Skip to main content

Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
16 votes
3 answers
15k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
Nuno's user avatar
  • 1,033
7 votes
3 answers
3k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
Gjermund B. Dahl's user avatar
11 votes
2 answers
7k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
lnl's user avatar
  • 213
6 votes
1 answer
2k views

Resellers under GDPR - disclosure of data processors or countries of data storage?

A significant number of web-design and I.T. consultancy companies typically re-sell third party services related to their own as part of their product/service portfolio, to give a few examples, ...
richhallstoke's user avatar
4 votes
1 answer
350 views

GDPR and Storing Non-EU Citizen Data as an EU-based company

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
tda's user avatar
  • 143
0 votes
1 answer
263 views

I emailed a law and data privacy professor regarding an issue I was having to do with internet privacy law. Will I get in legal trouble for this?

I emailed an American law and data privacy professor to ask to help explain whether google could reveal my information if a court order was taken out to identify me. I was very over emotional in the ...
Jane doe's user avatar
-3 votes
1 answer
104 views

Is compensation available for requested data improperly withheld and deleted against data subject’s wishes?

Bob requests data from ACME. They ask him for identification according to very unreasonable and onerous requirements. He objects to these on grounds of infeasibility and inaccessibility. They bicker ...
TylerDurden's user avatar
14 votes
5 answers
4k views

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

Service providers like Google and Facebook are pretty much part of people's lives. Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
user1034912's user avatar
  • 1,501
11 votes
2 answers
4k views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
Oful's user avatar
  • 133
10 votes
4 answers
5k views

Is there a way to determine if an email address is personal information?

The GDPR defines personal data as: Personal data is information that relates to an identified or identifiable individual. My understanding is that this means that [email protected] is ...
User65535's user avatar
  • 7,138
7 votes
1 answer
3k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
Joey's user avatar
  • 173
6 votes
1 answer
2k views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
beluga.me's user avatar
  • 163
5 votes
2 answers
1k views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
Džuris's user avatar
  • 189
5 votes
2 answers
654 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
Per Digre's user avatar
  • 354
4 votes
1 answer
811 views

For HIPAA, Does US Patient Data Have To Stay On US Servers?

For an application that stores US patient data, does HIPAA require that US data stays on US servers?
Ben Rei's user avatar
  • 41
4 votes
1 answer
1k views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
Simon McClive's user avatar
4 votes
1 answer
335 views

GDPR unbelievable legitimate interest. What action to take?

If a website is claiming legitimate interest in data collection in a way that is unbelievable is there any action that a web site visitor can take? For example, if one was to visit The Daily Mail you ...
Dave's user avatar
  • 827
4 votes
2 answers
211 views

Is it illegal to continue using oAuth tokens after a user asks to remove them?

We have an app that allows users to connect their CRM. The CEO wants to "fool" users into making them believe that they can delete the OAuth tokens so that we don't have access to their data anymore....
ILikeTacos's user avatar
3 votes
2 answers
923 views

Is Pushshift.io compliant to GDPR if they refuse to delete collected content?

Pushshift.io collects posts and comments using Reddit API, and saves that data into their database. This service is used by websites that allow you to see deleted contents in Reddit. For example, if ...
GDPR's user avatar
  • 47
3 votes
1 answer
51 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
CaballoBlanco's user avatar
2 votes
1 answer
126 views

GDPR - Personal data

I've read the definition of "personal data" and I still can't understand it clearly. For example I have a youtube account and create a comment, is this comment now considered my personal data? If that ...
dnc123's user avatar
  • 23
1 vote
1 answer
267 views

What exactly triggers the GDPR Article 14?

Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject: Art. 14 ...
User65535's user avatar
  • 7,138
1 vote
1 answer
150 views

Is Cameron a data controller?

Cameron doesn’t take greatly thoughtful pains in defining himself with respect to his street and online activities. Some may consider him a political activist, some a citizen and/or amateur journalist,...
TylerDurden's user avatar
1 vote
1 answer
35 views

Responsabilities on data breaches UK Data Protection Act

Following a question from THIS StackExchange about Data Protection Act application in the UK, there is an aspect about "proactivity" and "responsabilities" that I do not fully ...
Javier Gonzalez Moncayo's user avatar
1 vote
1 answer
128 views

SARing received text messages from a lost phone

Al loses his phone and it runs out of battery. He then is sent 10 SMS from various people. He then recovers his phone and switched it on and the messages are all received. Bob loses his phone but ...
TylerDurden's user avatar
0 votes
1 answer
58 views

Does the UK have a (enforcable) law linked with the Data Protection Act to control document's metadata?

Reading the information on the ICO's website, I came across a few items mentioning how to handle metadata on my organization's workflow like THIS or THIS. I noticed they use expressions like "...
Javier Gonzalez Moncayo's user avatar
0 votes
1 answer
42 views

Which country laws apply to user data? HQ location or Cloud data center location

Anyone here know which country laws apply to user data when a startup based in a different country (ex: UK), than where user data resides (ex: Switzerland) ? Switzerland have better privacy (not ...
kaushalyap's user avatar
0 votes
1 answer
93 views

Is Google obliged to obtain consent for the processing of searches for anonymous searches under the GDPR?

If you do not register a personal account for Google, thereby not giving specific and informed consent for the processing of your personal data, are Google still obliged to obtain consent for the ...
jsindos's user avatar
  • 135
-1 votes
1 answer
249 views

Will a court order be taken out for this? Could the FBI get involved in something like this? [closed]

I had 3 gmail accounts (where I had the same generic random first name and other words and random letters that I was made to put in to get them). None of them contained no personal information of mine....
Jane doe's user avatar