48 votes
Accepted

Does a private citizen in the US have the right to make a "Contact the Police" poster?

There is no law against a person creating and distributing such a poster, to the best of my knowledge. However such a poster pretty clearly implies that the person shown is guilty of a crime, or at ...
40 votes

How can the UK government fine itself?

Expanding on @Rick's answer, the UK government does not hold all of its money in an undifferentiated general fund (although much of it is held that way). In non-profits and government, one generally ...
  • 166k
38 votes
Accepted

How to store refusal of cookie consent

The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for ...
  • 8,693
38 votes

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

If the data controller has “reasonable doubts concerning the identity of the natural person making the request”, then “the controller may request the provision of additional information necessary to ...
  • 22.1k
30 votes

Is there a way to determine if an email address is personal information?

Treat all email addresses as if they are personal data. All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address. If your ...
  • 2,421
29 votes
Accepted

ISP is not hashing the password I log in with online. Should I take any action?

The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient ...
28 votes
Accepted

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

The point of privacy laws is to set basic standards that apply to everyone, whether or not they have a privacy policy. A privacy policy that is inconsistent with privacy laws cannot be enforced. ...
  • 6,652
26 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are ...
  • 23.8k
25 votes

Does a private citizen in the US have the right to make a "Contact the Police" poster?

This is entirely legal and commonly done. The risk of defamation liability to the suspect is minimal. Under New York Times v. Sullivan 376 U.S. 254 (1964) and related cases, to prevail in defamation ...
  • 166k
22 votes

Is displaying the user first name and last name a breach of GDPR?

Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service? For your scenario a common answer ...
  • 2,421
22 votes

Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people?

Most of the question has nothing to do with the law, it's about technical how-to or how-does, which should be asked in Information Security SE. There are two possible legal questions: is it legal to ...
  • 189k
21 votes
Accepted

Are there ways of storing personal data beyond standard GDPR limitations?

The GDPR does not set fixed retention periods. Instead, it says data may not be kept for longer than necessary. What is necessary depends very much on the specific context of the processing activity, ...
  • 22.1k
17 votes

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

GDPR doesn't generally expect “agreement”, so it's not necessary to prevent access by people who don't “agree”. A privacy policy is not a contract, but an unilateral notice about how personal data ...
  • 22.1k
16 votes
Accepted

Denied Data Subject Access Request (DSAR) due to third-party information

The GDPR allows the right to access to be limited if this access would “adversely affect the rights and freedoms of others” (Art 15(4) GDPR). However, access to the recording would not give you more ...
  • 22.1k
16 votes

Is there a way to determine if an email address is personal information?

As quarague correctly points out, you cannot reliably determine whether an email address is personal data. But since nearly all email addresses are personal data, you should treat all addresses in ...
  • 22.1k
15 votes

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) ...
  • 1,146
14 votes

ISP is not hashing the password I log in with online. Should I take any action?

Well, you may be right (probably), yet then again, you may be wrong... As David Siegel mentioned, they may have encrypted the password and have authorized support personal decrypting them up-on ...
14 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

2016/679 ("GDPR") defines the responsibilities of data processors and controllers (subject to the scope of the legislation). An individual can declare whatever they like, but those processors and ...
13 votes

Does a private citizen in the US have the right to make a "Contact the Police" poster?

In the U.S. it has long been acceptable for private citizens and organizations to sponsor rewards for information leading to a criminal's apprehension. Oftentimes, in the American West, the "...
  • 20.6k
13 votes

Can I store the names of arbitrary business associates in my CRM system?

The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as ...
  • 22.1k
12 votes

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue ...
  • 2,800
12 votes

How can the UK government fine itself?

Who is doing the fining? That will be the Information Commissioner’s Office who can issue a monetary penalty for failing to comply with Part 3 of the Data Protection Act 2018.
  • 31.6k
10 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

You can't make a binding declaration If you wish, you can make a public declaration that you grant consent for any and all processing of your data. You would likely have to be more detailed than that ...
  • 2,152
9 votes
Accepted

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

It seems like some law must have been breached during the sharing of this information? No. A scrutiny of your pseudonymous account would reveal that you used it for advancing your own business ...
9 votes
Accepted

UK: What information are the police legally required to collect when going door-to-door, and why?

What are the reasons/ legal requirements that the police might need my personal information, given that I had not been able to provide any further information/ witness testimony to the incident that ...
  • 31.6k
9 votes

Is displaying the user first name and last name a breach of GDPR?

GDPR is not a blanket ban on handling personal data. It regulates how to handle personal data, what permissions or justifications are required, and what happens when permissions are withdrawn. Data ...
  • 10.5k
9 votes
Accepted

GDPR - Are technical identifiers personal data?

Question 1. Are technical identifiers personal data? Yes. If they identify a person. For example an IP Address is considered personal data, because a person or household can be identified by an IP. ...
  • 1,333
8 votes
Accepted

Company makes confidential CV publicly available and searchable. Legal recourse?

She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or ...
8 votes
Accepted

As per GDPR, how are the agree/disagree to cookie buttons to be designed?

GDPR defines consent like this in Art 4(11): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a ...
  • 22.1k

Only top scored, non community-wiki answers of a minimum length are eligible