26 votes
Accepted

Does the German GDPR require storing the data in a German datacenter for a tele-health company?

The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in ...
user avatar
  • 17.1k
13 votes
Accepted

Is it okay to store user locations?

It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if ...
user avatar
  • 89.2k
6 votes
Accepted

Does any host provider currently comply with GDPR?

Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time. Microsoft was one of the first (if not the ...
user avatar
  • 549
6 votes
Accepted

My child's name is "Robert'); drop table *;--" Is he in trouble?

Your kid is not in trouble; he's a minor. You're in trouble. A criminal case for the charges a prosecutor would bring, i.e. destruction of property (the data) or for a relevant cyber or computer ...
user avatar
  • 17.5k
5 votes
Accepted

Is one liable if illegal material is found on one's own server?

So far as I am aware, all jurisdictions provide some kind of defence to the offence of possessing child pornography (or, for that matter, other illegal items like drugs and weapons) for legal purposes....
user avatar
  • 3,396
5 votes
Accepted

Deletion of personal data

Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “...
user avatar
  • 375
5 votes
Accepted

The Data ownership for an automated server running for years prior to GDPR Regulations

There are a number of misconceptions in this question. Firstly, the regulatory environment did not drastically change when the GDPR came into force in 2018. Previously, each EU member state had its ...
user avatar
  • 17.1k
4 votes

Legal jurisdiction over cloud storage

The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, ...
user avatar
  • 147k
4 votes
Accepted

Legality of data "chunking" concerning child pornography

18 U.S. Code § 2252 defines a crime and punishment for knowingly transporting, or reproducing for distribution by any means, visual depictions involving the use of a minor engaging in sexually ...
user avatar
  • 3,864
4 votes
Accepted

What is the legal status of data (intentionally deleted or not) on a second-hand computer?

Data, as it happens in law, can also be owned. That's why we have a discipline called "Intellectual Property". It is a "thing" - like other properties like cars, houses etc., someone owns it. Now, ...
user avatar
  • 1,663
3 votes

GDPR and local data storage in mobile app

No. As long as you don't see and have no means to access this data, but it is under the control of the user at all times, you are neither the controller or the processor of this personal data, and the ...
user avatar
  • 3,022
3 votes

For HIPAA, Does US Patient Data Have To Stay On US Servers?

No. This is governed by the HIPAA Security Rule which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt. The Rule does require someone covered by ...
user avatar
  • 129k
3 votes
Accepted

Storing pirated data online who is responsible?

If you have no knowledge and can't possibly have knowledge because the data is totally private, you should fall into the safe harbor protection of 17 U.S. Code § 512 - Limitations on liability ...
user avatar
  • 8,272
3 votes
Accepted

Does the European Union allow to store medical (sensitive) data in cloud platforms such as Amazon Web Services or Google Cloud?

Storing medical data in cloud services can be legal, but isn't necessarily so (as with any other kinds of data). The GDPR considers health-related data as “special categories” of data per Art 9. ...
user avatar
  • 17.1k
3 votes
Accepted

Can cloud services providers be asked to turn over data from foreign countries?

Generally speaking a business can be subpoenaed to provide any records, electronic or otherwise, by any court with jurisdiction over that business. Most subpoenas are issued in the context of pending ...
user avatar
  • 129k
3 votes
Accepted

Is requesting a customer database for testing purposes legal?

It's not illegal to ask. Whether they can give it to you, and under what circumstances, is another, much more complicated matter. For instance, if the database contains health information covered by ...
user avatar
  • 9,536
3 votes
Accepted

How to comply with 18 USC 2257A

So I suppose we basically need to disclose the exact geolocation of the datacenters that store this kind of content. That is incorrect. You need to identify a place of business where federal ...
user avatar
  • 24.6k
2 votes
Accepted

Is there a legal requirement for my hosting service to provide me with a copy/backup of my content?

It all comes down to the ToS you agreed to when you signed up with the host, or any changes made later. If it was in your ToS it is likely that they would have a fee for the time it takes. If it isn'...
user avatar
  • 460
2 votes
Accepted

Data Chain Of Custody

Owner claims cannot satisfy chain of custody if the data hit a cloud. Is that true? No. On the one hand, as you say, you can just include the cloud provider on the chain of custody. On the other hand,...
user avatar
  • 8,272
2 votes
Accepted

Is Encrypted Intellectual Property still considered Intellectual Property?

If it is fair use to copy it en clair then it is fair use to copy it enciphered. If it is not fair use en clair then it is not fair use enciphered. Enciphered works are derivative works of the ...
user avatar
  • 147k
2 votes

Is it legal for Grammarly to read, share and store forever all my emails?

Yes it is legal In fact, most online content hosts have similar provisions. For example: You Tube For clarity, you retain all of your ownership rights in your Content. However, by submitting ...
user avatar
  • 147k
2 votes

Does any host provider currently comply with GDPR?

Here's the Google equivalent of that Microsoft blog post: Our users can count on the fact that Google is committed to GDPR compliance across G Suite and Google Cloud Platform (GCP) services ...
user avatar
  • 121
2 votes

Can a U.S. business store mail on a server outside the U.S.?

In the absence of national security concerns, it is legal to store emails on mail servers outside the US. This is true even of information protected by HIPPA. This is a good thing, because the way ...
user avatar
  • 129k
2 votes

Under what conditions can an Asian company access Database hosted by a British company containing data of European citizens?

The GDPR doesn't talk about specific technologies used to access data. You are processing data of EU citizens, which is controlled by a UK company. They of course have their own obligations (as ...
user avatar
  • 4,786
2 votes

Should email addresses be anonymized/pseudonymized under GDPR?

The GDPR does not regulate specific security measures beyond making recommendations about what you should considder. It requires you to evalute risks and, if necessary, implement security measures to ...
user avatar
  • 3,022
2 votes

Does GDPR apply to personal information entered in a password-field?

This might be an unnecessary subtle point, but the goal of the GDPR isn't to protect personal data as some abstract concept – it regulates how personal data can be processed. For an organisation's ...
user avatar
  • 17.1k
2 votes

My child's name is "Robert'); drop table *;--" Is he in trouble?

No, your future first child would not get into trouble, since they cannot be held responsible for the initial name gave to them by another. You, as the 'responsible' parent may be held responsible ...
user avatar
  • 3,188
2 votes
Accepted

As an individual, not a company, if I collect email addresses of visitors to my website, what gdpr regulations apply to me?

The GDPR applies to all data controllers, regardless of whether the data controller is business or non-profit, corporation or natural person. However, there is an exception for purely personal or ...
user avatar
  • 17.1k
2 votes

Automated backups of my clients websites to cloud storage, who is legally at fault if the backup contains illegal/copyrighted material?

There are many jurisdictions in the world, and many types of "illegal material", so it is impossible to give a short universal answer. It is most likely that your business would not have ...
user avatar
  • 157k

Only top scored, non community-wiki answers of a minimum length are eligible