Hot answers tagged

7

This could be covered by point 1(c) of Article 6: Processing shall be lawful only if and to the extent that at least one of the following applies: ... (c) processing is necessary for compliance with a legal obligation to which the controller is subject; ... It might also fall under point 1(f): ... (f) processing is necessary ...


6

“From your perspective you should not worry about asking permission to use reCaptcha as it is not you who is processing the data it is google and any GDPR compliance falls on them.“ This is plain wrong. If a user visits your website you are the controller of data collected on your website. Regardless of what entity collects that data. However in my non-...


6

Based on the advice from @user6726, here's how I disputed the charge. First, I called FedEx customer service. They declined to waive the fee, and informed me that if I didn't pay, it would go to collections. So, I waited a few months and let the collection agency send me their version of the bill. Then, I sent the following reply (paraphrased) to the ...


5

The specifics probably depends on your province, but there are laws in Canada similar to those in the US whereby a person receiving unsolicited goods and services to pay or return the goods. For example, the Ontario Consumer Protection Act, 2002 §13 says (1) Except as provided in this section, a recipient of unsolicited goods or services has no legal ...


5

My interpretation of the GDPR when it comes to a contact form is as long as your privacy notice states that what data you collect in the contact form and what legal basis that data is used for you are fine. Someone submitting a contact form in my opinion is their consent to reply back to them regarding the data in which they have submitted. Another good ...


4

The only age of consent in England and Wales is 16. The relevant provision is Section 9 of the Sexual Offences Act 2003. 9 Sexual activity with a child (1) A person aged 18 or over (A) commits an offence if— (a) he intentionally touches another person (B), (b) the touching is sexual, and (c) either— (i) B is under 16 and A does ...


4

I believe in this case, your company (OrgX) is a data processor and your customer's organization (OrgY) is the data controller. OrgY is responsible for establishing a lawful basis for sending you (OrgX) the personal data for their employees. Note that consent is just one of six lawful bases outlined in article 6(1). I'm no expert, but I believe OrgY's admin ...


4

Yes, since you default to no consent, ergo consent would have to be positive. It's rather unsatisfactory though as a sort of double-negative, and needs careful wording to make sure consent is informed. However, this may be a technical problem as it seems odd that you can't have an unchecked checkbox. Does the word 'checked' perhaps appear in the HTML? https:...


3

Am I correct in arguing that the LHD never really had implied consent to begin with? In other words, does the failure to honour the express refusal inform us about the legitimacy of prior claims of implied consent? No. They had implied consent and had not intent at the outset to dishonor it. They have violated the patient's privacy right when ...


3

Massachusetts is a 'two-party' state. So you'd have to have consent from them to record. You could probably travel to a 'one-party' state such as one of the states listed here and call them while recording. In a one-party state, only one of the parties to the conversation needs to know about the recording. In those states you don't even need to inform them. ...


3

Breathalyzer tests are distinct from blood tests because the former does not "implicat[e] significant privacy concerns" (see Birchfeld v. ND). A cell phone is like a blood test, because it implicates significant privacy concerns, especially the level of electro-snooping that would be required to determine if someone had recently committed a phone-use ...


3

The ePrivacy directive (Article 5(3)) requires prior informed consent for storage (or access) of information stored on a user's terminal equipment. In other words - you must ask users if they agree to most cookies and similar technologies before the site starts to use them. That is not always technically possible or creates catastrophic UX, so take a ...


3

He has to follow the law of the country he is in and those of which he is a citizen. A citizen is subject to their country's jurisdiction wherever they are, however, some laws are only enforced within a nation's boundaries and some have extra-territorial application. 18 U.S. Code § 2423 - Transportation of minors covers the US law (I don't speak Hungarian ...


3

You didn't consent to being ripped off. You did however fail to grasp the terms under which you were permitted to park on their property, and you failed to pursue an alternative (such as looking for change; using a credit card). It is possible that you should have known that this was a no-change-given machine, since one can often see that there is no ...


3

"1) Can I use an pre checked tick box under GDPR?" Nope. "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." (Recital 32) "2) Since GDPR also requires the data collector to ensure that the user is not under the age of 13 so I am planning to ask the users age only for that region i.e. EU Region. Now will simply mentioning ...


3

Doing this is OK according to the GDPR and other European laws. The relevant bit is GDPRs rules for Lawfulness of processing, and in particular Article 6 (1)b, which says that it is legal to do this if processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject ...


3

Just below the section you quoted it says: (3) The victim’s prior sexual conduct is not a relevant issue in a prosecution under this section. There is no stated provision for the case you mention. I suspect that the law would apply. Whether the authorities would choose to prosecute in such a case is a very different question. There might be caselaw of ...


3

Assuming that the owner of the hard drive (irrespective of if that owner is a government or private person) is legally entitled to take possession of the hard drive then they can do so subject to the fact that they generally cannot commit a crime to do so (e.g. trespass or damage to property). If the person in possession of the hard drive refuses to hand it ...


3

I gather that the numerous ramifications you outline are merely contexts and that your main concern is about the application of contract law (contract law in the U.S. does not really vary among states). Thus, I will not really delve in the intricacies of --for instance-- privacy or copyright issues arising from the commercial use of a person's likeness that ...


3

Did you consent because you could have seen a poster? Broadly speaking, yes - but its unlikely that what you consented to was a contract. Conditions of Entry The posters that you describe are more likely to be conditions of entry rather than terms of a contract. The controller of premises is entitled to restrict access to that premises and impose ...


3

Do I need to inform the user about storing the score locally? No, there is no need as long as you don't transmit, store or process any personal info. It's doubtful that the score could be considered personal info, but you're not sending it to your servers in any way, so you don't seem to be processing it anyway. Do I need consent for using non-personal ...


2

There are two main concerns: copyright restrictions on distributing stuff that other people made, and publicity rights to use other people's picture and voice to promote a product. Both restrictions reduce to the fact that you need the rights-holder's permission to use the material. It is not required that the permission be written on paper or that it be ...


2

In general, police have no special protection from being recorded; if it is legal to video or audio record a person in that jurisdiction then it is legal to record a police officer in that jurisdiction. Anything that it is legal to do with the recording of a person is legal even if that person is a police officer. As to if it is legal to record a person see:...


2

Assuming that age is not a factor in the crime in the case, two offences come to mind: Sexual Assault (section 271 of the Criminal Code) Aggravated Sexual Assault (section 273 of the Criminal Code) The primary question that you put forward is the question of consent. This is defined in section 273.1 of the Criminal Code: Meaning of “consent” 273.1 (...


2

Implied consent does NOT rest upon the acquiring of a license. (Otherwise, someone who never had a license would be immune.) Rather, it is triggered by driving in the state. According to the Supreme Court case Birchfield v. North Dakota, criminal penalties for refusing breath tests (but not blood tests) are OK. However, one of the considerations is that ...


2

An issue highlighted with your question is whether the regulations target technical implementation of a web presence or target the user view of an organization's web presence. From a technical perspective, a web address is nothing more than an addressing scheme. www.example.com, www2.example.com and example.com could all serve the same content from the same ...


2

IANAL, but I"m assuming by "consent" you mean you feel you need to have users click through an agreement to acknowledge and clearly accept the fact that the site is sending their IP information to Google? I'd say it's your choice to use a click through advisory for the data collection by Google. But at a minimum in your situation, I'd say it's a very good ...


2

Age of consent to sex or marriage is governed by the law of the place where sexual contact or marriage, respectively, takes place. In the event that sexual conduct literally takes place on a boundary line (e.g. directly above the Four Corners Monument in Colorado-New Mexico-Utah-Arizona), each state has authority to apply its laws using its definitions to ...


2

Are you looking from Google's perspective or your perspective? From your perspective you should not worry about asking permission to use reCaptcha as it is not you who is processing the data it is google and any GDPR compliance falls on them. From their perspective, it should not be a concern, GDPR is worried about Personally Identifiable Information and ...


2

GDPR concerns itself with the processing, storage, and transmission of personal data. Sending a single email to a single person counts as processing data. To process the personal data you have to have a lawful basis to have/process that data. There are rules about processing the data of data subjects (GDPR) and there are rules about communication/marketing ...


Only top voted, non community-wiki answers of a minimum length are eligible