48 votes
Accepted

Does a private citizen in the US have the right to make a "Contact the Police" poster?

There is no law against a person creating and distributing such a poster, to the best of my knowledge. However such a poster pretty clearly implies that the person shown is guilty of a crime, or at ...
user avatar
  • 97.1k
40 votes

How can the UK government fine itself?

Expanding on @Rick's answer, the UK government does not hold all of its money in an undifferentiated general fund (although much of it is held that way). In non-profits and government, one generally ...
user avatar
  • 139k
38 votes

If a request for personal data is made under the GDPR rights but the requestor refuses to give ID for verification what should the company do?

If the data controller has “reasonable doubts concerning the identity of the natural person making the request”, then “the controller may request the provision of additional information necessary to ...
user avatar
  • 18k
37 votes
Accepted

How to store refusal of cookie consent

The so-called 'cookie law' obliges you to inform the user about the site's cookies (or use of Storage or such on the user's computer) and ask for consent for those that are not "strictly necessary for ...
user avatar
  • 7,165
29 votes
Accepted

ISP is not hashing the password I log in with online. Should I take any action?

The GDPR does indeed require that the password be stored "securely". It does not specify the technology which must be used for that purpose. Hashing the PW is a common method, and should be sufficient ...
user avatar
  • 97.1k
28 votes
Accepted

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

The point of privacy laws is to set basic standards that apply to everyone, whether or not they have a privacy policy. A privacy policy that is inconsistent with privacy laws cannot be enforced. ...
user avatar
  • 3,786
26 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

You could, but how should the companies that want to handle your data know this? If they have no affirmation from you that you allow them to process your data in any way, other than those they are ...
user avatar
  • 16k
25 votes

Does a private citizen in the US have the right to make a "Contact the Police" poster?

This is entirely legal and commonly done. The risk of defamation liability to the suspect is minimal. Under New York Times v. Sullivan 376 U.S. 254 (1964) and related cases, to prevail in defamation ...
user avatar
  • 139k
21 votes
Accepted

Are there ways of storing personal data beyond standard GDPR limitations?

The GDPR does not set fixed retention periods. Instead, it says data may not be kept for longer than necessary. What is necessary depends very much on the specific context of the processing activity, ...
user avatar
  • 18k
17 votes

Can service providers like Google and Facebook deny service to users who don't accept their privacy policy?

GDPR doesn't generally expect “agreement”, so it's not necessary to prevent access by people who don't “agree”. A privacy policy is not a contract, but an unilateral notice about how personal data ...
user avatar
  • 18k
16 votes
Accepted

Denied Data Subject Access Request (DSAR) due to third-party information

The GDPR allows the right to access to be limited if this access would “adversely affect the rights and freedoms of others” (Art 15(4) GDPR). However, access to the recording would not give you more ...
user avatar
  • 18k
15 votes

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) ...
user avatar
14 votes

ISP is not hashing the password I log in with online. Should I take any action?

Well, you may be right (probably), yet then again, you may be wrong... As David Siegel mentioned, they may have encrypted the password and have authorized support personal decrypting them up-on ...
user avatar
14 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

2016/679 ("GDPR") defines the responsibilities of data processors and controllers (subject to the scope of the legislation). An individual can declare whatever they like, but those processors and ...
user avatar
13 votes

Does a private citizen in the US have the right to make a "Contact the Police" poster?

In the U.S. it has long been acceptable for private citizens and organizations to sponsor rewards for information leading to a criminal's apprehension. Oftentimes, in the American West, the "...
user avatar
  • 17k
13 votes

Can I store the names of arbitrary business associates in my CRM system?

The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as ...
user avatar
  • 18k
12 votes

How can the UK government fine itself?

Who is doing the fining? That will be the Information Commissioner’s Office who can issue a monetary penalty for failing to comply with Part 3 of the Data Protection Act 2018.
user avatar
  • 23k
11 votes

Facebook vs GDPR - Private Messages I sent to others will never be deleted/erased from Facebook servers

Art. 17 GDPR Right to erasure (‘right to be forgotten’) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue ...
user avatar
  • 2,730
10 votes

Under GDPR, can I give permission once to allow everyone to store and process my data?

You can't make a binding declaration If you wish, you can make a public declaration that you grant consent for any and all processing of your data. You would likely have to be more detailed than that ...
user avatar
  • 2,120
9 votes
Accepted

Does revealing the owner of an anonymous forum account breach GDPR (or other) laws?

It seems like some law must have been breached during the sharing of this information? No. A scrutiny of your pseudonymous account would reveal that you used it for advancing your own business ...
user avatar
9 votes

Does a private citizen in the US have the right to make a "Contact the Police" poster?

Though not in the USA, something very similar happened in Ireland in 2014. A homeowner was burgled while absent, but his CCTV system caught clear images of the intruders. He supplied this data to the ...
user avatar
9 votes
Accepted

UK: What information are the police legally required to collect when going door-to-door, and why?

What are the reasons/ legal requirements that the police might need my personal information, given that I had not been able to provide any further information/ witness testimony to the incident that ...
user avatar
  • 23k
8 votes
Accepted

Company makes confidential CV publicly available and searchable. Legal recourse?

She could refer this to the Cyrpriot Commissioner for Personal Data Protection, but I would try contacting the company first and telling them to remove her Personal Data from the public website - or ...
user avatar
8 votes
Accepted

As per GDPR, how are the agree/disagree to cookie buttons to be designed?

GDPR defines consent like this in Art 4(11): ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a ...
user avatar
  • 18k
8 votes

Under GDPR's strict consent requirement rules, could a criminal/hacker/troll remain anonymous in all his activities?

It is absolutely not the case that Providers are not allowed to keep PII without consent. Article 6 of the GDPR identifies six possible lawful bases for processing personal information. These are: (...
user avatar
  • 97.1k
7 votes

Is hash of a username still personal data?

The Art. 29 WP has released Opinion 05/2014 on Anonymisation Techniques. There it defines a hash function like this: Hash function: this corresponds to a function which returns a fixed size output ...
user avatar
  • 2,730
7 votes

Can a one-time-pad provide legal immunity - (make data inadmissible) -?

If it was for a criminal case, the jury would have to decide if they believed the person who claimed he/she cracked the code. Really, any evidence is interpreted by the jury if it is regarding facts....
user avatar
  • 3,870
7 votes
Accepted

Can a company charge you to update your address under GDPR?

Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have ...
user avatar
  • 18k
6 votes

GDPR - Right to erasure - Conflicting laws

Great question - I work for a London based company who use a large amount of location data. The process for deletion of data is not as simple as it first sounds. We recently had a deep dive with our ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible