Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
311
questions
36
votes
2
answers
6k
views
How to store refusal of cookie consent
If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
33
votes
4
answers
11k
views
Does a private citizen in the US have the right to make a "Contact the Police" poster?
Imagine the following hypothetical situation. Assume the location is in the United States.
Mary had a credit card stolen by a suspect. The suspect used the credit card at a store. The manager of the ...
- 455
30
votes
2
answers
5k
views
How can the UK government fine itself?
In this news story the UK government has been fined £500,000 but who is doing the fining? Is the government fining itself?
- 591
30
votes
4
answers
9k
views
ISP is not hashing the password I log in with online. Should I take any action?
I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
- 419
22
votes
2
answers
4k
views
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
- 231
17
votes
4
answers
6k
views
Under GDPR, can I give permission once to allow everyone to store and process my data?
If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
- 457
16
votes
2
answers
4k
views
Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?
The company BlockAdblock has an argument that their anti-adblock script is compliant with EU data protection law. It is quite long and has many somewhat unrelated aspects, and I certainly do not want ...
- 5,880
15
votes
3
answers
13k
views
Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers
I asked this question to Facebook:
I would like to know how can I permanently delete private messages
from both sides of the conversation. For example, conversations I had
in the past with ...
- 1,003
14
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 1,491
14
votes
2
answers
3k
views
Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?
This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member.
I will explain the best I can:
...
- 151
12
votes
3
answers
7k
views
Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people?
I remember some password managers like Google's would give me a warning about passwords that have been compromised.
My question is this. How is Google or any company able to see that the password I ...
- 237
11
votes
2
answers
7k
views
Is hash of a username still personal data?
I create a script, which asks a user who upload a GIF to a social media website, if it can reupload it to another website (to reduce other users' internet usage). Now I want to give users an option to ...
- 213
11
votes
2
answers
1k
views
To comply to GDPR, are social networks required to have a button to "Export your Data"?
Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
- 1,003
10
votes
4
answers
5k
views
Is there a way to determine if an email address is personal information?
The GDPR defines personal data as:
Personal data is information that relates to an identified or identifiable individual.
My understanding is that this means that [email protected] is ...
- 5,880
10
votes
2
answers
3k
views
Can I store the names of arbitrary business associates in my CRM system?
I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships.
For example, "Gina works on reception."
Is this allowed ...
- 111
10
votes
2
answers
2k
views
GDPR - Are technical identifiers personal data?
I've built devices for an internet service provider company (in EU) to measure internet speed at subscribers' home. The devices are used by company technicians when fixing network speed problems ...
- 203
9
votes
1
answer
1k
views
Denied Data Subject Access Request (DSAR) due to third-party information
A while ago I made a data subject access request (DSAR, asking for personal information which is stored about me) which was part of an ongoing complaint. In a nutshell, I did a complaint to a company ...
- 231
9
votes
2
answers
3k
views
GDPR. Where to store users consent?
A pretty straightforward question, I think. When it comes to holding records that users consent has been provided, I can only imagine I would use some sort of php code to store data/records into .txt ...
- 113
8
votes
2
answers
2k
views
Are there ways of storing personal data beyond standard GDPR limitations?
So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data.
...
- 281
8
votes
1
answer
3k
views
Can a non-profit organization record attendance by name without permission?
I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most ...
- 201
8
votes
1
answer
725
views
Does gdpr.eu violate GDPR compliancy?
As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any ...
- 183
7
votes
1
answer
2k
views
How does the GDPR apply to software developed by one company and used by another?
Question
I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year.
A lot of it makes sense, however I'm really ...
- 173
7
votes
3
answers
2k
views
Are publicly available password dumps legal under GDPR
When a company gets breached by hackers, often the contents of their databases will make its way onto the internet. Sometimes this will include obviously personal information such as email contents or ...
- 81
7
votes
2
answers
1k
views
GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?
The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
- 171
7
votes
1
answer
5k
views
Are chat logs against the new european GDPR?
Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation?
I know you can't save data which can be linked to a natural person ...
- 173
6
votes
3
answers
3k
views
What counts as personal data under GDPR?
As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679).
There is a ...
- 163
6
votes
2
answers
619
views
Is a sent email in someone else’s inbox subject to data subject rights of the sender?
Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the ...
- 9,113
6
votes
2
answers
1k
views
As per GDPR, how are the agree/disagree to cookie buttons to be designed?
I just stumbled over this very... interesting cookie dialogue on the Ansible site:
How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
- 183
6
votes
1
answer
130
views
Company makes confidential CV publicly available and searchable. Legal recourse?
A friend of mine was looking for a job last August. She sent CVs for various positions.
Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
- 163
6
votes
1
answer
395
views
Can a company charge you to update your address under GDPR?
I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
- 163
6
votes
1
answer
2k
views
Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?
github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
- 163
6
votes
1
answer
1k
views
Resellers under GDPR - disclosure of data processors or countries of data storage?
A significant number of web-design and I.T. consultancy companies typically re-sell third party services related to their own as part of their product/service portfolio, to give a few examples, ...
- 894
6
votes
3
answers
711
views
Does the GDPR allow me to access data from public sources, store it and anaylize it?
I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer.
Does the GDPR allow me (my software/server) to derive data, store it and ...
- 63
5
votes
2
answers
5k
views
Is displaying the user first name and last name a breach of GDPR?
We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
- 151
5
votes
2
answers
749
views
How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?
Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. ...
5
votes
2
answers
628
views
GDPR - Right to erasure - Conflicting laws
I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
- 354
5
votes
1
answer
916
views
UK: What information are the police legally required to collect when going door-to-door, and why?
A few days ago, a police officer knocked on my door in the evening and asked whether I had noticed any disturbances in my street earlier in the day - he said it was in relation to reports that they'd ...
- 175
5
votes
1
answer
1k
views
Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?
Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)?
I am following the current issue ...
- 129
5
votes
1
answer
213
views
Are there temporal limits to data requirements for a GDPR SAR?
Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data?
The particular case I am thinking about is SAR made to the 3 credit ...
- 817
5
votes
1
answer
349
views
Deletion of personal data
I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background.
...
- 153
5
votes
1
answer
3k
views
Is it allowed to Psuedonym or Soft delete the User Records in a highly complex User centric Software under GDPR?
I referred this question: Under the GDPR, should transaction data be deleted on account deletion or on user request? which deals specifically with the use-case of e-commerce site. But still, there is ...
- 145
5
votes
2
answers
1k
views
How does GDPR affect sports statistics?
I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
- 189
5
votes
1
answer
167
views
Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?
I work at a SME.
When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
- 153
4
votes
2
answers
200
views
Is it illegal to continue using oAuth tokens after a user asks to remove them?
We have an app that allows users to connect their CRM.
The CEO wants to "fool" users into making them believe that they can delete the OAuth tokens so that we don't have access to their data anymore....
- 153
4
votes
1
answer
92
views
How can Standard Contractual Clauses overcome Schrems II?
My understanding of Schrems II was that it essentially said the US did not provide adequate data protection because of the potential access intelligence agencies there have and the lack of legal ...
- 143
4
votes
1
answer
203
views
Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?
Suppose a person living in Colorado is a registered member of a church. In this church, certain “blessings” are considered contingent on your membership. Membership is recorded on a digital system.
...
- 3,060
4
votes
2
answers
446
views
If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?
I’m considering buying the assets of an insolvent company that has gone into administration / receivership.
Included in the assets is a customer database.
How does GDPR apply?
is the purchasing ...
- 143
4
votes
1
answer
324
views
GDPR and Storing Non-EU Citizen Data as an EU-based company
I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
- 143
4
votes
1
answer
251
views
Choosing DPA to submit data breach complaint (EU-specific)
Context
The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
The offenders ...
- 153
4
votes
1
answer
98
views
How does GDPR's right to erasure apply to deduplicated storage?
I am trying to understand GDPR's right to erasure (and principle of storage limitation) in the following case:
Company A offers a online data storage service that is intended to be used by the users ...
- 43