Questions tagged [data-protection]

For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.

Filter by
Sorted by
Tagged with
0
votes
1answer
171 views

Autoresponders and GDPR - do they comply with the law?

Would it be GDPR compliant to have an autoresponder request opt-in permission? For example, a customer makes an enquiry by sending an email to the company in question. The company in question then ...
3
votes
2answers
510 views

Is the GDPR applicable to data stored in human memory?

If data is stored in human memory, is the GDPR applicable? Say, an employee of a company remembers an email address of a client, their date of birth, or even what their face looks like, does the ...
1
vote
1answer
528 views

Parent company GDPR compliance

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not ...
3
votes
1answer
297 views

Should email addresses be anonymized/pseudonymized under GDPR?

GDPR states recommendation to pseudonymise or even anonymise Personal Data. A lot — most of — web sites and services require email address on signup. Should, from the Data Controller's point of view, ...
1
vote
1answer
49 views

Can we collect data from minors to operate a competition with a prize?

We're planning to run a simple competition at an event. It's a skill based competition (not a lottery), where the best score at the end of the event will receive an android tablet. No purchase is ...
0
votes
2answers
75 views

Council “misplaced” copy of contract - is this a data protection breach (UK)?

My Girlfriend changed jobs recently, and as such had to provide the local council with a copy of her employment contract to support claims for low-income support benefits. Now, it seems they have ...
-1
votes
2answers
38 views

Which companies use personal data [closed]

I am not an expert in Law and I apologize if I make a big mistake by choosing wrong words. Since there are lots of new laws about data protection being enforced by courts, it became easier to see if ...
5
votes
1answer
1k views

Germany: Does a github.io hosted site require imprint / data privacy statement according to the GDPR?

github offers free publicly accessible data storage. Many people use that to present their personal profile where they e.g. advertise for freelancing services. An example url could be http://username....
1
vote
2answers
95 views

Can my user agreement require end users to indemnify me for misuse of their data by third-party services embedded in my app?

I have an Android App which is already in the Play Store. Now due to GDPR I am planning to improve my Privacy Policy and a Terms of service. I am planning to add certain terms in my Terms of service ...
4
votes
1answer
760 views

How does the CLOUD Act apply for non-US persons' data stored on US-owned servers outside the USA?

The Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943) was signed into law on March 23, 2018. The law became necessary because the previous legislation in the Stored Communications ...
2
votes
0answers
64 views

GDPR - Right of Access From Processor

If my organisation is processing data on behalf of a controller, does the data subject have access rights through the processor, or must Subject Access Requests (SARs) go through the controller? If ...
1
vote
1answer
721 views

Is there a UK equivalent to the USA's FERPA?

The Family Education Rights and Privacy Act (FERPA) describes rights students have to their private records in the United States. Is there an equivalent for students in the United Kingdom?
4
votes
2answers
720 views

How does GDPR affect sports statistics?

I am involved in maintaining few sports statistics systems. Of course, these systems are full of personal data. It is important to keep a list of players in a hockey game and a name associated with a ...
1
vote
3answers
91 views

Is ”data breach” a correct way to describe the Facebook scandal?

I’m reading the words ”data breach” a lot in the Facebook Cambridge Analytica scandal context (example). But is this a correct way to describe the scandal? The definition of data breach from the ...
0
votes
1answer
61 views

Can I share IP adresses of machine who attempted logins?

I started a small experiment. I put up a few servers on digital ocean and I started logging all the failed login attempts. They were numerable. The dataset after a week is a fun one to play with. I'...
7
votes
1answer
3k views

Are chat logs against the new european GDPR?

Is keeping logs of chats (e.g. IRC, in this specific case Twitch chat) against the new European General Data Protection Regulation? I know you can't save data which can be linked to a natural person ...
6
votes
3answers
655 views

Does the GDPR allow me to access data from public sources, store it and anaylize it?

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer. Does the GDPR allow me (my software/server) to derive data, store it and ...
2
votes
1answer
108 views

Advice sought regarding GDPR and managing sensitive data

We have a site that has very sensitive information including medical and information about children. This is on a public website with many organisations shared on one server. There are files that are ...
1
vote
0answers
315 views

Encryption export compliance document in iOS app store

I am using encrypted core data (a wrapper of sqlcipher for core data) in my application in order to encrypt the database, and later before submitting the app to the appstore, I happened to notice that ...
4
votes
1answer
207 views

Nuisance-causing passwords or technology at US borders

My question pertains to the somewhat recent emergence/increase of technological searches present at US borders. The premise I am operating under is that, a), while there are limits to this, border ...
2
votes
2answers
161 views

Does the EU GDPR apply to these types of natural persons?

Does the GDPR apply to a website operator who is a natural person (not a company or non-profit) and uses the website directly for commercial activity uses the website to advertise his/her other ...
4
votes
1answer
315 views

For HIPAA, Does US Patient Data Have To Stay On US Servers?

For an application that stores US patient data, does HIPAA require that US data stays on US servers?
2
votes
1answer
54 views

GDPR: Applied Security vs Employee Contracts

An Organisation has 10,000 employees. All 10,000 employees have unrestricted access to ALL Customer PII data stored by the Organisation. Only 200 employees require access to the PII data for the ...
0
votes
1answer
54 views

confidentiality disclaimer Spain / EU

Ive, recently had some email correspondence with a company based in Spain regarding a reimbursement for poor service received. The company's email went to great lengths to communicate the ...
5
votes
1answer
2k views

How does the GDPR apply to software developed by one company and used by another?

Question I work for a bespoke software development company and I've been doing a lot of reading about the GDPR before it comes into force next year. A lot of it makes sense, however I'm really ...
0
votes
1answer
92 views

definition of personal data collection related to privacy policy

So I am about to publish a mobile app and I need a privacy policy, although my app doesn't really collect any type of user information, is there some kind of definition about what it means to "collect"...
4
votes
2answers
155 views

Is it illegal to continue using oAuth tokens after a user asks to remove them?

We have an app that allows users to connect their CRM. The CEO wants to "fool" users into making them believe that they can delete the OAuth tokens so that we don't have access to their data anymore....
7
votes
2answers
855 views

GDPR (General Data Protection Regulation) - crypto-shredding or regular delete?

The introduction of the GDPR (General Data Protection Regulation) in May 2018 for all businesses targeting EU citizens raises questions regarding the Art. 17 right to erasure, also known as the right ...
0
votes
1answer
2k views

Are companies in the United Kingdom entitled to make data subject access requests?

Are companies in the United Kingdom entitled to make data subject access requests, or is this right limited to non-companies such as individuals? Which statute permits or prevents them from doing so?
0
votes
2answers
505 views

Can I claim copyright on public data that I have compiled into a database?

I have compiled a bunch of data released by the UNECE and government agencies into a multilingual searchable database on my website. In total it's about 2000 database entries in 4 languages, so about ...
0
votes
1answer
170 views

Do I have the right to protect my personal property ? [closed]

In most part of US, people have the right to protect their own personal property with an appropriate amount of force.With this concept of personal property and a persons right to protect as background,...
1
vote
1answer
93 views

Are there any legal limitations to using IP based authorisation so that only users from client premises can have access to cloud?

We have a cloud-based B2B solution that is meant to help them collate and manage their operational data. One of clients wants to ensure that their employees can only access their data from devices ...
4
votes
1answer
826 views

GDPR Legislation and user invites by email

I want to understand what the implications are for user emails with the onset of GDPR. It's a bit of a strange question but here is the scenario. We run a Software as a Service platform when a user ...
2
votes
2answers
74 views

Address search at work not related to work

My wife has had letter through our door regarding a scrape in a car park (between cars) at our local vets. The other car belonged to an employee of the vets. At the time both parties were happy and it ...
4
votes
2answers
506 views

GDPR - Right to erasure - Conflicting laws

I'm reading up on EU's GDPR in relation to an anonymization product I am working on. The one section that has raised a few questions is article 17 - The right to erasure, or more popularly referred to ...
2
votes
1answer
339 views

What damages could one claim in a data breach, if the data was not subsequently used fraudulently?

Equifax recently announced they suffered a very large data breach, allegedly affecting almost half of all people in the United States. It's expected that lawsuits against Equifax will be popping up ...
0
votes
1answer
148 views

How can a 3D Artist know that his model is being sold some where else?

How can a 3D Artist know that his model is being sold some where else? And with so much modification that he can tell that its his model but can't prove it? Suppose, I've created a 3D Model and then ...
0
votes
2answers
3k views

How to validate an employee's expense receipt for an Uber ride

I believe an expense receipt I have received for an Uber ride from an employee is fake. Am I legally allowed to contact Uber and ask them to verify the receipt? If I suggest to the employee i think ...
0
votes
1answer
65 views

Can a company be defined as the Data Controller?

In our company training on Data Protection this statement is made A data controller is the person (legal or natural) who decides on the purpose for which data is to be collected, held or ...
3
votes
1answer
89 views

According to GDPR Article 30, do I maintain a continuous record or just a one-off?

Article 30 of the GDPR seems ambiguous to me, and I'd like some clarification. See: https://www.privacy-regulation.eu/en/30.htm It states that a data controller ...shall maintain a record of ...
1
vote
0answers
88 views

Data Protection - Data removal request

A UK-based recruitment website focusing specifically on the technology industry has somehow obtained a copy of LinkedIn's public profile database and are hosting it on their own website as if it were ...
1
vote
1answer
427 views

GDPR - Offshoring

We work for consulting company in India, call it Z. Z has a partnership with a European cards & transactions processing company Y. So the Indian consulting company Z does offshore production ...
2
votes
3answers
2k views

What counts as personal data under GDPR?

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679). There is a ...
1
vote
3answers
11k views

Will the GDPR apply to small hobby clubs?

When it comes into force, how will the General Data Protection Regulation affect small hobbyist organisations? Will it apply to, for example, student societies that are holding lists of email ...
0
votes
1answer
39 views

What constitutes PII w.r.t. DPA \ EU legislations?

I have the following data items: Name Office Department Parking space number I'm using What is personal data? – A quick reference guide to figure out what out of these items would be regarded as PII....
-1
votes
1answer
72 views

Cloud providers and proprietary data

I have read the terms and conditions of my cloud service and they "reserve the right to monitor abusive or offensive usage", but I would like to know if they can spy on my proprietary data and use or ...
1
vote
2answers
2k views

Is it legal for Grammarly to read, share and store forever all my emails?

I have just noticed the following paragraph in Grammarly Terms and Conditions. By uploading or entering any User Content, you give Grammarly (and those it works with) a nonexclusive, worldwide, ...
6
votes
1answer
1k views

Resellers under GDPR - disclosure of data processors or countries of data storage?

A significant number of web-design and I.T. consultancy companies typically re-sell third party services related to their own as part of their product/service portfolio, to give a few examples, ...
4
votes
1answer
230 views

Legality of secretly micro-chipping coins?

In the UK, we are less than a week away from the new £1 coin coming into circulation, which has been billed as 'the most high-tech coin in the world'. In an effort to reduce counterfeit, they have ...

1 2 3
4