Hot answers tagged

29 votes
Accepted

Brute force, mass image production copyright trolling?

This has been asked about music. A large flaw is that independently creating something that has already been copyrighted is not copyright infringement. Copyright infringement requires copying, ...
user avatar
  • 7,311
26 votes
Accepted

Does the German GDPR require storing the data in a German datacenter for a tele-health company?

The goal of the GDPR is to ensure a single market for personal data processing throughout the EU. Since all EU/EEA member states now have equivalent levels of data protection, it doesn't matter in ...
user avatar
  • 17.2k
25 votes

Does derivative works law allow someone to create a new work based on an old one as long as they make modifications?

Your client is confused about how copyright law works (at least in the United States and virtually every other country I've ever heard about copyright in). If I were guessing, they read something like ...
user avatar
  • 9,556
11 votes
Accepted

If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?

The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “...
user avatar
  • 17.2k
7 votes
Accepted

Can a company charge you to update your address under GDPR?

Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have ...
user avatar
  • 17.2k
6 votes

Does derivative works law allow someone to create a new work based on an old one as long as they make modifications?

The client is mistaken. There is no such thing as "derivative Works law", at least not in the sense that the client suggests; there is only copyright law. US Copyright Law 17 USC 106 says: ...
user avatar
  • 92.7k
5 votes

GDPR: Can I collect non-personally identifiable information?

There are two relevant bodies of EU law to consider here. The GDPR covers processing of personal data. Personal data is any data where the data subject can be identified directly or indirectly. The ...
user avatar
  • 17.2k
4 votes
Accepted

Data copyright for public domain content or natural resources

Copyright protects literary and artistic expression, not facts. So, in a database, the structure of the tables, the construction of the queries and the presentation of the user interface are all ...
user avatar
  • 151k
4 votes

Do initials count as personal data?

Basically how reducible is personal information until it's no longer personal information? When it can no longer be used, alone or combined with other data, to identify a person (or small number of ...
user avatar
  • 151k
4 votes

How can you guarantee deletion of consumer data on the internet?

Neither the GDPR, nor the CCPA, nor any other data protection law that I am aware of, requires that when information is deleted on request, that similar information not be collected and stored in ...
user avatar
  • 92.7k
4 votes

Does derivative works law allow someone to create a new work based on an old one as long as they make modifications?

Derivative works add protection, they don't remove or replace any. If work X is created by A, then A gets protection for unauthorized use of X. If work Y is created by B as a derivative of X, then: A ...
user avatar
  • 474
3 votes

Supreme Court Cases That Have Been Decided on Statistical Evidence---Are There Any?

This is not, unfortunately, a direct answer to your question. Nonetheless, it might be of interest to you. The US Census has been the subject of extensive legal wrangling, ending in the Supreme Court ...
user avatar
  • 179
3 votes

Inactive account deleted under GDPR (data retention) laws. Should the credit on it have been refunded to the account holder?

There are two "cancellations" here. There is a contract between the customer and the company. This contract was ended. Also, as part of GDPR obligations, the data of the former customer was ...
user avatar
  • 4,844
3 votes

GDPR account verification

This is less of a compliance question, and more of an infosec question. On one hand, you want to be able to restore access to an account to users who have lost their access. On the other hand, you ...
user avatar
  • 17.2k
3 votes

If a company actively and knowingly displays user passwords to their staff, is it breaking GDPR laws?

GDPR regulations on the whole do not actually mention passwords (source: Information Commissioner's Office UK, this may vary in other country's implementation of GDPR) and providing that the data is ...
user avatar
3 votes

What does "structured, commonly used and machine-readable format" look like in practice?

Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined? No, the GDPR is based on "general principles"...
user avatar
  • 3,325
3 votes
Accepted

GDPR and Storing Non-EU Citizen Data as an EU-based company

are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU? Absolutely. The territorial scope of the GDPR is specified at ...
user avatar
  • 24.8k
3 votes

Is it illegal for a school to take photos of children during online classes?

There is no generally applicable law that that effect in the United States, although, of course, there are laws in fifty different states, plus the District of Columbia and U.S. territories, that I ...
user avatar
  • 134k
3 votes
Accepted

How long should I wait for a Data Access Request in Ireland

According to The official government page "Freedom of information (FOI)" FOI only applies to FOI bodies. These are mostly bodies that are publicly funded (for example, government ...
user avatar
  • 92.7k
2 votes

Does the GDPR law apply to my hobby-site?

Art. 2(2)(c) GDPR does include a personal use exception: This Regulation does not apply to the processing of personal data: (c) by a natural person in the course of a purely personal or ...
user avatar
  • 2,709
2 votes

How to legally distribute the data of all Internet websites?

You want to sell or distribute Intellectual Property owned by other entities? Depending on the jurisdiction it's likely that you will need permission from the IP owner.
user avatar
  • 5,648
2 votes

Is deterministic anonymization of test data ok?

You are not describing anonymization, you are describing pseudonymization. Recital 26: (26) The principles of data protection should apply to any information concerning an identified or ...
user avatar
  • 1,788
2 votes

Identity verification prior granting access to personal data [GDPR]

You should make sure that the person making the request is actually the data subject. However, you have a lot of flexibility to create an approach that is appropriate for your specific circumstances. ...
user avatar
  • 17.2k
2 votes

How does GDPR affect game data and how it is processed?

Sleep pattern and timezone deduction are arguably not "personal data" within the meaning of the GDPR. Personal data is defined in Article 4 as: any information relating to an identified or ...
user avatar
  • 3,325
2 votes

What does "structured, commonly used and machine-readable format" look like in practice?

The GDPR Art 20 right to data portability is distinct from the Art 15 right to access, although there is some overlap. The right to data portability likely applies here because processing is performed ...
user avatar
  • 17.2k
2 votes

Is there any legal recourse in the UK if an employee leaves with sensitive company information to a third world country?

You know you have legal recourse - your lawyers have advised you to budget £20,000 for it. You know the person you are targeting has no resources with which to reimburse you. You know enforcement will ...
user avatar
  • 151k
2 votes
Accepted

is fictional data covered by copyright?

That is an interesting question that I don't think has been tested in an highly analogous case. There are a number of sci-fi works that posit elaborate systems of made-up facts about Dragon's Egg and ...
user avatar
  • 160k
2 votes

Is it legal for a company to not allow me to download my data unless I pay for the premium plan?

...do I own the data on a website that I created an account? Maybe not. Read the Terms of Service for the site; it is a legally binding contract. The TOS will outline what you agree to when opening ...
user avatar
  • 17.6k
2 votes

Can I avoid telling the police my password by regenerating my key each time?

A key to a box containing a key to another box is still a key Similarly, a password that generates a password that gives access to your data is still a password, even if the intermediate password can (...
user avatar
  • 151k

Only top scored, non community-wiki answers of a minimum length are eligible