Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
35
votes
2answers
5k views

How to store refusal of cookie consent

If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
33
votes
4answers
10k views

Does a private citizen in the US have the right to make a “Contact the Police” poster?

Imagine the following hypothetical situation. Assume the location is in the United States. Mary had a credit card stolen by a suspect. The suspect used the credit card at a store. The manager of the ...
30
votes
4answers
8k views

ISP is not hashing the password I log in with online. Should I take any action?

I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
17
votes
4answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
14
votes
2answers
3k views

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member. I will explain the best I can: ...
13
votes
3answers
9k views

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

I asked this question to Facebook: I would like to know how can I permanently delete private messages from both sides of the conversation. For example, conversations I had in the past with ...
11
votes
2answers
1k views

To comply to GDPR, are social networks required to have a button to “Export your Data”?

Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
10
votes
2answers
5k views

Is hash of a username still personal data?

I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
9
votes
2answers
2k views

GDPR. Where to store users consent?

A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
7
votes
2answers
634 views

As per GDPR, how are the agree/disagree to cookie buttons to be designed?

I just stumbled over this very... interesting cookie dialogue on the Ansible site: How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
7
votes
3answers
1k views

Are publicly available password dumps legal under GDPR

When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or ...
7
votes
2answers
858 views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
7
votes
1answer
3k views

Are chat logs against the new european GDPR?

Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation? I know you can't save data which can be linked to a natural person ...
6
votes
1answer
749 views

UK: What information are the police legally required to collect when going door-to-door, and why?

A few days ago, a police officer knocked on my door in the evening and asked whether I had noticed any disturbances in my street earlier in the day - he said it was in relation to reports that they'd ...
6
votes
1answer
119 views

Company makes confidential CV publicly available and searchable. Legal recourse?

A friend of mine was looking for a job last August. She sent CVs for various positions. Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
6
votes
1answer
150 views

Can a company charge you to update your address under GDPR?

I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
6
votes
1answer
1k views

Resellers under GDPR - disclosure of data processors or countries of data storage?

A significant number of web-design and I.T. consultancy companies typically re-sell third party services related to their own as part of their product/service portfolio, to give a few examples, ...
6
votes
3answers
655 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
5
votes
1answer
132 views

Are there temporal limits to data requirements for a GDPR SAR?

Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data? The particular case I am thinking about is SAR made to the 3 credit ...
5
votes
1answer
272 views

Deletion of personal data

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background. ...
5
votes
1answer
2k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
5
votes
1answer
2k views

Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?

I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
5
votes
1answer
1k views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
5
votes
1answer
122 views

GDPR unbelievable legitimate interest. What action to take?

If a website is claiming legitimate interest in data collection in a way that is unbelievable is there any action that a web site visitor can take? For example, if one was to visit The Daily Mail you ...
4
votes
2answers
508 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
4
votes
2answers
155 views

Is it illegal to continue using oAuth tokens after a user asks to remove them?

We have an app that allows users to connect their CRM. The CEO wants to "fool" users into making them believe that they can delete the OAuth tokens so that we don't have access to their data anymore....
4
votes
2answers
225 views

If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?

I’m considering buying the assets of an insolvent company that has gone into administration / receivership. Included in the assets is a customer database. How does GDPR apply? is the purchasing ...
4
votes
1answer
118 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
4
votes
2answers
721 views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
4
votes
1answer
95 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
4
votes
1answer
315 views

For HIPAA, Does US Patient Data Have To Stay On US Servers?

For an application that stores US patient data, does HIPAA require that US data stays on US servers?
4
votes
1answer
827 views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
4
votes
1answer
147 views

How to make data brokers delete my information without providing more information? Can I take legal action?

I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
4
votes
1answer
102 views

Does possesing BUT NOT processing a personal data make the organization their controller?

According to Article 4(7) of GDPR: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
4
votes
1answer
76 views

Would revealing/storing whether or not an EU customer uses a service violate the GDPR?

Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
4
votes
1answer
760 views

How does the CLOUD Act apply for non-US persons' data stored on US-owned servers outside the USA?

The Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943) was signed into law on March 23, 2018. The law became necessary because the previous legislation in the Stored Communications ...
4
votes
1answer
207 views

Nuisance-causing passwords or technology at US borders

My question pertains to the somewhat recent emergence/increase of technological searches present at US borders. The premise I am operating under is that, a), while there are limits to this, border ...
4
votes
1answer
230 views

Legality of secretly micro-chipping coins?

In the UK, we are less than a week away from the new £1 coin coming into circulation, which has been billed as 'the most high-tech coin in the world'. In an effort to reduce counterfeit, they have ...
3
votes
4answers
135 views

Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

GDPR Article 39(1)(b) states: The data protection officer shall have at least the following tasks: (b) to monitor compliance with this Regulation, with other Union or Member State data ...
3
votes
1answer
77 views

Why does Google require consent from users in order to process ads personalization data?

Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was ...
3
votes
3answers
224 views

If you find something indexed on a search engine, is it legal to access and report that to the firm?

I found a US law firm's SQL database indexed on Google exposing email addresses, phone numbers, comments/questions of its clients. Not to mention the user database with even worse information. This is ...
3
votes
1answer
103 views

Does GDPR apply to location data collected by apps?

I've just been reading this article in the New York Times which expounds on the business practices of mobile apps which collect your location data and use it/sell it. The article gives examples of ...
3
votes
1answer
44 views

What is a “sealed” document?

When reading about T.J Miller, I noticed one sentence Student conduct proceedings were held, the results of which are sealed (...) What is the legal framework for such "sealing" of ...
3
votes
2answers
155 views

Controller processor roles for a SAAS for schools

Assume the following situation: There is a cloud-software (SAAS) which is used by a school for basically three things: Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
3
votes
1answer
50 views

A general question under Personal Data Privacy

Suppose X is a student body that holds a database of comments made by its members about the lecturers of ABC University. Professor Y from ABC requests X to send him a copy of all comments about him. ...
3
votes
2answers
510 views

Is the GDPR applicable to data stored in human memory?

If data is stored in human memory, is the GDPR applicable? Say, an employee of a company remembers an email address of a client, their date of birth, or even what their face looks like, does the ...
3
votes
1answer
33 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
3
votes
1answer
298 views

Should email addresses be anonymized/pseudonymized under GDPR?

GDPR states recommendation to pseudonymise or even anonymise Personal Data. A lot — most of — web sites and services require email address on signup. Should, from the Data Controller's point of view, ...
3
votes
1answer
89 views

According to GDPR Article 30, do I maintain a continuous record or just a one-off?

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification. See: https://www.privacy-regulation.eu/en/30.htm It states that a data controller ...shall maintain a record of ...
3
votes
2answers
74 views

Recruiter forwarding freelancer's profile without consent

I work as a freelancer, so being contacted by recruiters is a regular occurrence. Recently I responded to a request from a recruiter of a UK-based, "award-winning" recruitment company. We talked on ...