Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
311
questions
1
vote
1
answer
58
views
What is the likely penalty for an organisation failing to comply with a subject access request by many months, on the 1st, 2nd, and 3rd occasions?
ACME Inc. Receives a subject access request from Bob, and fails to respond to it for 5 months. What are the likely sanctions faced by ACME, in case this was the:
1st,
2nd,
or 3rd
Such incident of ...
- 504
-3
votes
0
answers
88
views
When running a dropshipping business, how can business owners protect customer data in accordance with GDPR?
In accordance with GDPR laws, how can dropshippers protect their customers' personal data when it's being sent to suppliers in countries that don't have data protection laws as strict as the EU?
- 21.7k
16
votes
2
answers
4k
views
Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?
The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
- 225
1
vote
0
answers
72
views
What data protection law was broken by Alison Rose lying about the reason for closing Nigel Farage’s bank accounts?
The former NatWest chief executive Alison Rose spoke to a BBC journalist about the planned closure of Nigel Farage’s bank accounts. It is in the news today that the ICO has said in a report said that ...
- 5,880
3
votes
0
answers
78
views
When targeting EU digital markets, is it enough to be GDPR compliant, or does one need to check the privacy laws of each EU country separately?
When targeting EU digital markets, is it enough to be GDPR compliant with regards to data privacy, or does one need to check the privacy laws of each EU country separately?
There exists an argument ...
- 198k
-4
votes
1
answer
94
views
Does the right to “face [or at least know] one’s accuser” apply in effect to data protection contexts?
Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to ...
- 198k
0
votes
0
answers
38
views
Is jigsaw identification enough to render a piece of information DPA-subject “personal data“? [duplicate]
In some legal contexts there is the notion of “jigsaw identification,” that is pieces of information that could allow certain people if adequately placed and privileged to other pieces of information ...
- 9,113
14
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 35.2k
0
votes
1
answer
101
views
Are outward facing security cameras’ footage on the outside of ambassadorial missions subject to subject access rights?
Bob walks past the front entrance of the embassy of the republic of Zwakilostan which is somehow under diplomatic protocols Zwakilostani sovereign territory. The cameras point outside toward the road ...
- 5,348
-6
votes
1
answer
55
views
Is the CPS a data controller for its defendants?
Alice was charged with an offence by the CPS. Is her file with the subject to the DPA 2018?
- 14.7k
-1
votes
1
answer
74
views
Is it reasonable for a data controller to require proof of one’s address before honouring a subject’s right of access
Alice has requested access to her personal data from a shopkeeper.
Barbara has submitted a SAR to a police force for BWV footage.
They both require one item of identification and another for evidence ...
- 14.7k
2
votes
1
answer
129
views
What exactly triggers the GDPR Article 14?
Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject:
Art. 14 ...
CommunityBot
- 1
1
vote
1
answer
72
views
What Would be the Legality of a Company Paying Individuals for their Data?
Let's say I started a new social media company, which collects and sells it's users' data. To entice people to use my social media site, I give them a cut of the money that I get from selling that ...
- 195k
4
votes
1
answer
92
views
How can Standard Contractual Clauses overcome Schrems II?
My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
- 23.9k
1
vote
1
answer
64
views
Does 2 party consent apply if the data is anonymized?
If I have a text conversation between myself and another party, both of whom reside in 2 party consent states in the US, if I remove all reasonably identifying information, do I still need consent ...
- 198k
-6
votes
2
answers
387
views
Is it legal for a business to deny me access to their store on the basis of how I look? [closed]
Is it legal for a business to use discriminatory (and notoriously false-positive) fingerprinting algorithms that prevent me from loading their website purely on the basis of how I look (as opposed to ...
- 43.3k
0
votes
0
answers
453
views
GDPR implications of email sent to a misconfigured host
I sent an email to a website's contact and my mailserver received this error:
<...@...>: host ....mail.protection.outlook.com[104.47.70.110] said:
451 4.4.4 Mail received as unauthenticated, ...
- 103
4
votes
1
answer
203
views
Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?
Suppose a person living in Colorado is a registered member of a church. In this church, certain “blessings” are considered contingent on your membership. Membership is recorded on a digital system.
...
- 195k
1
vote
1
answer
115
views
SARing received text messages from a lost phone
Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received.
Bob loses his phone but ...
- 14.7k
-3
votes
1
answer
100
views
Is compensation available for requested data improperly withheld and deleted against data subject’s wishes?
Bob requests data from ACME. They ask him for identification according to very unreasonable and onerous requirements. He objects to these on grounds of infeasibility and inaccessibility. They bicker ...
- 198k
-2
votes
2
answers
93
views
Can personal data compelled by police able to be disclosed to a private business?
Bob is ejected from a private business as the police are called because the security guard felt his dietary proclivities were socially unacceptable in public. The police arrived and Bob was already ...
- 198k
5
votes
2
answers
749
views
How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?
Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. ...
1
vote
0
answers
63
views
Receive written confirmation about non-breached data
Context:
I am working for an institution which has recently suffered a data breach.
There have also been articles in local press regarding the nature of the leaked data and claims about having access ...
2
votes
0
answers
32
views
Does article 8 of the European Convention protect against the dissemination of sensitive information about a research subject in scientific research?
I have a couple of questions related to the scope of Article 8(1) of the European Convention on Human Rights and who can be responsible for infringements in the rights outlined in the article. My ...
- 21
4
votes
1
answer
324
views
GDPR and Storing Non-EU Citizen Data as an EU-based company
I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
- 23.9k
8
votes
1
answer
3k
views
Can a non-profit organization record attendance by name without permission?
I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
- 23.9k
2
votes
0
answers
44
views
Search engine data breaches, osint
Such a search engine that is deliberately created for the purpose of collecting open source information about security related incidents including data breaches and including a link to the source that ...
- 43
0
votes
1
answer
241
views
Is OpenAI/ChatGPT compliant with GDPR, if they don't allow changing or removing the Phone Number and Email Address?
Italy has recently banned ChatGPT, and is now allowing it again in the country, after they implemented a few privacy controls.
The fact that it's now allowed again makes me wonder if Italy (and the ...
- 47
3
votes
1
answer
70
views
GDPR protection for non-EU individuals by using EU services through VPN use?
REASON FOR QUESTION:
I was born in the EU and lost my citizenship when I immigrated to the US many years ago. As many know, our privacy protections are a joke and our data gets collected and sold to ...
- 23.9k
4
votes
1
answer
251
views
Choosing DPA to submit data breach complaint (EU-specific)
Context
The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
The offenders ...
- 23.9k
4
votes
1
answer
98
views
How does GDPR's right to erasure apply to deduplicated storage?
I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case:
Company A offers a online data storage service that is intended to be used by the users ...
- 103
6
votes
2
answers
619
views
Is a sent email in someone else’s inbox subject to data subject rights of the sender?
Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
- 5,945
0
votes
1
answer
65
views
Can a user opt-out of embedded services without prior account-linking?
Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, ...
- 23.9k
0
votes
0
answers
13
views
Can a B2B outbound sales lead generation company legally capture and sell publicly available information without the consent of the leads?
I am researching the business model of a B2B outbound sales lead generation company that captures publicly available information for professionals such as name, company email, LinkedIn, Twitter, ...
0
votes
2
answers
47
views
Official source for Data Export legislation (UK)
I need to find an official source for "Data Export" legislation that applies within the UK, I have searched the .GOV websites and found various pages that refer to physical item (military ...
- 198k
0
votes
1
answer
108
views
Is it legal to store Singapore user data outside Singapore?
I am based out of india and has intent to launch the website in Singapore for singapore usesr where datastores and webservers will be hosted on data center in india. Is there any data protect act in ...
- 109
-3
votes
1
answer
93
views
Do investors have any copyrights on the application they invest on?
Considering I am the founder of Instagram, it means I have written 100% of the application code by myself, then found an investor and they put some money into the startup and got 30% of the new ...
- 249
1
vote
1
answer
38
views
GDPR When using an external CV formatting company
As a recruitment company, if I use an external company to format CVs that have been shared, do I need to inform the candidates? What are the potential pitfalls of an external company being given ...
- 23.9k
0
votes
1
answer
143
views
Is it legal for ProtonMail to suspend access to your email until you pay for subscription periods that haven’t yet elapsed or for you’ve not had use?
ProtonMail runs on an annual subscription model. If your pre-yearly renewal payment fails, then you lose access to your data until you pay the yearly rate in respect of the year ahead of the date on ...
- 23.9k
10
votes
2
answers
2k
views
GDPR - Are technical identifiers personal data?
I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
- 23.9k
0
votes
1
answer
37
views
Can a Data Controller refuse a second SAR from the same person?
Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. ...
- 113k
2
votes
0
answers
77
views
Is there anything to stop a subject access requester from being barred by a business?
A an access requester requests security footage of themselves from a business B. B services their request by providing the footage. But then wishes not to serve them again in the future. Is this ...
- 113k
1
vote
0
answers
32
views
A question about the Rehabilitation of Offenders Act. UK
Suppose I get an offer to study a PhD, and in the application procedure I was not asked about a criminal record at all. According to the rehabilitation of offenders, I can choose to withhold my ...
- 155
-1
votes
1
answer
247
views
Do I have the right to protect my personal property ? [closed]
In most part of US, people have the right to protect their own personal property with an appropriate amount of force.With this concept of personal property and a persons right to protect as background,...
- 7,336
1
vote
1
answer
89
views
Can a student ask other students about their grades and then publish an average under FERPA?
Can a student ask other students (>14) to fill out an online form disclosing their grade on an assignment and then publish an average of the grades?
Or is the implicit permission given by filling ...
- 234
3
votes
1
answer
166
views
What is the legal basis for a Schengen country embassy to call the hotel to confirm the applicant's reservation?
When applying for a Schengen visa, an applicant is typically required to provide a proof of accommodation. Often it's a screenshot from a hotel aggregator, or an email from a hotel (if booked directly)...
- 14.4k
-1
votes
1
answer
77
views
How to make sure your startup or project idea is not stolen or given away when sharing it with professors or sources of support [duplicate]
Say you have an idea for which you can appreciate some intellectual and financial support. For this you may reach out to different sources, such as university professors or research institutes that ...
- 35.2k
0
votes
0
answers
16
views
Is there a legal context regarding non-personal data retention for older SAS clients? [EU]
Can EU based SAS company keep non-personal data that what created by an former EU-based client (for example blog posts/)?
If yes for how long?
- 137
8
votes
1
answer
725
views
Does gdpr.eu violate GDPR compliancy?
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
- 696
2
votes
1
answer
77
views
What is the status of Meta's fine for breaking the EU privacy laws during the appeal?
Today it was in the news that Meta (owner of facebook) was fined 390 million Euros for GDPR violation by the Irish data protection officer. They were also told they have 3 months to change their user ...
- 35.2k