Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
1
vote
1answer
79 views

Cookie consent compliance: disabling JavaScript and keyboard accessibility

I've noticed that most cookie consent solutions are JavaScript based, and when you have JS disabled, the cookie consent settings may not be accessible. Speaking of accessibility, some cookie consent ...
1
vote
1answer
81 views

Do users who are given another user's email address have obligations under GDPR?

I have an app/website which connects people into groups and then the group performs work in the real world. That work in the real world will occasionally require that group members talk to each other. ...
0
votes
1answer
42 views

International Transfers to a Data Subject

A membership organisation based in the EEA receives membership applications from people based outside of the EEA, in countries which do not have an adequacy decision. During the course of the ...
-5
votes
1answer
119 views

At first UK, then EU, then GERMANY, then GDRP, now LGPD … How far we will be enforced to comply with other countries extraterritorial laws? [closed]

(these are somehow related questions: 1, 2, 3; but not duplicate ). Also, if you downvote, please comment the reason of downvoting, and don't see the rant where it is not. Original question: We (...
0
votes
1answer
94 views

Can employer collect and share employee data such as skin colour?

In an attempt to make the workforce more "diverse", our employer has announced that they will start "collecting and sharing" [sic!] employee data such as ethnicity and gender. This,...
-1
votes
2answers
177 views

The right to hide one's password

It's well known that you should never reveal your password to anyone -- including your boss, your sysadmin, etc. My friend's former boss has sued her, demanding (among other things) the password to ...
6
votes
1answer
150 views

Can a company charge you to update your address under GDPR?

I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
0
votes
0answers
51 views

If a user of my site gives me info of a third party they claim to be affiliated with, am I allowed to contact that third party to check?

I am developing an app where a part of the on-boarding process requires users to enter the email / company name of the agency that they are affiliated with (the 3rd party). I need to confirm that they ...
-1
votes
2answers
122 views

As an individual, not a company, if I collect email addresses of visitors to my website, what gdpr regulations apply to me?

I'm planning on making a website to act as a CV / portfolio of my work as a software developer. I intend to lock this personal data behind a token based access system, so that it isn't available ...
0
votes
0answers
35 views

Face generation using AI

Given how advanced AI has become, I was wondering about the legalities of stuff that it is being used for. I came across https://www.rosebud.ai/ a few days ago. To summarize, it is a service where ...
1
vote
1answer
81 views

Does a hyperlink to a privacy policy have to be available after the user agrees?

A website that deals with personal user data is legally bound by CCPA Privacy Rights and GDPR Data Protection Rights. The user must agree to the privacy policy before the website has consent to share ...
0
votes
1answer
72 views

Is Google obliged to obtain consent for the processing of searches for anonymous searches under the GDPR?

If you do not register a personal account for Google, thereby not giving specific and informed consent for the processing of your personal data, are Google still obliged to obtain consent for the ...
3
votes
1answer
77 views

Why does Google require consent from users in order to process ads personalization data?

Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was ...
0
votes
2answers
77 views

What is the law regarding web/mobile applications and “personal” data?

I'm developing an application for mobile/web/desktop that will (in very watered down basic terms) store free text strings they've self-contributed and access them freely. As it stands, these ...
0
votes
1answer
57 views

Is any attempt to access restricted information on the web considered an attack?

This article reports that a person who "gained access to the admin portal by simply altering the website’s URL" is now under investigation by FBI for "exploiting personal information". I want to ...
1
vote
1answer
72 views

GDPR - Personal data

I've read the definition of "personal data" and I still can't understand it clearly. For example I have a youtube account and create a comment, is this comment now considered my personal data? If that ...
35
votes
2answers
5k views

How to store refusal of cookie consent

If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
11
votes
2answers
1k views

To comply to GDPR, are social networks required to have a button to “Export your Data”?

Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
5
votes
1answer
272 views

Deletion of personal data

I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background. ...
4
votes
2answers
225 views

If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?

I’m considering buying the assets of an insolvent company that has gone into administration / receivership. Included in the assets is a customer database. How does GDPR apply? is the purchasing ...
2
votes
1answer
97 views

Does the European Union allow to store medical (sensitive) data in cloud platforms such as Amazon Web Services or Google Cloud?

Does the EU allow to store patients medical data in cloud databases from providers such as Amazon Web Services or Google Cloud? What are the legal requirements? Can you point at some legal source ...
1
vote
1answer
83 views

Does Article 27(1) of the GDPR apply to a U.S. controller using Google Analytics if it only sells to U.S. clients?

If a U.S. controller who only sells to U.S. clients uses Google Analytics on their website, would it be required to have a representative in the Union? I am unsure whether Google Analytics in this ...
0
votes
0answers
74 views

Facebook vs GDPR - Is Facebook never deleting the Searches you do?

I frequently delete the Search History from my account's Activity Log. However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past. Suggestions ...
0
votes
1answer
27 views

Which country laws apply to user data? HQ location or Cloud data center location

Anyone here know which country laws apply to user data when a startup based in a different country (ex: UK), than where user data resides (ex: Switzerland) ? Switzerland have better privacy (not ...
0
votes
0answers
92 views

Requesting Proof of Data Deletion

This questions covers the law and tech. If I delete my account at Facebook or any company with a website service, can I ask to be provided proof of data having been deleted in some form provided by ...
1
vote
2answers
81 views

Are insurance companies liable for employee theft of customer data?

Assume that Alice is getting a quote from an insurance company, but something goes wrong in the company's system while processing her quote. The company logs a defect and assigns it to Bob, one of ...
0
votes
0answers
39 views

Does data protection apply under a power of attorney relationship?

I have hired a relocation company to help me with dealing with the immigration office and I have signed a power of attorney so that they can visit the authorities and get feedback on my application on ...
0
votes
0answers
37 views

Data Privacy: Should a user be allowed to change another users profile information?

In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)? What laws (US & EU) would give guidance either way? ...
4
votes
1answer
95 views

Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?

I work at a SME. When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
1
vote
1answer
39 views

Can someone enlighten me about the main task of the independent supervision of data protection law

So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
0
votes
1answer
61 views

Hiding order invoice information, GDPR

I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like: Name Surname ...
1
vote
2answers
65 views

Is an auto-submitting form GDPR/DPA-compliant?

TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant? An organisation I am part of has an online form on their intranet for reporting incidents ...
1
vote
1answer
199 views

Hypothetical question about Whistleblower Protection

Let's say a US non-government employment comes in contact with very sensitive unprotected information on the web. The information was gathered using opsint (Open Source Intelligence) there was no ...
1
vote
1answer
155 views

GDPR on Proxy Users

I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc... My questions here are about the scope of GDPR. Does GDPR apply to people who: ...
1
vote
0answers
48 views

Question Regarding GDPR

I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
3
votes
1answer
33 views

Identity verification prior granting access to personal data [GDPR]

When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
1
vote
2answers
73 views

Can governments require administrators of groups on social media platforms to buy licenses?

The Kenyan government now wants administrators of WhatsApp groups and other social media platforms to pay for licenses. Is this possible with the GDPR, Facebook privacy policy, etc., as the proposed ...
2
votes
1answer
94 views

Data processing locations post-Brexit

I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients. I have several UK-based clients, all ...
2
votes
1answer
109 views

Public WiFi - when do you have to delete stored user data?

Note: I originally thought of this for germany, but if you have examples from other countries those are also welcome, since im interested in the topic in general. So lets say im using a public WiFi, ...
17
votes
4answers
6k views

Under GDPR, can I give permission once to allow everyone to store and process my data?

If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
1
vote
1answer
77 views

Do I violate GDRP if install WhatsApp as a private user?

As far as I can understand, if I install WhatsApp, the app sends my contact list to the server. Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
1
vote
1answer
22 views

Is a system that stores credentials required to meet the cyber security requirements of the systems it could give access to?

IT companies often use access keys, credentials, and remote management software to maintain their client's infrastructure. These access methods are then saved in some form of database so that the IT ...
1
vote
2answers
125 views

Is newspaper publishing of a defendant's details considered doxing in the United Kingdom?

Does doxing apply to a newspaper that publishes a defendant’s full name and full address (minus the postcode) following a first hearing in the Magistrates Court? Can a defendant who is yet to stand ...
1
vote
3answers
82 views

Does GDPR apply to personal information entered in a password-field?

If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply? For example if someone enters their email, phone number or name in a password-field? If so, ...
1
vote
1answer
83 views

United States HIPAA and New Zealand HISO from outside these countries

We are developing a software product for storing and managing health records in Australia, with the software product primarily targeted towards Australian healthcare organisations. This requires us to ...
-1
votes
1answer
66 views

Do I have to include a GDPR in my app even tho I don't collect data from users? [closed]

I have written an android app The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user? Is is ...
1
vote
2answers
87 views

File copying and deletion before employee leaves to competitor

This may be a mundane question but I cannot find an answer for it, as the law is not my area of expertise. If an employee is under contract and copies files (on mass to a personal cloud storage) for ...
1
vote
1answer
82 views

Private company making it hard to delete customer's personal data

Storyline A friend of mine opened an account with an online company that sells picture prints. Without her knowing, just after signing in, somehow (she did not understand how; probably through the ...
4
votes
1answer
118 views

Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?

Apologies in advance if this is not the correct exchange for this question. I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU. As part of ...
0
votes
2answers
54 views

GDPR question about processing personal data for research purposes that yield aggregated results

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...