Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
311
questions
-1
votes
2
answers
120
views
Under GDPR's strict consent requirement rules, could a criminal/hacker/troll remain anonymous in all his activities?
Since GDPR strictly requires consent to Personal Identifiable Information (PII), could a criminal exploit online services by remaining anonymous in all his criminal activities?
Providers are not ...
- 1,491
14
votes
5
answers
4k
views
Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?
Service providers like Google and Facebook are pretty much part of people's lives.
Like how the law has provisions for 'well known brands' (eg. generic trademarks and common carriers), does the law ...
- 1,491
3
votes
1
answer
425
views
Date Privacy and Twitch; Do I have the right to access my chat logs?
Under Data Privacy laws, the user has a right to access their data, erasure, etc. Yet under Twitch the users have no way to access their own logs, only the streamer and a team of mods.
This has always ...
- 33
0
votes
1
answer
103
views
GDPR Compliance - Password Protected Documents in AutoRecovery
I'm working with personnel data in my job, including lots of details which I know to be sensitive and most certainly covered by GDPR.
In order to maintain compliance with the regulations while ...
- 1
3
votes
1
answer
73
views
Site user posts data under licnese, can user demand erasure?
Suppose that a site, run as a free service, allows communication between users (a chat site). Suppose that the site also permits users to optionally upload text documents or images, which will be ...
- 113k
8
votes
2
answers
2k
views
Are there ways of storing personal data beyond standard GDPR limitations?
So GDPR harmonizes legal stance of personal data in the EU — mainly by limiting storage time of certain data, and by providing citizens with a procedure to request deletion of their personal data.
...
- 281
0
votes
2
answers
654
views
Is Google's Consent Management Platform not GDPR compliant since it does not show a consent form when 'personalised ads' are disabled?
This question borders the line between technical and legal but I am posting here because it is not a coding problem in itself. Apologies if this is the wrong forum.
I have set up my mobile app to use ...
- 75
4
votes
2
answers
160
views
Is it legal to process PII in EU of customers which are not in EU?
So I have an app that processes the PII of users and their interests, the app is south Asia based. The app doesn't support EU customers and is geo-blocked by default.
I would like to process and store ...
- 41
9
votes
1
answer
1k
views
Denied Data Subject Access Request (DSAR) due to third-party information
A while ago I made a data subject access request (DSAR, asking for personal information which is stored about me) which was part of an ongoing complaint. In a nutshell, I did a complaint to a company ...
- 231
1
vote
1
answer
174
views
How long can a company take to answer my GDPR request to download my data?
In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be ...
- 13
0
votes
1
answer
99
views
Is there generally a duration after which a permission given to a person is terminated automatically?
Consider the following as an example:
Jack and Sam were both 18 years old. At the time, both were good friends, and Jack has given Sam permission to use his e-mail account for sending and reading e-...
- 103
1
vote
1
answer
133
views
Would it be legal to sequence human DNA from wastewater?
DNA can Identify Individuals
I have asked this question in the biology stackexchange. Below the law part:
I know that there are some efforts from scientists working with bladder cancer to perform ...
- 113
0
votes
1
answer
119
views
The Data ownership for an automated server running for years prior to GDPR Regulations
Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various ...
- 105
2
votes
1
answer
1k
views
Impact of GDPR on remote work outside of the EU (as LLC)?
I do remote work for clients in the EU. The legal foundation is a B2B contract between two EU legal entities, one of which is the client's limited company, the other my limited company. Since both ...
- 23
2
votes
1
answer
452
views
GDPR - Are the typical lists of examples for personal data misleading?
Article 4 of the EU GDPR states
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);
The explanation for the term ‘personal data’ as
...
- 123
0
votes
0
answers
42
views
Is [company] breaching any data protection legislation in Canada needing my wife's details to authenticate MY account?
I created an online account in my name with a large Canadian retailer. My wife enters her credit card details to pay for the shopping. When I log in to the website it greets me with my name.
When I ...
0
votes
1
answer
42
views
EU privacy and data protection law for small WhatsApp group
We have created a small WhatsApp group to feed poor people and street children who are Covid affected in India. We are people from the EU, US, Australia and even from India. Members want transparency ...
1
vote
1
answer
86
views
Does the Data Protection Act 2018 in UK require users of a website to explicitly
Now that Brexit has happened, GDPR no longer takes effect in UK.
However, the Data Protection Act 2018 will continue to apply.
With GDPR's Article 6, a website is required to request explicit consent ...
- 1,003
4
votes
1
answer
333
views
GDPR unbelievable legitimate interest. What action to take?
If a website is claiming legitimate interest in data collection in a way that is unbelievable is there any action that a web site visitor can take?
For example, if one was to visit The Daily Mail you ...
- 817
1
vote
2
answers
97
views
The UK GDPA article 17 right to erasure. Can I retain the person's ID number if it no longer identifies them?
I manage a small relational database for members of a club with about 600 members. The 'member' table has records holding the memberID , their name, address phone etc. The memberID is then used as a ...
- 113
1
vote
2
answers
858
views
How long can an employer keep financial details after employee has left under GDPR?
I finished a job in 2019, but just received notification of a data breach at that job in 2021, and my bank account number, sort code, national insurance number, full name, address and date of birth ...
- 333
2
votes
0
answers
62
views
GDPR data deletion: can I ask the company to delete the data it had exported in the United States?
I am located in Italy.
I have subscribed to a service and provided some PII that "could be exported in the United States".
If I send a GDPR request to delete my data, can I ask them to also ...
- 1,586
2
votes
0
answers
54
views
GDPR data deletion: do I have a right to have the company specify which data it retained and why?
I requested the DPO of a company to delete all my data under GDPR.
After a step of "account ownership" verification, it replied that:
XXXX has deleted all of your personal data except where ...
- 1,586
2
votes
1
answer
181
views
What is a "sealed" document?
When reading about T.J Miller, I noticed one sentence
Student conduct proceedings were held, the results of which are sealed (...)
What is the legal framework for such "sealing" of ...
- 2,461
0
votes
1
answer
53
views
Can I use an Employee's Personal ID in an company internal project? (EU Data protection Law)
I want to create an Order-Website for our company, where employees can order dishes from the canteen, so they know roughly how much food to order.
Now the question came up, if you order some dish, but ...
5
votes
1
answer
922
views
UK: What information are the police legally required to collect when going door-to-door, and why?
A few days ago, a police officer knocked on my door in the evening and asked whether I had noticed any disturbances in my street earlier in the day - he said it was in relation to reports that they'd ...
- 175
0
votes
1
answer
85
views
Youtube made for kids
Youtube allows youtubers to mark videos as made for kids. There the United States COPPA is cited The age of a kid here is thirteen . In U.K. it is 16 and some country it may be else if they wish to ...
1
vote
1
answer
98
views
Does legitimate interest need to be justified in response to a GDPR DSAR?
In the response to a GDPR Data Subject Access Request, in describing the lawful basis under which the data controller is processing my data, I got this:
We process your personal data for our ...
- 817
1
vote
0
answers
174
views
Mendeley is encrypting my data on my hard disk with a key only available to them: can I ask for unencrypted data under GDPR?
I use Mendeley Desktop to manage my bibliography. Now I want to switch to Zotero.
Zotero used to be able to import the Mandeley's database. However, Mendeley 1.19 encrypted my data on my HDD with a ...
- 1,586
2
votes
2
answers
127
views
Giving contact information on estranged family member without consent
Background: I'm based in the UK, specifically in England whilst my brother is in Scotland. We are also both adults.
I have a bit of a weird situation and I wanted to know where I stand legally.
...
anon
0
votes
1
answer
1k
views
Twitter and account deactivation - Do you have to explicitly ask for account to be deleted if company nowhere says that it will do so? [duplicate]
I am trying to delete my Twitter account.
Twitter only has a "deactivate" account button, and no "delete" account button, as I posted here.
It looks like in the guides posted by ...
- 1,586
2
votes
2
answers
550
views
GDPR: What data am I allowed to keep after a user requests deletion?
I struggle to find an insightful article on what, specifically, I have to delete and what I don't have to delete when a user requests deletion of their data.
Some things are obvious to me: personal ...
- 121
0
votes
2
answers
150
views
Are websites mandated to retain I.P. addresses fr five years or not under this regulation or id is a mis interpretation?
If one searches about "Indonesia data retention law 5 years" one will find that there seems t be a regulation in Indonesia that states that one must retain ll collected data fr five years ...
user36042
0
votes
1
answer
120
views
Does GDPR apply to data of users who lied about their country of residence?
Imagine a website which requires users to register in order to use all its features. In order to avoid exposure to GDPR complains, would any of the following tactics work?
Ask the user for their ...
- 1,345
-1
votes
1
answer
239
views
Will a court order be taken out for this? Could the FBI get involved in something like this? [closed]
I had 3 gmail accounts (where I had the same generic random first name and other words and random letters that I was made to put in to get them). None of them contained no personal information of mine....
- 51
0
votes
1
answer
253
views
I emailed a law and data privacy professor regarding an issue I was having to do with internet privacy law. Will I get in legal trouble for this?
I emailed an American law and data privacy professor to ask to help explain whether google could reveal my information if a court order was taken out to identify me. I was very over emotional in the ...
- 51
2
votes
1
answer
62
views
Is it legal to upload NASA's SRTM dataset to kaggle?
Short Version:
Is it legal to upload NASA's SRTM dataset to kaggle.com?
Long Version:
I'm doing a computer science and data science project on landslide analysis. For this, I'm considering a variety ...
- 131
1
vote
1
answer
85
views
Legality of Network companies scanning TCP ports - how has my consent been obtained?
In my firewall and IIS logs I constantly see entries for servers from companies like ZenLayer, Dedipath, DigitalOcean and other Network-related businesses that appear to ping/scan my systems to ...
- 11
-2
votes
2
answers
455
views
Is it legal if I collect and sell public data from Twitter?
Let's assume that, technically i am able to collect the public information from Twitter (including user's profile and their tweets) from Twitter.
I am wondering, is it legal to sell this data?
How ...
- 126
0
votes
1
answer
126
views
UK - Does a foreign, non-EU company's ToS Override GDPR
MiHoyo is a Chinese company that has recently produced the hugely popular online game, Genshin Impact. However, terrible online security has led to thousands of user details, emails, phone numbers, ...
- 101
-2
votes
1
answer
82
views
Conflict between data protection laws and import export laws regarding cryptography [closed]
Main question:
Cryptography laws restrict import of cryptography however data protection laws demand it. Which laws prevails?
Background:
Under the Wassenaar Arrangement going many countries control ...
33
votes
4
answers
11k
views
Does a private citizen in the US have the right to make a "Contact the Police" poster?
Imagine the following hypothetical situation. Assume the location is in the United States.
Mary had a credit card stolen by a suspect. The suspect used the credit card at a store. The manager of the ...
- 455
-1
votes
1
answer
72
views
Is requesting a customer database for testing purposes legal?
We're a company working in building industry and have a program, develeoped together with our software vendor, to create quotes and configurate products. The program uses a MS SQL database.
It stores ...
- 113
1
vote
1
answer
164
views
Is it against the law to forge identity documents if relevant information is accurate?
Organisations are required to "use all reasonable measures to verify the identity of a data subject who requests access". This has been implemented in some cases by requiring the data ...
- 817
1
vote
1
answer
48
views
What restrictions can organisations impose on the method of making a DSAR?
From the ICO "An individual can make a [Subject Access request] SAR verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their ...
- 817
5
votes
1
answer
213
views
Are there temporal limits to data requirements for a GDPR SAR?
Are there any limits on data that must be provided as part of a GDPR subject access request (SAR) based on the age of the data?
The particular case I am thinking about is SAR made to the 3 credit ...
- 817
14
votes
2
answers
3k
views
Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?
This whole thing is to do with using an IP address to identify an anonymous forum account and then sharing details of the ownership of this account with another member.
I will explain the best I can:
...
- 151
-2
votes
2
answers
187
views
What is the definition of computer virus by law?The definition seems to be broad
According to the Indian IT Act we cannot place computer virus(which includes cookies) without user permission but does that mean we need to take permission even for placing nessecary cookies?
...
-3
votes
1
answer
106
views
Can the POPI act land the CEO of a tech giant in a South African jail?
How likely is it that a breach of POPI act will lead to a CEO of a tech giant being subject to jail?Will it really be the CEO or other officials?
The South African POPI Act could impose imprisonment ...
6
votes
2
answers
1k
views
As per GDPR, how are the agree/disagree to cookie buttons to be designed?
I just stumbled over this very... interesting cookie dialogue on the Ansible site:
How am I, as the average user, to decide if I'm agreeing or not to the choice with "Out" or "In"?...
- 183