Skip to main content
30 votes

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the ...
Dale M's user avatar
  • 213k
14 votes
Accepted

Are push tokens considered PII under the GDPR or the CCPA?

Yes, but it doesn't matter. This answer discusses gdpr implications. Personal data is any information that relates to an identifiable person. The GDPR has an extremely broad concept of identifiability,...
amon's user avatar
  • 24k
14 votes

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

The first question is, is the school required to obtain your consent. The answer is highly jurisdiction-dependent. California is very protective of the individual's personality right and there are ...
user6726's user avatar
  • 215k
11 votes
Accepted

If website uses cookies only after users login, can I ask for cookie consent during account creation instead of website launch?

Under European rules (GDPR, ePrivacy), you only need consent here if you both access or store information on the user's device (such as cookies), and this access/storage is not strictly necessary for ...
amon's user avatar
  • 24k
10 votes

Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?

For the same reason that states require doctors to be licensed Surely, if I want an unqualified, unlicensed surgeon (or a person that says they’re a surgeon) to crack open my cranium and poke my brain,...
Dale M's user avatar
  • 213k
8 votes

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

Depending on jurisdiction, the right to any picture of you may be yours. Some countries allow taking and publishing pictures of you, as long as you are in public or on the picture taker's private ...
nvoigt's user avatar
  • 8,133
7 votes
Accepted

In the United States is doing business in only some states considered discrimination?

I have a really good pizza place near my home but the bastards won't deliver when I go interstate! Now, that's discrimination! Yes, it's discrimination. However, it's not unlawful discrimination. ...
Dale M's user avatar
  • 213k
7 votes

What is the most comparable American law to GDPR right to subject access? Privacy Act?

HIPAA seems comparable but only applies to medical data, but is there anything more general than that? Not really, at least at the national level. There is no comprehensive national regulation of ...
ohwilleke's user avatar
  • 220k
7 votes

Are push tokens considered PII under the GDPR or the CCPA?

it only identifies a device and not a human being It identifies a device that is associated with an identifiable person. As an IP address is personal data under the GDPR, it's hard to see how a push ...
phoog's user avatar
  • 37.8k
6 votes

Why is the onus for adhering to privacy directives (e.g. GDPR, CCPA, etc.) on a host and not the user?

Most of your arguments since you discovered this issue seem to be very self-serving. If IT security is too complex for small businesses, how do you figure individuals can reasonably assess it from the ...
Relaxed's user avatar
  • 764
5 votes
Accepted

What can I do if my CCPA request is being ignored?

Overview of the CCPA The CCPA constitutes California Civil Code TITLE 1.81.5. California Consumer Privacy Act of 2018 (sections 1798.100 - 1798.199.100) (Note: the online version gives both original ...
David Siegel's user avatar
5 votes

Do schools have permission to use pictures containing my face taken inside school forever if I agreed to it?

They declined, citing the document that everyone signs. Ask to see their copy of the release that you signed. Since this was some number of years ago, I'd wager that they don't actually have it. If ...
bta's user avatar
  • 1,334
3 votes
Accepted

Do users who are given another user's email address have obligations under GDPR?

If I get this consent, have I fully complied with the GDPR rules in the scenario I've described? You have covered one potential basis for acquiring the details, but I would argue "legitimate ...
Matthew's user avatar
  • 3,772
3 votes
Accepted

Is it legal for a business to store and use my payment information in a way that I can't edit, remove, or otherwise control?

A company may retain information to comply with legal obligations, exercise legal claims or rights, or defend legal claims. Maintaining the ability to charge and refund on a credit card is within the ...
user6726's user avatar
  • 215k
3 votes
Accepted

What is the meaning of mail in the CCPA (California Consumer Privacy Act of 2018)?

You're misreading the law. You need to keep reading the section you referenced (emphasis added): The disclosure...shall be made in writing and delivered through the consumer’s account with the ...
Ryan M's user avatar
  • 10.3k
2 votes
Accepted

Comcast Xfinity CCPA Policy

Update: I've filed a complaint with the CA Attorney General. They automatically forwarded the complaint to Comcast and sent me a notice in the mail. If you have filed a complaint against a business, ...
user50232's user avatar
2 votes
Accepted

Privacy Policy change for different Countries / Continents on Website

You must comply with the law everywhere you operate So, yes. You must comply with American law (all 50 states pluses Federal), Samoan law, Thai law, Kenyan law, etc. to the extent that it applies to ...
Dale M's user avatar
  • 213k
2 votes
Accepted

Definition of a Household or Device in the context of the California Consumer Privacy Act (CCPA)

There are also regulations to go with the bill passed by the legislature. The proposed regulations are open for comment until Dec. 6 2019. In the regulations, "Household" is given a definition (§999....
user6726's user avatar
  • 215k
2 votes
Accepted

Cookie consent compliance: disabling JavaScript and keyboard accessibility

This is unlikely to pose a problem: most consent-requiring stuff happens only per JS, and consent must be opt-in anyway. However, accessibility concerns might be legitimate. Cookies are usually set ...
amon's user avatar
  • 24k
2 votes

Advertising in mobile apps and proof of consent

here is what the law says about the mobile apps alternative to homepage 1798.140.p (p) “Homepage” means the introductory page of an internet website and any internet web page where personal ...
kirill_igum's user avatar
2 votes

Site user posts data under licnese, can user demand erasure?

Rewind and reset please: What is your valid legal basis for collecting the personal data? Let's look at this site as an example. There is personal information (PI) in this answer. The words that I ...
Dale M's user avatar
  • 213k
2 votes
Accepted

CCPA do I need to provide a "Do not sell my info" link if I don't sell people's information?

No CA code Section 1798.120 (part of the CCPA) provides that: (a) A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third ...
David Siegel's user avatar
2 votes
Accepted

What is the relationship between free speech and data privacy?

-CCPA section 1798.105 provides in paragraph (d) (4) that: (d) A business or a service provider shall not be required to comply with a consumer’s request to delete the consumer’s personal information ...
David Siegel's user avatar
2 votes
Accepted

When Company A's headquarters is in California, and is CCPA compliant, can a CA user demand deletion of all personal info?

The user can always request that their personal information be deleted. The business generally has an obligation to delete the data but there are a lot of exceptions to that general rule. The ...
Justin Cave's user avatar
  • 3,067
2 votes
Accepted

Is a name of person in an blog interview personal identifiable information that requires author disclosure in privacy policy?

An interviewee's name falls under right-of-publicity If you have a right to publicity or not depends heavily on the jurisdiction. Typically, an Interview is covered by those rights, and not by gdpr. ...
Trish's user avatar
  • 40.4k
2 votes

Would it violate the GDPR for a web application to reveal PII without requiring authentication?

Obviously you should listen to your company lawyers, "but people on the internet said so" is never a good defense legally. I also have no idea what kind of data a "proposal" ...
nvoigt's user avatar
  • 8,133
1 vote

Google CCPA Request

Yes, But ... Under Section 1798.105 a covered business must honor erasure requests unless an exception applies. Under 1798.130 a business must provide an email address for this purpose if it operates ...
David Siegel's user avatar
1 vote
Accepted

Does CCPA require deletion of personal information when it's never sold?

Yes, the right to know and the right to delete applies also when the data is not sold, assuming that no exception applies. Indeed, the CCPA's right to opt out via the Do Not Sell My Personal ...
amon's user avatar
  • 24k
1 vote
Accepted

Privacy Policy and CCPA - selling of personal information

CCPA section 1798.140(t) provides that: (t) (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise ...
David Siegel's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible