Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
311
questions
-1
votes
2
answers
116
views
How restrictive is the General Data Protection Regulation (GDPR) in Europe?
Lets say that I want to take a picture or record a video of a city I am visiting in Europe and like its inevitable people will appear in the picture or video. I cannot do this before asking permission ...
- 101
2
votes
1
answer
197
views
What legal actions can we take for website that doesn't remove PII upon requests?
A business directory listing website scraped old data for their listings. They use random contact information, personally identifiable information (PII), logos/banners to falsely represent those ...
- 348
5
votes
1
answer
1k
views
Has Anker broken the GDPR since the eufy camera has stored photo data in AWS without notifying users?
Can a complaint be filed to the European Data Protection Supervisor, with the goal of having a lawsuit brought against Anker (in the context of its eufy products)?
I am following the current issue ...
- 129
2
votes
2
answers
87
views
Is nickname on an android app consider as personal Information for GDPR policy
I am currently developing a puzzle game where the player initially has the option to enter a
"NIckname" of his choice ( might also be his name - its up to him what to enter) so that his
time ...
- 21
5
votes
2
answers
5k
views
Is displaying the user first name and last name a breach of GDPR?
We have a registration form where we create an account for a user where they need to fill their first name and last name. When creating the account we also create a public profile behind the scene by ...
- 151
1
vote
1
answer
82
views
Is there a legal procedure in debt collection?
A company sells your data to a debt collection agency without proven attempts to collect payments from you for years.
A law firm sends you a letter of demand when they have not attempted to contact ...
- 79
1
vote
1
answer
85
views
Does revealing my personal email address in the To field constitute/qualify as a data breach for under the Australian Privacy Act
An email address was given for contact to a "charity". The charity then decided to notify a number of individuals on the list without using the BCC field. A number of individual were not ...
-2
votes
1
answer
61
views
Why do some data controllers require two forms of ID and others only one?
Meet Bob. Bob has submitted a number of subject access requests to various data controlling bodies, including businesses and several police forces.
Some police forces simply require scan of id with ...
2
votes
1
answer
211
views
How can data received in online subject access request form be used by ACRO?
Meet Bob. Bob has requested his PNC file from ACRO Criminal Records Office
under the Data Protection Act.
Their online request form solicits much intrusive information. What purposes may information ...
-1
votes
1
answer
72
views
Audio obfuscation for HIPPA compliance
I have audio files of medical conversations that require HIPPA level protection. I would like to send these files to a third party for transcription. However, the service I would like to use does not ...
- 101
4
votes
2
answers
202
views
What is the lawful basis for running Know Your Customer (KYC) checks on startup investors?
Suppose you have a startup that raises money from a number of angel investors, many of whom are investing as natural persons.
What is the lawful GDPR basis for processing the investors' personal data, ...
- 371
0
votes
1
answer
32
views
Does a UK private company need a privacy notice to store shareholders' personal data?
I'm the co-founder of a UK-based startup, and we're on the cusp of raising a seed round from a number of angel investors, the majority of whom will invest as private persons.
Our lawyers advised us to ...
- 371
3
votes
2
answers
808
views
Is Pushshift.io compliant to GDPR if they refuse to delete collected content?
Pushshift.io collects posts and comments using Reddit API, and saves that data into their database. This service is used by websites that allow you to see deleted contents in Reddit. For example, if ...
- 47
2
votes
1
answer
129
views
What exactly triggers the GDPR Article 14?
Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject:
Art. 14 ...
- 5,880
10
votes
4
answers
5k
views
Is there a way to determine if an email address is personal information?
The GDPR defines personal data as:
Personal data is information that relates to an identified or identifiable individual.
My understanding is that this means that [email protected] is ...
- 5,880
1
vote
2
answers
369
views
Is password reset to a known default value GDPR compliant?
I am working in a project where there are two procedure to change user password :
The more common technique, in which user click on "change password" button (or "forgot password")....
- 115
1
vote
1
answer
30
views
Responsabilities on data breaches UK Data Protection Act
Following a question from THIS StackExchange about Data Protection Act application in the UK, there is an aspect about "proactivity" and "responsabilities" that I do not fully ...
- 15
0
votes
1
answer
43
views
Does GDPR apply to a non-EU company communicating with me?
Someone used my e-mail address to create an account at one on-line service in a country that is not in EU. I told the company about that and they responded with that they have undone that.
But now, I ...
- 151
0
votes
1
answer
48
views
Does the UK have a (enforcable) law linked with the Data Protection Act to control document's metadata?
Reading the information on the ICO's website, I came across a few items mentioning how to handle metadata on my organization's workflow like THIS or THIS.
I noticed they use expressions like "...
- 15
0
votes
1
answer
104
views
Is who your employer is a public/accessable knowledge in Germany
Assuming you don't have LinkedIn or any social network that says who your current employer is, can your previous employer somehow find out through a certain source or access this information from ...
- 230
0
votes
2
answers
52
views
If you recieve others PII as part of the response to a GDPR SAR do you become a data controller?
Say Alice makes a GDPR Subject Access Request of a data controller, and in response receives some of Bob's Personally Identifiable Information, does the Alice then become a data controller with ...
- 5,880
2
votes
2
answers
126
views
GDPR and personal data reselling
The situation is following:
I had an account in company A which then was sold to company B, both conduct online services.
I wasn't aware of this because I didn't log in to my account for several years,...
- 145
1
vote
1
answer
114
views
Do you need to remove a customer's data for GDPR or the like, if that data has been anonymized and used as part of an aggregate?
Say I have a SaaS which collects users financial information, or location information, or other random information, and aggregates it in an anonymous way. Say for example I present to my users "...
- 113
0
votes
1
answer
128
views
GDPR - When does data become personal data, and what exactly comprises personal data?
As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following:
...
- 103
1
vote
1
answer
244
views
Data backups, data loss, the GDPR right to be forgotten, and timing
This question concerns the timing of GDPR demands in regard to the "right to be forgotten", and data loss.
I am considering creating a web app that allows users to play a game against one ...
- 125
1
vote
1
answer
43
views
What’s the internal DPO access level?
Since the internal Data Protection Officer (DPO) should be independent, he needs to have access to all company files. But should he have access to everything at all time, or can the company only allow ...
- 137
3
votes
2
answers
102
views
Would changing your signature bar you from getting a UKVI SAR?
I am in the process of trying to submit a SAR (Subject Access Request) to UK Visas and Immigration (UKVI), but, I have read this paragraph:
your signature and the date, within the last 6 months – ...
- 1,234
0
votes
1
answer
178
views
Are javascript keyloggers on websites legal?
I believe that if one delivers a keylogger by say email and use it to extract data entered into text boxes without the users knowledge or consent on a web site then that is illegal. If the same is ...
- 5,880
10
votes
2
answers
3k
views
Can I store the names of arbitrary business associates in my CRM system?
I'm running an agency and I would like to store the names of employees of my client's companies to help me build client relationships.
For example, "Gina works on reception."
Is this allowed ...
- 111
0
votes
0
answers
43
views
Is my app's displaying of email IDs illegal from a data privacy perspective?
I am building an app that will easily help connect Spotify playlist curators with artists who are trying to promote their music. As part of this, i would like my app to display names and business ...
- 1
3
votes
2
answers
97
views
Does obscuring personally identifiable and directory information avoid potential FERPA violations?
Say I have a database of students, each with a unique ID, GPA, placement test scores, and some demographic information (nothing personally identifiable). The ID is generated using a one-way ...
2
votes
1
answer
76
views
Can (public) schools monetize data collected from students (13+) in the US?
Does CCPA impact whether or not this is allowed?
Is it implicitly implied that information can be collected by attending school?
Is there different guidance for public (government-managed and ...
- 234
22
votes
2
answers
4k
views
If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?
A request for personal data to be deleted is made under the GDPR rights but the requestor refuses to give ID for verification and only provides an email address.
- 231
4
votes
1
answer
305
views
Do sites need to explicitly ask for cookie consent as of 2022?
I'm trying to build a web app based in the UK that will serve (primarily though not exclusively) British and European customers, and am trying my best to make sure that I comply primarily with the ...
- 211
0
votes
1
answer
110
views
What are the limits of ID requirements for a subject access request?
When one makes a subject access request it is required that the data controller is required to ensure the identity of the requestor, to prevent unauthorised individuals accessing personal data of ...
- 5,880
1
vote
3
answers
116
views
How to avoid having problem with data protection regulations (GDPR)?
I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by ...
- 113
1
vote
1
answer
80
views
What global big tech does to comply with data protection laws all over the world?
Give this scenario...
A user in Germany, a user in US.
Each one decides to create an account on Facebook and facebook is located in US...
According with GDPR, US cannot store data from EU Citizens. So,...
- 121
0
votes
1
answer
181
views
What is the correct responce of a data processor to a SAR if they have multiple controllers?
In the case where a subjects data handled both by a data controller and a data processor, and the subject makes a data subject access request (SAR) of the processor the usual procedure if for the data ...
- 5,880
0
votes
0
answers
69
views
Is it illegal to allow a minor to participate in a site satisfaction survey?
Consider some imaginary website, run by a US legal entity - let's call it Whack Stove Reflow - has registered users, some of whom are under 18. This imaginary website wants to take a community ...
- 602
1
vote
1
answer
46
views
What references are available for the GDPR legitimate interests balancing test?
A basis for the processing of personally identifiable data (PII) is legitimate interest. According to the UK ICO data controllers who rely on this basis should conduct a legitimate interests ...
- 817
0
votes
1
answer
121
views
How does GDPR Art. 14 apply to large scale B2B data transfer
Article 14 of the GDPR appears to require any data controller to inform the data subject when a business to business transfer of personal data occurs. Business to business transfer of personal data ...
- 5,880
1
vote
1
answer
102
views
Under GDPR can a company give out the demographics of employees e.g. ethnic background without anonymising it?
If a client asks for the demographics of a company's employees e.g. female to male ratio or ethnicity. Does this have to be anonymised so it is compliant with the GDPR or can the names be revealed?
- 231
2
votes
1
answer
161
views
Can I use forum posts related to user to analyze them?
I would like to create an app, which would make analyses based on user behaviors, posts, comments.
I can gather those data from sites, forums because e.g twitter and so are public websites, they are ...
- 123
1
vote
1
answer
80
views
How long should I wait for a Data Access Request in Ireland
A few weeks ago I made a Data Access request to an Irish company I've been doing business with for just over 10 years. I've not received any sort of response - not even an acknowledgment of my e-mail. ...
- 13
2
votes
1
answer
111
views
GPDR: Are third party companies alowed to track my e-mails
I live in Ireland and I've been doing business with an Irish company. That company has using a third party for its main IT system and this system has been sending me e-mails.
Just recently I've had a ...
- 123
30
votes
2
answers
5k
views
How can the UK government fine itself?
In this news story the UK government has been fined £500,000 but who is doing the fining? Is the government fining itself?
- 591
1
vote
0
answers
135
views
Is YouTube legally required to not allow "Made For Kids" videos to be added to playlists?
In the last few years YouTube introduced a Made For Kids classification for videos, which requires uploaders to state whether a given video is made for children, in which case certain features are ...
- 211
2
votes
0
answers
65
views
Could a cell phone carrier sell this privacy plan?
Suppose Verizon offered a "privacy plan" (e.g., for $50 extra per month) in which they intentionally delete any location/ping/connection/dialing history data from their servers/towers such ...
- 939
1
vote
1
answer
185
views
Is it illegal for a school to take photos of children during online classes?
Consider a situation where some students are required to turn on the camera during online classes - my question is:
If a student's facial image is collected during online classes, is parental consent ...
- 85
1
vote
1
answer
134
views
How to notify Facebook of no consent to their use of my information?
I do not have a Facebook account (and never had one under any alias). I'd like to notify Facebook that I do not consent to their storing / displaying any information related to me (images of me, name ...
- 129