Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
310
questions
2
votes
1
answer
61
views
What subject access rights exist when only some of the data relates to you?
If some data record exists where some of the data relates to person A (eg. telephone number) while other data does not (eg. name), what right of access does person A have to that record under the GDPR?...
- 817
1
vote
1
answer
164
views
Advertising in mobile apps and proof of consent
What does CCPA require for proof of consent to display advertising in mobile applications (vs a web site), especially for apps that do not create a user profile? Hypothetically, would it be sufficient ...
- 27
-4
votes
1
answer
183
views
What is the meaning of mail in the CCPA (California Consumer Privacy Act of 2018)?
The CCPA states that under section 1798.130(2) customers can request their data BY_MAIL OR BY ELECTRONIC MEANS as the customer chooses.
However NOWHERE on any website can I find a button or form to ...
user35276
2
votes
2
answers
99
views
Can a German employer force employees to submit personal data to a contractor?
A German higher-education institution recently introduced a new measure to facilitate Covid-19 contact tracing: next to each door (i.e. entrances to the building, the lecture rooms, the labs and some ...
- 153
-1
votes
1
answer
153
views
GDPR account verification
I am having trouble in deciding what information I should be recording in order to verify an account user in the event that
a) the user is locked out of their account for some reason
b) they make an ...
- 101
-1
votes
2
answers
102
views
HOA creating accounts on a third-party website without my consent
This question is in regards to a situation in Colorado in the US. I began receiving emails from a website distributing community information. The emails did not have an unsubscribe link so I sent them ...
- 193
1
vote
0
answers
47
views
CPA leaked tax return details
A CPA that is supposedly working on my Tax application accidentally has uploaded some other people tax applications to my account on their "secured" platform.
Now I am very worried that they ...
- 11
1
vote
1
answer
81
views
Am I allowed to sell the reviews of my product to another company?
I ran a company which closed down two months ago. One of my former competitor's has contacted me about buying my branding, product formulations, and business name.
They are not interested in my ...
- 115
0
votes
1
answer
436
views
Does a certified letter proof the content?
My previous company has recently updated their website, and included pictures of the employees as well as events and reviews to boost their image.
I don't know if they have asked permission to current ...
- 101
2
votes
1
answer
127
views
Right to personal data on youtube : what if account is banned
Since GDPR at least we have the right to access and get the data we generated on websites like Facebook or Google (our history, likes, almost everything).
My question is : what happens if Facebook or ...
1
vote
1
answer
89
views
How does GDPR affect game data and how it is processed?
A real-time strategy game's data involving player points is available publicly (the point data is paired with their username). A player gains points through actions such as 'attacking' and 'building'.
...
- 111
2
votes
1
answer
775
views
Online player nicks: personal data under GDPR?
We run a server for an old, open-source FPS game. The game collects match events that get logged, where the only information stored is player nicknames (changeable at will at any time by the players). ...
- 33
2
votes
1
answer
173
views
Does sharing personal data publicly imply consent for collection and processing?
Suppose an EU citizen publishes their personal information, such as name and contact details online, for instance, on social media.
If I wanted to contact them in my professional capacity over email, ...
user34046
2
votes
3
answers
498
views
Does GDPR consent notification apply to access points intended purely for maintenance?
Suppose I have a publicly available interface, intended to be used exclusively by me or my employees for the purposes of maintenance, e.g. an SSH server.
Since I am processing user's IP address when ...
user34046
2
votes
1
answer
224
views
Cookie consent compliance: disabling JavaScript and keyboard accessibility
I've noticed that most cookie consent solutions are JavaScript based, and when you have JS disabled, the cookie consent settings may not be accessible.
Speaking of accessibility, some cookie consent ...
1
vote
1
answer
138
views
Do users who are given another user's email address have obligations under GDPR?
I have an app/website which connects people into groups and then the group performs work in the real world. That work in the real world will occasionally require that group members talk to each other. ...
- 13
0
votes
1
answer
46
views
International Transfers to a Data Subject
A membership organisation based in the EEA receives membership applications from people based outside of the EEA, in countries which do not have an adequacy decision. During the course of the ...
- 151
-5
votes
1
answer
189
views
At first UK, then EU, then GERMANY, then GDRP, now LGPD ... How far we will be enforced to comply with other countries extraterritorial laws? [closed]
(these are somehow related questions: 1, 2, 3; but not duplicate ). Also, if you downvote, please comment the reason of downvoting, and don't see the rant where it is not.
Original question:
We (...
- 190
0
votes
1
answer
206
views
Can employer collect and share employee data such as skin colour?
In an attempt to make the workforce more "diverse", our employer has announced that they will start
"collecting and sharing" [sic!] employee data such as ethnicity and gender. This,...
-1
votes
2
answers
196
views
The right to hide one's password
It's well known that you should never reveal your password to anyone -- including your boss, your sysadmin, etc. My friend's former boss has sued her, demanding (among other things) the password to ...
- 99
6
votes
1
answer
396
views
Can a company charge you to update your address under GDPR?
I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone ...
- 163
0
votes
0
answers
54
views
If a user of my site gives me info of a third party they claim to be affiliated with, am I allowed to contact that third party to check?
I am developing an app where a part of the on-boarding process requires users to enter the email / company name of the agency that they are affiliated with (the 3rd party). I need to confirm that they ...
- 109
-1
votes
2
answers
143
views
As an individual, not a company, if I collect email addresses of visitors to my website, what gdpr regulations apply to me?
I'm planning on making a website to act as a CV / portfolio of my work as a software developer. I intend to lock this personal data behind a token based access system, so that it isn't available ...
- 101
1
vote
1
answer
187
views
Does a hyperlink to a privacy policy have to be available after the user agrees?
A website that deals with personal user data is legally bound by CCPA Privacy Rights and GDPR Data Protection Rights. The user must agree to the privacy policy before the website has consent to share ...
- 191
0
votes
1
answer
91
views
Is Google obliged to obtain consent for the processing of searches for anonymous searches under the GDPR?
If you do not register a personal account for Google, thereby not giving specific and informed consent for the processing of your personal data, are Google still obliged to obtain consent for the ...
- 135
3
votes
1
answer
173
views
Why does Google require consent from users in order to process ads personalization data?
Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was ...
- 135
0
votes
2
answers
170
views
What is the law regarding web/mobile applications and "personal" data?
I'm developing an application for mobile/web/desktop that will (in very watered down basic terms) store free text strings they've self-contributed and access them freely.
As it stands, these ...
- 101
0
votes
1
answer
82
views
Is any attempt to access restricted information on the web considered an attack?
This article reports that a person who "gained access to the admin portal by simply altering the website’s URL" is now under investigation by FBI for "exploiting personal information".
I want to ...
- 1,345
2
votes
1
answer
116
views
GDPR - Personal data
I've read the definition of "personal data" and I still can't understand it clearly. For example I have a youtube account and create a comment, is this comment now considered my personal data? If that ...
- 23
36
votes
2
answers
6k
views
How to store refusal of cookie consent
If a user refuses cookies on a website, then how can that website store that refusal? As far as I can tell, the GDPR requires you to store both consent to and refusal of personal data storage. But it ...
11
votes
2
answers
1k
views
To comply to GDPR, are social networks required to have a button to "Export your Data"?
Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, ...
- 1,003
5
votes
1
answer
349
views
Deletion of personal data
I recently registered an account on an employment agency website. Had to provide my email address, a password and of course all of my personal data, including my complete professional background.
...
- 153
4
votes
2
answers
448
views
If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?
I’m considering buying the assets of an insolvent company that has gone into administration / receivership.
Included in the assets is a customer database.
How does GDPR apply?
is the purchasing ...
- 143
2
votes
1
answer
205
views
Does the European Union allow to store medical (sensitive) data in cloud platforms such as Amazon Web Services or Google Cloud?
Does the EU allow to store patients medical data in cloud databases from providers such as Amazon Web Services or Google Cloud?
What are the legal requirements?
Can you point at some legal source ...
- 123
2
votes
1
answer
115
views
Does Article 27(1) of the GDPR apply to a U.S. controller using Google Analytics if it only sells to U.S. clients?
If a U.S. controller who only sells to U.S. clients uses Google Analytics on their website, would it be required to have a representative in the Union? I am unsure whether Google Analytics in this ...
0
votes
0
answers
93
views
Facebook vs GDPR - Is Facebook never deleting the Searches you do?
I frequently delete the Search History from my account's Activity Log.
However, every time I start typing in Search, Facebook seems to remember perfectly searches I've done in the past.
Suggestions ...
- 1,003
0
votes
1
answer
39
views
Which country laws apply to user data? HQ location or Cloud data center location
Anyone here know which country laws apply to user data when a startup based in a different country (ex: UK), than where user data resides (ex: Switzerland) ?
Switzerland have better privacy (not ...
- 101
0
votes
0
answers
217
views
Requesting Proof of Data Deletion
This questions covers the law and tech.
If I delete my account at Facebook or any company with a website service, can I ask to be provided proof of data having been deleted in some form provided by ...
- 101
1
vote
2
answers
91
views
Are insurance companies liable for employee theft of customer data?
Assume that Alice is getting a quote from an insurance company, but something goes wrong in the company's system while processing her quote. The company logs a defect and assigns it to Bob, one of ...
0
votes
0
answers
39
views
Does data protection apply under a power of attorney relationship?
I have hired a relocation company to help me with dealing with the immigration office and I have signed a power of attorney so that they can visit the authorities and get feedback on my application on ...
- 113
0
votes
0
answers
45
views
Data Privacy: Should a user be allowed to change another users profile information?
In a SaaS platform, should users be allowed to change other users profile information (things like Name, Gender, Company they work for etc)?
What laws (US & EU) would give guidance either way? ...
- 1
5
votes
1
answer
168
views
Does the data protection european regulation (GDPR) apply to processing information obtained from business cards and conversations?
I work at a SME.
When we meet someone (either a potential customer or a potential partner) at an exhibition, meeting, conference, etc., we usually save that person's contact information and topic of ...
- 153
1
vote
1
answer
43
views
Can someone enlighten me about the main task of the independent supervision of data protection law
So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country ...
- 113
0
votes
1
answer
114
views
Hiding order invoice information, GDPR
I have a software where we can show order invoice information by typing in the order number and buyer email. Now the thing is that I need to hide the sensitive order information like:
Name Surname
...
- 103
1
vote
2
answers
127
views
Is an auto-submitting form GDPR/DPA-compliant?
TL;DR is a form that automatically submits itself, even after the user has closed the window, GDPR-compliant?
An organisation I am part of has an online form on their intranet for reporting incidents ...
- 641
4
votes
2
answers
326
views
Hypothetical question about Whistleblower Protection
Let's say a US non-government employment comes in contact with very sensitive unprotected information on the web. The information was gathered using opsint (Open Source Intelligence) there was no ...
1
vote
1
answer
330
views
GDPR on Proxy Users
I believe I have a good overall understanding about the GDPR legislation, in terms of what needs to be protected, etc...
My questions here are about the scope of GDPR.
Does GDPR apply to people who:
...
- 1,003
0
votes
0
answers
49
views
Question Regarding GDPR
I have a question regarding The General Data Protection Regulation 2016/679 in European law and I'm not even sure this is the right place to ask, but I'll ask anyway as I'm stuck on where to find this ...
- 11
3
votes
1
answer
45
views
Identity verification prior granting access to personal data [GDPR]
When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data?
1
vote
2
answers
78
views
Can governments require administrators of groups on social media platforms to buy licenses?
The Kenyan government now wants administrators of WhatsApp groups and other social media platforms to pay for licenses. Is this possible with the GDPR, Facebook privacy policy, etc., as the proposed ...
- 113