Skip to main content

Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
35 votes
2 answers
7k views

How to store refusal of cookie consent

If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
Jackson Holiday Wheeler's user avatar
33 votes
4 answers
11k views

Does a private citizen in the US have the right to make a "Contact the Police" poster?

Imagine the following hypothetical situation. Assume the location is in the United States. Mary had a credit card stolen by a suspect. The suspect used the credit card at a store. The manager of the ...
ninja star's user avatar
30 votes
2 answers
5k views

How can the UK government fine itself?

In this news story the UK government has been fined £500,000 but who is doing the fining? Is the government fining itself?
sno's user avatar
  • 591
30 votes
4 answers
9k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
fluidj's user avatar
  • 419
22 votes
2 answers
4k views

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
Kin's user avatar
  • 231
16 votes
4 answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
J. Doe's user avatar
  • 447
16 votes
2 answers
4k views

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
User65535's user avatar
  • 7,562
16 votes
3 answers
15k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
Nuno's user avatar
  • 1,033
14 votes
5 answers
4k views

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

Service providers like Google and Facebook are pretty much part of people's lives. Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
user1034912's user avatar
  • 1,511
14 votes
2 answers
3k views

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member. I will explain the best I can: ...
Michael Morgan's user avatar
11 votes
3 answers
7k views

Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people?

I remember some password managers like Google's would give me a warning about passwords that have been compromised. My question is this. How is Google or any company able to see that the password I ...
devin's user avatar
  • 227
11 votes
2 answers
7k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
lnl's user avatar
  • 213
11 votes
2 answers
2k views

To comply to GDPR, are social networks required to have a button to "Export your Data"?

Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
Nuno's user avatar
  • 1,033
11 votes
2 answers
4k views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
Oful's user avatar
  • 133
10 votes
4 answers
5k views

Is there a way to determine if an email address is personal information?

The GDPR defines personal data as: Personal data is information that relates to an identified or identifiable individual. My understanding is that this means that [email protected] is ...
User65535's user avatar
  • 7,562
10 votes
2 answers
3k views

Can I store the names of arbitrary business associates in my CRM system?

I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships. For example, "Gina works on reception." Is this allowed ...
Jordan Regan's user avatar
10 votes
2 answers
2k views

GDPR - Are technical identifiers personal data?

I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
kol's user avatar
  • 203
9 votes
1 answer
1k views

Denied Data Subject Access Request (DSAR) due to third-party information

A while ago I made a data subject access request (DSAR, asking for personal information which is stored about me) which was part of an ongoing complaint. In a nutshell, I did a complaint to a company ...
tom's user avatar
  • 231
8 votes
2 answers
2k views

Are there ways of storing personal data beyond standard GDPR limitations?

So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data. ...
MrVocabulary's user avatar
8 votes
1 answer
3k views

Can a non-profit organization record attendance by name without permission?

I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
Tripartio's user avatar
  • 201
8 votes
1 answer
740 views

Does gdpr.eu violate GDPR compliancy?

As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
panda-byte's user avatar
7 votes
3 answers
3k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
Gjermund B. Dahl's user avatar
7 votes
1 answer
3k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
Joey's user avatar
  • 173
7 votes
2 answers
1k views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
basgys's user avatar
  • 171
7 votes
1 answer
5k views

Are chat logs against the new european GDPR?

Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation? I know you can't save data which can be linked to a natural person ...
RaphaelH's user avatar
  • 173
6 votes
2 answers
658 views

Is a sent email in someone else’s inbox subject to data subject rights of the sender?

Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
TylerDurden's user avatar
6 votes
2 answers
1k views

As per GDPR, how are the agree/disagree to cookie buttons to be designed?

I just stumbled over this very... interesting cookie dialogue on the Ansible site: How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
Flying Thunder's user avatar
6 votes
1 answer
134 views

Company makes confidential CV publicly available and searchable. Legal recourse?

A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
GregKos's user avatar
  • 163
6 votes
1 answer
519 views

Can a company charge you to update your address under GDPR?

I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
metaDesign's user avatar
6 votes
3 answers
3k views

Are publicly available password dumps legal under GDPR

When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or ...
gorzilla's user avatar
6 votes
1 answer
2k views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
beluga.me's user avatar
  • 163
6 votes
1 answer
2k views

Resellers under GDPR - disclosure of data processors or countries of data storage?

A significant number of web-design and I.T. consultancy companies typically re-sell third party services related to their own as part of their product/service portfolio, to give a few examples, ...
richhallstoke's user avatar
6 votes
3 answers
719 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
user179898's user avatar
5 votes
2 answers
6k views

Is displaying the user first name and last name a breach of GDPR?

We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
Ced's user avatar
  • 151
5 votes
2 answers
770 views

How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?

Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. ...
CarrotsHamster's user avatar
5 votes
2 answers
660 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
Per Digre's user avatar
  • 354
5 votes
1 answer
1k views

UK: What information are the police legally required to collect when going door-to-door, and why?

A few days ago, a police officer knocked on my door in the evening and asked whether I had noticed any disturbances in my street earlier in the day - he said it was in relation to reports that they'd ...
Noble-Surfer's user avatar
5 votes
1 answer
1k views

Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?

Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)? I am following the current issue ...
Paul-Beyond's user avatar
5 votes
1 answer
569 views

Witness protection and street photography

I am in a Canadian witness protection and recently went past a 360-degree camera recording video in the middle of a public street which I assume is for some art project. In the witness protection ...
fejyesynb's user avatar
  • 151
5 votes
1 answer
233 views

Are there temporal limits to data requirements for a GDPR SAR?

Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data? The particular case I am thinking about is SAR made to the 3 credit ...
Dave's user avatar
  • 827
5 votes
1 answer
363 views

Deletion of personal data

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background. ...
MrUpsidown's user avatar
5 votes
1 answer
3k views

Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?

I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
Karan Desai's user avatar
5 votes
2 answers
1k views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
Džuris's user avatar
  • 189
5 votes
1 answer
186 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
cinico's user avatar
  • 153
5 votes
1 answer
283 views

Nuisance-causing passwords or technology at US borders

My question pertains to the somewhat recent emergence/increase of technological searches present at US borders. The premise I am operating under is that, a), while there are limits to this, border ...
Davis's user avatar
  • 203
4 votes
2 answers
212 views

Is it illegal to continue using oAuth tokens after a user asks to remove them?

We have an app that allows users to connect their CRM. The CEO wants to "fool" users into making them believe that they can delete the OAuth tokens so that we don't have access to their data anymore....
ILikeTacos's user avatar
4 votes
1 answer
108 views

How can Standard Contractual Clauses overcome Schrems II?

My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
baarkerlounger's user avatar
4 votes
1 answer
220 views

Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?

Suppose a person living in Colorado is a registered member of a church. In this church, certain “blessings” are considered contingent on your membership. Membership is recorded on a digital system. ...
moonman239's user avatar
  • 3,068
4 votes
2 answers
605 views

If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?

I’m considering buying the assets of an insolvent company that has gone into administration / receivership. Included in the assets is a customer database. How does GDPR apply? is the purchasing ...
Jim Morrison's user avatar
4 votes
1 answer
364 views

GDPR and Storing Non-EU Citizen Data as an EU-based company

I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
tda's user avatar
  • 143

1
2 3 4 5
7