Skip to main content
49 votes
Accepted

Does a private citizen in the US have the right to make a "Contact the Police" poster?

There is no law against a person creating and distributing such a poster, to the best of my knowledge. However such a poster pretty clearly implies that the person shown is guilty of a crime, or at ...
David Siegel's user avatar
40 votes

How can the UK government fine itself?

Expanding on @Rick's answer, the UK government does not hold all of its money in an undifferentiated general fund (although much of it is held that way). In non-profits and government, one generally ...
ohwilleke's user avatar
  • 224k
38 votes

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

If the data controller has “reasonable doubts concerning the identity of the natural person making the request”, then “the controller may request the provision of additional information necessary to ...
amon's user avatar
  • 24k
37 votes
Accepted

How to store refusal of cookie consent

The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for ...
Lag's user avatar
  • 17.7k
30 votes
Accepted

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

The point of privacy laws is to set basic standards that apply to everyone, whether or not they have a privacy policy. A privacy policy that is inconsistent with privacy laws cannot be enforced. ...
sjy's user avatar
  • 9,306
30 votes

Is there a way to determine if an email address is personal information?

Treat all email addresses as if they are personal data. All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address. If your ...
quarague's user avatar
  • 3,570
29 votes
Accepted

ISP is not hashing the password I log in with online. Should I take any action?

The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient ...
David Siegel's user avatar
26 votes

Does a private citizen in the US have the right to make a "Contact the Police" poster?

This is entirely legal and commonly done. The risk of defamation liability to the suspect is minimal. Under New York Times v. Sullivan 376 U.S. 254 (1964) and related cases, to prevail in defamation ...
ohwilleke's user avatar
  • 224k
25 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are ...
Trish's user avatar
  • 41.5k
23 votes

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

"Article 5.3" here means the following from the ePrivacy Directive, 2002/58/EC, as amended amended by Directive 2009/136/EC. Member States shall ensure that the use of electronic ...
alexg's user avatar
  • 7,220
22 votes

Is displaying the user first name and last name a breach of GDPR?

Names clearly are personal data and so a good question to ask for GDPR compliance is: Do you need to do what you want to do in order to offer your product or service? For your scenario a common answer ...
quarague's user avatar
  • 3,570
22 votes

Is it illegal to download passwords in bulk from the dark web to make a password checking tool to help people?

Most of the question has nothing to do with the law, it's about technical how-to or how-does, which should be asked in Information Security SE. There are two possible legal questions: is it legal to ...
user6726's user avatar
  • 215k
21 votes
Accepted

Are there ways of storing personal data beyond standard GDPR limitations?

The GDPR does not set fixed retention periods. Instead, it says data may not be kept for longer than necessary. What is necessary depends very much on the specific context of the processing activity, ...
amon's user avatar
  • 24k
19 votes
Accepted

Can a non-profit organization record attendance by name without permission?

The scope of the GDPR is entered when personal data is being processed in a structured manner. Personal data is any information relating to identifiable data subjects (definition in Art 4(1)). "...
amon's user avatar
  • 24k
18 votes

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

GDPR doesn't generally expect “agreement”, so it's not necessary to prevent access by people who don't “agree”. A privacy policy is not a contract, but a unilateral notice about how personal data will ...
amon's user avatar
  • 24k
18 votes

Is there any merit in the argument "this data processing is required for my business model so it is strictly necessary in terms of data protection"?

No. when storing/accessing is strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service (Sometimes known as ...
Lag's user avatar
  • 17.7k
16 votes
Accepted

Denied Data Subject Access Request (DSAR) due to third-party information

The GDPR allows the right to access to be limited if this access would “adversely affect the rights and freedoms of others” (Art 15(4) GDPR). However, access to the recording would not give you more ...
amon's user avatar
  • 24k
15 votes

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) ...
Andrew Leach's user avatar
  • 1,494
15 votes

Is there a way to determine if an email address is personal information?

As quarague correctly points out, you cannot reliably determine whether an email address is personal data. But since nearly all email addresses are personal data, you should treat all addresses in ...
amon's user avatar
  • 24k
15 votes

How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?

You seem to have a solid understanding of the ePrivacy implications, but lack a fundamental insight: your organization does not have a right to achieve its mission or a right to disseminate unwanted ...
amon's user avatar
  • 24k
14 votes

ISP is not hashing the password I log in with online. Should I take any action?

Well, you may be right (probably), yet then again, you may be wrong... As David Siegel mentioned, they may have encrypted the password and have authorized support personal decrypting them up-on ...
Rui Freitas Serrano's user avatar
14 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

2016/679 ("GDPR") defines the responsibilities of data processors and controllers (subject to the scope of the legislation). An individual can declare whatever they like, but those processors and ...
ItWasLikeThatWhenIGotHere's user avatar
13 votes

Does a private citizen in the US have the right to make a "Contact the Police" poster?

In the U.S. it has long been acceptable for private citizens and organizations to sponsor rewards for information leading to a criminal's apprehension. Oftentimes, in the American West, the "...
hszmv's user avatar
  • 23k
13 votes

Can I store the names of arbitrary business associates in my CRM system?

The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as ...
amon's user avatar
  • 24k
12 votes

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue ...
wimh's user avatar
  • 2,865
12 votes

Standards for data availability for internal employees

Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, ...
Dale M's user avatar
  • 215k
11 votes

Is it legal for a business to deny me access to their store on the basis of how I look?

You are mistaken: they deny you on your act When you use Tor, your browser is not sending a lot of information. That makes Tor browsers hilariously easy to detect: nobody knows where the real browser ...
Trish's user avatar
  • 41.5k
10 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

You can't make a binding declaration If you wish, you can make a public declaration that you grant consent for any and all processing of your data. You would likely have to be more detailed than that ...
Peteris's user avatar
  • 2,199

Only top scored, non community-wiki answers of a minimum length are eligible