48

There is no law against a person creating and distributing such a poster, to the best of my knowledge. However such a poster pretty clearly implies that the person shown is guilty of a crime, or at least strongly suspected. If the store somehow made an error, pulling the image of a person who did not use the stolen card or there is some other error, the ...


36

The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for the provision of an information society service requested by the subscriber or user". It does not require you to seek consent for the use of any cookie no ...


29

The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient if properly implemented (strong hash function, use of salt, etc). But other methods of securing the password might be sufficient. Encrypting the PW rather ...


28

The point of privacy laws is to set basic standards that apply to everyone, whether or not they have a privacy policy. A privacy policy that is inconsistent with privacy laws cannot be enforced. Breaches of privacy law can be punished even if the conduct is permitted by a privacy policy. Article 7 of the GDPR illustrates this by making special provision for ...


26

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are already allowed to because of the exceptions, they have to - under GDPR - assume you don't want them to process your data, and thus have to ask you.


25

This is entirely legal and commonly done. The risk of defamation liability to the suspect is minimal. Under New York Times v. Sullivan 376 U.S. 254 (1964) and related cases, to prevail in defamation case with a media defendant, a public figure plaintiff, or a matter of public concern, the plaintiff must show "actual malice." In Rosenbloom v. ...


21

The GDPR does not set fixed retention periods. Instead, it says data may not be kept for longer than necessary. What is necessary depends very much on the specific context of the processing activity, in particular on the purpose of processing. The GDPR allows retention for as long as necessary. For example, businesses (including financial institutions) are ...


17

GDPR doesn't generally expect “agreement”, so it's not necessary to prevent access by people who don't “agree”. A privacy policy is not a contract, but an unilateral notice about how personal data will be processed. This processing is either legal, or it is not. The GDPR contains various conditions and parameters that determine what is legal. In particular, ...


16

The GDPR allows the right to access to be limited if this access would “adversely affect the rights and freedoms of others” (Art 15(4) GDPR). However, access to the recording would not give you more information than you've already received during the phone call, so this exemption is quite unlikely to apply in any case. UK data protection law also has a large ...


15

It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for ...


14

Well, you may be right (probably), yet then again, you may be wrong... As David Siegel mentioned, they may have encrypted the password and have authorized support personal decrypting them up-on support calls for authentication purposes... What you can do is to submit a Data Subject Access Request focused on your Password and HOW they handle it in a secure ...


14

2016/679 ("GDPR") defines the responsibilities of data processors and controllers (subject to the scope of the legislation). An individual can declare whatever they like, but those processors and controllers will still be bound by the legislation. In many cases consent will be irrelevant - it's only one of the lawful bases for processing : (a) ...


13

In the U.S. it has long been acceptable for private citizens and organizations to sponsor rewards for information leading to a criminal's apprehension. Oftentimes, in the American West, the "Wanted" posters that offered rewards were funded by citizens and victims own pockets since law enforcement bodies at the time were very underfunded (no "...


12

In short, no. Article 20 of the GDPR covers the “Right to data portability”, which essentially says two main things: The data subject had the right to an exported copy of their personal data in a common format And The data subject has the right to have this data transmitted directly from one controller to another where technically feasible. Neither of ...


10

Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: Assuming ...


10

You can't make a binding declaration If you wish, you can make a public declaration that you grant consent for any and all processing of your data. You would likely have to be more detailed than that (consent needs to be informed and specific) - you'd likely have to exhaustively specify that yes, you know that this includes also this and that specific ...


9

It seems like some law must have been breached during the sharing of this information? No. A scrutiny of your pseudonymous account would reveal that you used it for advancing your own business interests. That use forfeits the protections for which the GDPR was intended. The Terms of Use very likely contain a provision to the effect of disclosing account ...


9

Though not in the USA, something very similar happened in Ireland in 2014. A homeowner was burgled while absent, but his CCTV system caught clear images of the intruders. He supplied this data to the police, who were pleased to have it. However, he also posted the videos on Youtube. He was subsequently ordered to take them down again because he was violating ...


9

What are the reasons/ legal requirements that the police might need my personal information, given that I had not been able to provide any further information/ witness testimony to the incident that they were investigating? The police in england-and-wales have a duty to undertake reasonable lines of enquiry and to carry out a proportionate investigation in ...


8

She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or delete it completely. If they don't give a satisfactory response, mention the CPDP. This could lead to the data being removed within a few days, while an ...


8

GDPR defines consent like this in Art 4(11): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; Further conditions on consent are ...


7

The Art. 29 WP has released Opinion 05/2014 on Anonymisation Techniques. There it defines a hash function like this: Hash function: this corresponds to a function which returns a fixed size output from an input of any size (the input may be a single attribute or a set of attributes) and cannot be reversed; this means that the reversal risk seen with ...


7

If it was for a criminal case, the jury would have to decide if they believed the person who claimed he/she cracked the code. Really, any evidence is interpreted by the jury if it is regarding facts. 1) An issue of fact, not law. A question of fact is resolved by a trier of fact, i.e. a jury or, at a bench trial, a judge, weighing the strength of ...


7

Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes ...


7

It is absolutely not the case that Providers are not allowed to keep PII without consent. Article 6 of the GDPR identifies six possible lawful bases for processing personal information. These are: (a) the data subject has given consent ... (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take ...


6

Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our legal team and as a result actually created a product to process deletions. Personal data from users/customer is carried for lots of reasons, not just marketing....


6

How to store consent According to the ICO, you need to store the following: Who consented the name of the individual, or other identifier (eg, online user name, session ID). When they consented a copy of a dated document, or online records that include a timestamp; or, for oral consent, a note of the time and date which was made at the time of the ...


6

It depends on whether you can identify the person to whom a username hash belongs. If you store both username and its hash in the same database row then yes. If it is impracticable for you to identify the person by their hash only, then no. This comes from the definition of personal data — "any information relating to an identified or identifiable natural ...


6

In principle, the data subject's right to access involves a copy of all personal data the controller holds on them. There are no time limits by default. Of course, the controller can ask a data subject to clarify their request, e.g. to focus on a particular time frame. There is an implied time limit though: personal data may only be processed/stored for as ...


6

The retention periods depend on the exact legal basis for keeping such records. For example, accounting records might reasonably involve at least your bank account number, sort code, full name, and address. Under Section 388 of the Companies Act 2006, accounting records must be kept for three to six years, depending on the type of company (private or public)....


Only top voted, non community-wiki answers of a minimum length are eligible