26
votes
Accepted
Does the German GDPR require storing the data in a German datacenter for a tele-health company?
The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in ...
- 24.1k
20
votes
Accepted
My child's name is "Robert'); drop table *;--" Am I in trouble?
Your kid is not in trouble; he's a minor. You're in trouble.
A criminal case for the charges a prosecutor would bring, i.e. destruction of property (the data) or for a relevant cyber or computer ...
- 19k
13
votes
Accepted
Is it okay to store user locations?
It seems clear that this is personal information under the GDPR. If you are subject to the GDPR, you need to have a "lawful basis" to store or process such information. (You are subject to the GDPR if ...
- 115k
7
votes
Accepted
Is one liable if illegal material is found on one's own server?
So far as I am aware, all jurisdictions provide some kind of defence to the offence of possessing child pornography (or, for that matter, other illegal items like drugs and weapons) for legal purposes....
- 9,356
6
votes
My child's name is "Robert'); drop table *;--" Am I in trouble?
No, your future first child would not get into trouble, since they cannot be held responsible for the initial name gave to them by another.
You, as the 'responsible' parent may be held responsible ...
- 5,736
6
votes
Accepted
Does any host provider currently comply with GDPR?
Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time.
Microsoft was one of the first (if not the ...
- 549
5
votes
Accepted
Deletion of personal data
Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"?
Article 15 defines a “...
- 821
5
votes
Accepted
The Data ownership for an automated server running for years prior to GDPR Regulations
There are a number of misconceptions in this question.
Firstly, the regulatory environment did not drastically change when the GDPR came into force in 2018. Previously, each EU member state had its ...
- 24.1k
4
votes
Accepted
Legality of data "chunking" concerning child pornography
18 U.S. Code § 2252 defines a crime and punishment for knowingly transporting, or reproducing for distribution by any means, visual depictions involving the use of a minor engaging in sexually ...
- 4,054
4
votes
Accepted
What is the legal status of data (intentionally deleted or not) on a second-hand computer?
Data, as it happens in law, can also be owned. That's why we have a discipline called "Intellectual Property". It is a "thing" - like other properties like cars, houses etc., someone owns it.
Now, ...
- 1,743
4
votes
For HIPAA, Does US Patient Data Have To Stay On US Servers?
No. This is governed by the HIPAA Security Rule which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt.
The Rule does require someone covered by ...
- 240k
4
votes
Legal jurisdiction over cloud storage
The law in every country where your service is available prevails. That means that if your servers are in Estonia, your file storage is in Lithuania, your company is in Switzerland, you are in France, ...
- 227k
4
votes
Accepted
How does GDPR's right to erasure apply to deduplicated storage?
I think there are a couple of different ways to look at this.
Deduplication is a technical detail that's irrelevant here
While the data may be deduplicated on a technical level, the files remain ...
- 24.1k
4
votes
Accepted
Is the inaccessibility of illegal data no defence to its keeping?
There is no way to answer your question in the abstract. Any answer will clearly depend on the meaning of any particular criminal prohibition.
For example, if the prohibition were: "no person may ...
- 72.7k
3
votes
GDPR and local data storage in mobile app
No. As long as you don't see and have no means to access this data, but it is under the control of the user at all times, you are neither the controller or the processor of this personal data, and the ...
- 3,282
3
votes
Should email addresses be anonymized/pseudonymized under GDPR?
The GDPR does not regulate specific security measures beyond making recommendations about what you should considder.
It requires you to evalute risks and, if necessary, implement security measures to ...
- 3,282
3
votes
My child's name is "Robert'); drop table *;--" Am I in trouble?
That string of characters is not acceptable as a name in some jurisdictions in the first place.
germany will block the name on the basis that the name is on one hand prone to damaging the child, and ...
- 45.2k
3
votes
Accepted
Does the European Union allow to store medical (sensitive) data in cloud platforms such as Amazon Web Services or Google Cloud?
Storing medical data in cloud services can be legal, but isn't necessarily so (as with any other kinds of data).
The GDPR considers health-related data as “special categories” of data per Art 9. ...
- 24.1k
3
votes
Accepted
Can cloud services providers be asked to turn over data from foreign countries?
Generally speaking a business can be subpoenaed to provide any records, electronic or otherwise, by any court with jurisdiction over that business. Most subpoenas are issued in the context of pending ...
- 240k
3
votes
Accepted
Is requesting a customer database for testing purposes legal?
It's not illegal to ask.
Whether they can give it to you, and under what circumstances, is another, much more complicated matter.
For instance, if the database contains health information covered by ...
- 10.3k
3
votes
Accepted
How to comply with 18 USC 2257A
So I suppose we basically need to disclose the exact geolocation of the datacenters that store this kind of content.
That is incorrect. You need to identify a place of business where federal ...
- 40.1k
2
votes
Accepted
Is Encrypted Intellectual Property still considered Intellectual Property?
If it is fair use to copy it en clair then it is fair use to copy it enciphered. If it is not fair use en clair then it is not fair use enciphered.
Enciphered works are derivative works of the ...
- 227k
2
votes
Is it legal for Grammarly to read, share and store forever all my emails?
Yes it is legal
In fact, most online content hosts have similar provisions. For example:
You Tube
For clarity, you retain all of your ownership rights in your Content. However, by submitting ...
- 227k
2
votes
Does any host provider currently comply with GDPR?
Here's the Google equivalent of that Microsoft blog post:
Our users can count on the fact that Google is committed to GDPR
compliance across G Suite and Google Cloud Platform (GCP) services
...
- 121
2
votes
Can a U.S. business store mail on a server outside the U.S.?
In the absence of national security concerns, it is legal to store emails on mail servers outside the US. This is true even of information protected by HIPAA.
This is a good thing, because the way the ...
- 240k
2
votes
Does GDPR apply to personal information entered in a password-field?
This might be an unnecessary subtle point, but the goal of the GDPR isn't to protect personal data as some abstract concept – it regulates how personal data can be processed. For an organisation's ...
- 24.1k
2
votes
Under what conditions can an Asian company access Database hosted by a British company containing data of European citizens?
The GDPR doesn't talk about specific technologies used to access data. You are processing data of EU citizens, which is controlled by a UK company. They of course have their own obligations (as ...
- 6,240
2
votes
Accepted
As an individual, not a company, if I collect email addresses of visitors to my website, what gdpr regulations apply to me?
The GDPR applies to all data controllers, regardless of whether the data controller is business or non-profit, corporation or natural person. However, there is an exception for purely personal or ...
- 24.1k
2
votes
Automated backups of my clients websites to cloud storage, who is legally at fault if the backup contains illegal/copyrighted material?
There are many jurisdictions in the world, and many types of "illegal material", so it is impossible to give a short universal answer. It is most likely that your business would not have ...
- 217k
Only top scored, non community-wiki answers of a minimum length are eligible