvoting, and don't see the rant where it is not. Original question: We (...