16

Does GDPR apply if my web app stores personal data on the user's phone only? No. If you are not processing Personally Identifiable Information (PII) then the GDPR does not apply to you. This is what a web browser does when it asks to remember your username and password for this web site. You are providing a tool, the user is using that tool to process ...


12

You're probably a data controller, but you have taken pretty good steps to limit your compliance obligations. Personal data is any information relating to an identifiable person. You are a data controller if you participate in determining the purposes and means of processing. The provider of a website is typically a data controller for any data that is ...


11

The GDPR does not have specific rules on passwords. Instead, the GDPR imposes a more general requirement to ensure data protection by implementing “appropriate” technical and organizational measures, “[t]aking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of ...


3

Article 10 (1) Basic Law / Art. 10 Abs. 1 Grundgesetz: The privacy of correspondence, posts, and telecommunications shall be inviolable. You can send whatever you want via postcard (as long as it doesn't constitute a different criminal offense). Technically, whoever were to decrypt your message, besides the addressee, would probably commit Data Espionage ...


3

There are two processes that go on all the time, and are generally considered legal: Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The history of SHA-1 is a good example of this. People ...


3

GDPR regulations on the whole do not actually mention passwords (source: Information Commissioner's Office UK, this may vary in other country's implementation of GDPR) and providing that the data is only accessible by authorised parties within the organisation within the parameters set out in user agreements and/or privacy policies, then the law isn't broken....


2

A key to a box containing a key to another box is still a key Similarly, a password that generates a password that gives access to your data is still a password, even if the intermediate password can (also) be used as a digital signature. The problem with your plan is that it starts with the basic assumption that courts are stupid and only apply the literal ...


2

Handheld transceivers are usually operated under some portion of 47 CFR 95 (Personal Radio Services). Typically, this is subpart B (Family Radio Service) or subpart D (CB Radio Service); occasionally it's subpart E (General Mobile Radio Service. CB Radio Service only permits plain-language voice communication. Not only is encryption prohibited, using coded ...


2

Q: Could UK law enforcement enforce RIPA section 49 on a company outside the UK? NO For two reasons: RIPA 2000 is not extraterritorial so only applies in England, Wales and Northern Ireland - there is no power to compel a foreign company to comply. The  procedure to obtain material in an evidential format from, say, a foreign service provider is not RIPA ...


2

Only literary or artistic works have copyright A number, on its own, is neither. Of course, a number that is a digital representation of say, The Lord if the Rings, is a copy of a copyrighted work but it is not, of itself, copyrighted.


1

Encryption is a mandatory safety measure which might mitigate some risks to data subjects and could therefore influence whether a breach must be reported. It does not affect your accountability or liability. Per Art 32, the data controller is responsible for implementing appropriate technical and organizational safety measures. What is appropriate e.g. ...


1

Since you are able to encrypt the data, the data is clearly personal data for you. That means you will have to comply with the GDPR regarding how you process and store this data. This involves disclosing recipients of this data per Art 13(1)(e), and only engaging data processors in line with Art 28. Your storage provider such as Azure and AWS cannot decrypt ...


1

You can't copy the book in any way shape or form without permission, that is what copyright protection means. You can't convert if from one format to another, you can't OCR it to a PDF or image-scan a print book into a big picture file. There is a gray tolerance or license area where you may have permission to install multiple copies on a personal device, ...


1

Under Art 25 and Art 32 GDPR, a data controller is required to implement appropriate security measures. Encryption is explicitly suggested as a potential measure. What is appropriate depends among other factors on a risk-based analysis. Here, I can't see any threat model that would reasonably require encryption of a locally stored literature database. I ...


1

Yes The law gives the nominated agencies the power to demand keys from anyone, anywhere. Refusal to hand them over is a crime punishable by imprisonment of up to 2 years (5 years for child abuse or national security reasons). People have been tried, convicted and gaoled for non compliance. As a practical matter, enforcing this on people outside the ...


1

I think that the gender will likely not be sensitive in the context of your experiment, but whether your experiment would be GDPR-compliant would depend on the details. gender is considered as "Personal data" which is ‘sensitive’ Yes, the gender of a particular person is that person's personal data, since (a) the person is identifiable and (b) ...


Only top voted, non community-wiki answers of a minimum length are eligible