Questions tagged [data-protection]
For questions about the legal obligations of protecting data (personal or otherwise) and the consequences of failing to do so.
311
questions
1
vote
2
answers
78
views
Can governments require administrators of groups on social media platforms to buy licenses?
The Kenyan government now wants administrators of WhatsApp groups and other social media platforms to pay for licenses. Is this possible with the GDPR, Facebook privacy policy, etc., as the proposed ...
- 113
2
votes
1
answer
98
views
Data processing locations post-Brexit
I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients.
I have several UK-based clients, all ...
- 121
2
votes
1
answer
163
views
Public WiFi - when do you have to delete stored user data?
Note: I originally thought of this for germany, but if you have examples from other countries those are also welcome, since im interested in the topic in general.
So lets say im using a public WiFi, ...
- 183
17
votes
4
answers
6k
views
Under GDPR, can I give permission once to allow everyone to store and process my data?
If I own the data, can I declare, as part of my personal freedom, that I basically agree that my specific data can be stored and processed anywhere by anybody, without asking myself every time?
- 457
1
vote
1
answer
83
views
Do I violate GDRP if install WhatsApp as a private user?
As far as I can understand, if I install WhatsApp, the app sends my contact list to the server.
Isn't it by GDPR terms illegal to allow this data processing step if I have not asked all of my ...
- 457
1
vote
1
answer
29
views
Is a system that stores credentials required to meet the cyber security requirements of the systems it could give access to?
IT companies often use access keys, credentials, and remote management software to maintain their client's infrastructure. These access methods are then saved in some form of database so that the IT ...
- 327
1
vote
2
answers
173
views
Is newspaper publishing of a defendant's details considered doxing in the United Kingdom?
Does doxing apply to a newspaper that publishes a defendant’s full name and full address (minus the postcode) following a first hearing in the Magistrates Court?
Can a defendant who is yet to stand ...
1
vote
3
answers
163
views
Does GDPR apply to personal information entered in a password-field?
If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply?
For example if someone enters their email, phone number or name in a password-field? If so, ...
- 121
0
votes
1
answer
161
views
United States HIPAA and New Zealand HISO from outside these countries
We are developing a software product for storing and managing health records in Australia, with the software product primarily targeted towards Australian healthcare organisations. This requires us to ...
- 9
-1
votes
1
answer
83
views
Do I have to include a GDPR in my app even tho I don't collect data from users? [closed]
I have written an android app The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user?
Is is ...
- 101
1
vote
2
answers
135
views
File copying and deletion before employee leaves to competitor
This may be a mundane question but I cannot find an answer for it, as the law is not my area of expertise.
If an employee is under contract and copies files (on mass to a personal cloud storage) for ...
- 113
1
vote
1
answer
101
views
Private company making it hard to delete customer's personal data
Storyline
A friend of mine opened an account with an online company that sells picture prints. Without her knowing, just after signing in, somehow (she did not understand how; probably through the ...
- 145
4
votes
1
answer
155
views
Is it legal to compel users to share data in order to access more features, when the features being accessed do not require the data being requested?
Apologies in advance if this is not the correct exchange for this question.
I am a developer working for a company that owns a healthcare application. They operate exclusively in the EU.
As part of ...
1
vote
2
answers
76
views
GDPR question about processing personal data for research purposes that yield aggregated results
So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (...
- 11
3
votes
2
answers
212
views
Controller processor roles for a SAAS for schools
Assume the following situation:
There is a cloud-software (SAAS) which is used by a school for basically three things:
Edit: The SAAS was designed with children facilities in mind: Nurseries, ...
- 151
30
votes
4
answers
9k
views
ISP is not hashing the password I log in with online. Should I take any action?
I just phoned the customer support number for my ISP for the first time and was surprised to be asked the fourth and fifth characters of my password, specifically the one I used to log into my account ...
- 419
0
votes
2
answers
74
views
GDPR: can we ask the building owner to share and/or destroy data about one's RFID activity?
this is a follow up of https://security.stackexchange.com/questions/84184/do-rfid-key-cards-track-the-user-through-entry-ways
It seems most buildings store the activity of one's RFID key activity.
...
- 113
3
votes
4
answers
189
views
Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?
GDPR Article 39(1)(b) states:
The data protection officer shall have at least the following tasks:
(b) to monitor compliance with this Regulation, with other Union or
Member State data ...
3
votes
4
answers
468
views
Can a one-time-pad provide legal immunity - (make data inadmissible) -?
IMPORTANT NOTE:
This question is quite niche, I am not sure if this stack is the most relevant place, please inform me if there is a better place for it.
To explain the question:
I am asking if, a ...
- 43
3
votes
3
answers
250
views
If you find something indexed on a search engine, is it legal to access and report that to the firm?
I found a US law firm's SQL database indexed on Google exposing email addresses, phone numbers, comments/questions of its clients. Not to mention the user database with even worse information. This is ...
Timothy French
4
votes
1
answer
419
views
How to make data brokers delete my information without providing more information? Can I take legal action?
I've been reading this terrifying list of data brokers after finding my information in a Google search result. I want to reach out to the "high-priority" data brokers and get them to remove me from ...
- 141
0
votes
2
answers
100
views
Proportion of copyrighted material that can be distributed without infringement
Is there a threshold or a descriptive proportion that is considered not copyright infringement but merely creative and educational use when distributing some copyright protected material along with ...
- 101
2
votes
1
answer
123
views
Removing my personal data ex-employer (RGPD/GDPR)
I work and live in France. I worked for a company last year but I quit working there months ago. Since I left, they still have not have removed some data accessible on the internet, like my first name/...
- 21
1
vote
2
answers
389
views
Do you have to provide the name and email address of your data protection officer?
Looking at Steam's privacy policy, they don't provide an email address to reach the DPO nor do they name them:
You can contact Valve's data protection officer at the address below.
While we ...
- 622
0
votes
1
answer
92
views
A query with regard to Defamation and Data Privacy
Suppose student X fails in Professor A’s class. X takes professor A’s picture from the university website and then puts up posters around campus with the picture along with offensive comments. He ...
- 133
3
votes
1
answer
56
views
A general question under Personal Data Privacy
Suppose X is a student body that holds a database of comments made by its members about the lecturers of ABC University. Professor Y from ABC requests X to send him a copy of all comments about him. ...
- 133
2
votes
1
answer
236
views
Identity photographs under GDPR
Are identity photographs, of the form commonly used for things like a bus/rail pass or membership card considered to be "special category data" within the meaning of the UK's Data Protection Act 2018?
...
- 293
0
votes
1
answer
30
views
When to authorize someone and when to sign a contract for processing personal data
There are two ways for the data controller to let someone else process the data he controls:
authorise him or her to do so,
sign a legal contract making him or her a 'processor' (Article 28 GDPR).
...
2
votes
1
answer
108
views
What practical confidentiality protections can BSA offer to software piracy whistleblowers?
This question refers to a form for reporting software piracy. That page has an FAQ question:
If I report software piracy to the BSA, will my name be kept confidential?
Your name will never be ...
- 4,798
1
vote
1
answer
168
views
The case of creating personal data by combining non-personal data
In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify ...
2
votes
2
answers
195
views
Can I share scammers personal details online? What type of details can I share?
I live in the UK, and I constantly see scams on Facebook such as:
"£300pm house. I live abroad, so you will need to send me the money, and I will send you the keys in the post," or
"Free iPad for ...
1
vote
2
answers
112
views
Data Scraping public athlete name and performance data. Does this need to be treated as personal data?
Consider the following data for amateur/professional athletes:
Athlete name,
Athletic event + best performance data
e.g.:
Joe Bloggs
5k 19:00
10k 40:00
Half Marathon 85:00
other events etc...
and ...
- 133
4
votes
1
answer
101
views
Would revealing/storing whether or not an EU customer uses a service violate the GDPR?
Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone ...
- 1,714
0
votes
2
answers
75
views
Is a step by step route considered as personal data?
I would like to know whether a route between two physical places A and B, with its different step by step streets, can be considered as a personal data and should be processed as it. We don't know ...
- 3
1
vote
1
answer
118
views
Can my employer gather personal data without written consent
I'm located in the EU.
My employer recently became a contractor for an american company. We deal with software.
A requirement of the american company was that on all machine of the people working ...
- 11
6
votes
1
answer
130
views
Company makes confidential CV publicly available and searchable. Legal recourse?
A friend of mine was looking for a job last August. She sent CVs for various positions.
Now, months later, somebody told her that if he Googles her name, her CV pops up. She tried it herself and sure ...
- 163
4
votes
1
answer
133
views
Does possesing BUT NOT processing a personal data make the organization their controller?
According to Article 4(7) of GDPR:
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of ...
0
votes
0
answers
34
views
Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer
Does right to Data Access request /GDPR supersede restrictions in Employment contract of previous employer ?
Is above fundamental right's affected by
Clauses in temporary employment contract like '...
- 37
1
vote
0
answers
31
views
Liability for data when reselling used data storage (US)
If I purchase used storage media from a company, what is my liability for the data that it may contain?
As a standard practice, all such media would be wiped. However, secure data destruction is not ...
- 111
3
votes
1
answer
146
views
Does GDPR apply to location data collected by apps?
I've just been reading this article in the New York Times which expounds on the business practices of mobile apps which collect your location data and use it/sell it.
The article gives examples of ...
- 333
2
votes
1
answer
539
views
Is it theft/fraud if one sends confidential info from their work laptop to their own personal web mail but there is no malicious intent? (UK/US)
Sender's intentions are non malicious, but the sender knows they are not supposed to send confidential info out of work laptop, and sender deleted some sent emails to cover up. Their intent is to do ...
- 131
-1
votes
1
answer
35
views
US/International Law regarding collection of diagnostic data from iPhone app [closed]
I am designing an iPhone ultrasound transceiver.
In order to improve the algorithm I wish to send an occasional ~2-3s chunk of audio containing the signal to my server.
As such, this would clearly ...
- 123
0
votes
1
answer
390
views
How can GDPR affect user generated content?
I'm wondering where the lines of GDPR are in regard to user generated content and how it meets the Communications Decency Act.
Section 230 has been what ISPs and websites (Yelp as an example) use as ...
- 121
1
vote
2
answers
129
views
Deliberately inaccurate data
The GDPR seem to assume that the client would want us to maintain accurate data. Article 5(1)(d) makes it clear we have to correct inaccurate data.
But I deliver pizzas for a big chain, and I ...
- 111
0
votes
1
answer
291
views
Hetzner is trying to charge me for Bandwidth overuse and will not respond when I use the contact form
A few months ago, I was using Hetzner Cloud for my VPS, and they blocked a server because someone seems to have DDoSed it. I requested it to be unblocked, and they ignored me. I also noticed they are ...
user21049
4
votes
1
answer
324
views
GDPR and Storing Non-EU Citizen Data as an EU-based company
I work for an EU company based in the UK and often work with clients in China and Africa (and some other non-EU countries). In the future, it may arise that we will be storing some personal ...
- 143
1
vote
2
answers
63
views
Is it legal to require registration to obtain US Government software or data?
Is it legal to require registration to obtain US Government software or data?
For example, if a government web site makes you put in an email address before you can access public data or public ...
- 111
1
vote
1
answer
183
views
Is it reasonable to ask me to change my email address after it was leaked?
My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later ...
- 202
-1
votes
1
answer
94
views
Can a good lawyer mitigate a failure to prevent data breaches?
I was curious how important it is for a software startup to seek legal council during the fundraising/growth stages. Basically, I don't want to be up a creek if we have some data breach or hack. How ...
0
votes
1
answer
70
views
Is it legal to list parties not willing to take part in a survey?
I am building a website where hospitals, schools and hotels would be rated by referring to several factors. I need to collect the data (certificates, documents, etc...) from the hospitals/schools/...
- 103